From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 804E0C43381 for ; Fri, 15 Feb 2019 10:01:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5B06F21924 for ; Fri, 15 Feb 2019 10:01:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2405535AbfBOKBh (ORCPT ); Fri, 15 Feb 2019 05:01:37 -0500 Received: from relay.sw.ru ([185.231.240.75]:33698 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726159AbfBOKBh (ORCPT ); Fri, 15 Feb 2019 05:01:37 -0500 Received: from [172.16.25.12] by relay.sw.ru with esmtp (Exim 4.91) (envelope-from ) id 1guaJA-0003fU-Ra; Fri, 15 Feb 2019 13:01:24 +0300 Subject: Re: [PATCH v5 3/3] powerpc/32: Add KASAN support To: Christophe Leroy , Daniel Axtens , Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Nicholas Piggin , "Aneesh Kumar K.V" , Alexander Potapenko , Dmitry Vyukov Cc: linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kasan-dev@googlegroups.com, linux-mm@kvack.org References: <3429fe33b68206ecc2a725a740937bbaef2d1ac8.1549935251.git.christophe.leroy@c-s.fr> <8736oq3u2r.fsf@dja-thinkpad.axtens.net> From: Andrey Ryabinin Message-ID: Date: Fri, 15 Feb 2019 13:01:46 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2/15/19 11:41 AM, Christophe Leroy wrote: > > > Le 14/02/2019 à 23:04, Daniel Axtens a écrit : >> Hi Christophe, >> >>> --- a/arch/powerpc/include/asm/string.h >>> +++ b/arch/powerpc/include/asm/string.h >>> @@ -27,6 +27,20 @@ extern int memcmp(const void *,const void *,__kernel_size_t); >>>   extern void * memchr(const void *,int,__kernel_size_t); >>>   extern void * memcpy_flushcache(void *,const void *,__kernel_size_t); >>>   +void *__memset(void *s, int c, __kernel_size_t count); >>> +void *__memcpy(void *to, const void *from, __kernel_size_t n); >>> +void *__memmove(void *to, const void *from, __kernel_size_t n); >>> + >>> +#if defined(CONFIG_KASAN) && !defined(__SANITIZE_ADDRESS__) >>> +/* >>> + * For files that are not instrumented (e.g. mm/slub.c) we >>> + * should use not instrumented version of mem* functions. >>> + */ >>> +#define memcpy(dst, src, len) __memcpy(dst, src, len) >>> +#define memmove(dst, src, len) __memmove(dst, src, len) >>> +#define memset(s, c, n) __memset(s, c, n) >>> +#endif >>> + >> >> I'm finding that I miss tests like 'kasan test: kasan_memcmp >> out-of-bounds in memcmp' because the uninstrumented asm version is used >> instead of an instrumented C version. I ended up guarding the relevant >> __HAVE_ARCH_x symbols behind a #ifndef CONFIG_KASAN and only exporting >> the arch versions if we're not compiled with KASAN. >> >> I find I need to guard and unexport strncpy, strncmp, memchr and >> memcmp. Do you need to do this on 32bit as well, or are those tests >> passing anyway for some reason? > > Indeed, I didn't try the KASAN test module recently, because my configs don't have CONFIG_MODULE by default. > > Trying to test it now, I am discovering that module loading oopses with latest version of my series, I need to figure out exactly why. Here below the oops by modprobing test_module (the one supposed to just say hello to the world). > > What we see is an access to the RO kasan zero area. > > The shadow mem is 0xf7c00000..0xffc00000 > Linear kernel memory is shadowed by 0xf7c00000-0xf8bfffff > 0xf8c00000-0xffc00000 is shadowed read only by the kasan zero page. > > Why is kasan trying to access that ? Isn't kasan supposed to not check stuff in vmalloc area ? It tries to poison global variables in modules. If module is in vmalloc, than it will try to poison vmalloc. Given that the vmalloc area is not so big on 32bits, the easiest solution is to cover all vmalloc with RW shadow.