From patchwork Tue Aug 14 07:55:22 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kyeongdon Kim X-Patchwork-Id: 10565171 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7BBFD1815 for ; Tue, 14 Aug 2018 07:55:52 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 667DD297CA for ; Tue, 14 Aug 2018 07:55:52 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 57158297D5; Tue, 14 Aug 2018 07:55:52 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 4C0DD297CA for ; Tue, 14 Aug 2018 07:55:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=4bwsuUKupblLH0JZycjymDL3KQGFS9PXMmU/kerIH6Y=; b=E+z x8/wq8Uz8uD6Ld880rzKoqUFEBF3MqzjonGu8hFuSM37sJkDfyrhxNJaA6Afqk78Bad14ysenF4H/ 8miMvDWYM1OIG/E7XLyVFCufZNZUs/ztT3uMZFBmS+TGUd8Z5WBJBkjTTHMiJQ7QZp8xUrgqdaeAU YScbZN1xULkynLG5HndzdXXP8K/HcxBfPmjcuzXGnm/p0LRIHYwBt09jyHzeyYaBnXVMxEdVQTtdY 13REx/AfyZvQae4stgzvfcQJcl9TOq2v6DI4SyyQMw65bAnLop0xAEVhxbcYl9FqgvJ/qkFQzuSQf KMLFIT9T2J/ytuV4zeSgmjGg8qP9VVA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fpUB7-0005UM-Lc; Tue, 14 Aug 2018 07:55:45 +0000 Received: from lgeamrelo12.lge.com ([156.147.23.52] helo=lgeamrelo11.lge.com) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fpUB3-0005T7-LT for linux-arm-kernel@lists.infradead.org; Tue, 14 Aug 2018 07:55:43 +0000 Received: from unknown (HELO lgemrelse6q.lge.com) (156.147.1.121) by 156.147.23.52 with ESMTP; 14 Aug 2018 16:55:24 +0900 X-Original-SENDERIP: 156.147.1.121 X-Original-MAILFROM: kyeongdon.kim@lge.com Received: from unknown (HELO localhost.localdomain) (10.168.176.142) by 156.147.1.121 with ESMTP; 14 Aug 2018 16:55:24 +0900 X-Original-SENDERIP: 10.168.176.142 X-Original-MAILFROM: kyeongdon.kim@lge.com From: Kyeongdon Kim To: aryabinin@virtuozzo.com, catalin.marinas@arm.com, glider@google.com, dvyukov@google.com Subject: [PATCH] arm64: lib: use c string functions for KASAN support Date: Tue, 14 Aug 2018 16:55:22 +0900 Message-Id: <1534233322-106271-1-git-send-email-kyeongdon.kim@lge.com> X-Mailer: git-send-email 2.6.2 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180814_005541_978117_657E6F22 X-CRM114-Status: UNSURE ( 8.75 ) X-CRM114-Notice: Please train this message. X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: mark.rutland@arm.com, Jason@zx2c4.com, peterz@infradead.org, gregkh@linuxfoundation.org, will.deacon@arm.com, linux-kernel@vger.kernel.org, kyeongdon.kim@lge.com, mingo@kernel.org, linux-arm-kernel@lists.infradead.org MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Assembly optimized string functions cannot detect KASan bug. This might have been the intention of the original author. (not too much important to catch) But, I found the obvious uaf problem in strcmp() function. - in this case, using 32bit KASan patchset helps Since I used c string function, I believe I could find this bug. After using the patch, can see the report & backtrace the below: ================================================================== BUG: KASAN: use-after-free in strcmp+0x1c/0x5c at addr ffffffc0ad313500 Read of size 1 by task swapper/0/1 CPU: 3 PID: 1 Comm: swapper/0 Tainted: G B 4.9.77+ #1 Hardware name: Generic (DT) based system Call trace: [] dump_backtrace+0x0/0x2e0 [] show_stack+0x14/0x1c [] dump_stack+0x88/0xb0 [] kasan_object_err+0x24/0x7c [] kasan_report+0x2f0/0x484 [] __asan_load1+0x24/0x50 [] strcmp+0x1c/0x5c [] platform_match+0x40/0xe4 [] __driver_attach+0x40/0x130 [] bus_for_each_dev+0xc4/0xe0 [] driver_attach+0x30/0x3c [] bus_add_driver+0x2dc/0x328 [] driver_register+0x118/0x160 [] __platform_driver_register+0x7c/0x88 [] alarmtimer_init+0x154/0x1e4 [] do_one_initcall+0x184/0x1a4 [] kernel_init_freeable+0x2ec/0x2f0 [] kernel_init+0x18/0x10c [] ret_from_fork+0x10/0x50 Object at ffffffc0ad313500, in cache kmalloc-64 size: 64 Allocated: PID = 1 save_stack_trace_tsk+0x0/0x194 save_stack_trace+0x18/0x20 kasan_kmalloc+0xa8/0x154 kasan_slab_alloc+0x14/0x1c __kmalloc_track_caller+0x178/0x2a0 kvasprintf+0x80/0x104 kvasprintf_const+0xcc/0xd0 kobject_set_name_vargs+0x54/0xd4 dev_set_name+0x64/0x84 of_device_make_bus_id+0xc4/0x140 of_device_alloc+0x1e0/0x200 of_platform_device_create_pdata+0x70/0xf4 of_platform_bus_create+0x448/0x508 of_platform_populate+0xf4/0x104 of_platform_default_populate+0x20/0x28 of_platform_default_populate_init+0x68/0x78 Freed: PID = 1 save_stack_trace_tsk+0x0/0x194 save_stack_trace+0x18/0x20 kasan_slab_free+0xa0/0x14c kfree+0x174/0x288 kfree_const+0x2c/0x38 kobject_rename+0x12c/0x160 device_rename+0xa8/0x110 mt_usb_probe+0x218/0x760 platform_drv_probe+0x74/0xd0 driver_probe_device+0x3d4/0x614 __driver_attach+0xc8/0x130 bus_for_each_dev+0xc4/0xe0 driver_attach+0x30/0x3c bus_add_driver+0x2dc/0x328 driver_register+0x118/0x160 __platform_driver_register+0x7c/0x88 Memory state around the buggy address: ffffffc0ad313300: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffffffc0ad313400: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc >ffffffc0ad313500: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ^ ffffffc0ad313600: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc ffffffc0ad313700: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Signed-off-by: Kyeongdon Kim --- arch/arm64/include/asm/string.h | 2 ++ arch/arm64/kernel/arm64ksyms.c | 2 ++ arch/arm64/lib/Makefile | 8 +++++--- 3 files changed, 9 insertions(+), 3 deletions(-) diff --git a/arch/arm64/include/asm/string.h b/arch/arm64/include/asm/string.h index dd95d33..5c5219a 100644 --- a/arch/arm64/include/asm/string.h +++ b/arch/arm64/include/asm/string.h @@ -16,6 +16,7 @@ #ifndef __ASM_STRING_H #define __ASM_STRING_H +#if !defined(CONFIG_KASAN) #define __HAVE_ARCH_STRRCHR extern char *strrchr(const char *, int c); @@ -33,6 +34,7 @@ extern __kernel_size_t strlen(const char *); #define __HAVE_ARCH_STRNLEN extern __kernel_size_t strnlen(const char *, __kernel_size_t); +#endif #define __HAVE_ARCH_MEMCPY extern void *memcpy(void *, const void *, __kernel_size_t); diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c index d894a20..eb9bf20 100644 --- a/arch/arm64/kernel/arm64ksyms.c +++ b/arch/arm64/kernel/arm64ksyms.c @@ -44,12 +44,14 @@ EXPORT_SYMBOL(__arch_copy_in_user); EXPORT_SYMBOL(memstart_addr); /* string / mem functions */ +#if !defined(CONFIG_KASAN) EXPORT_SYMBOL(strchr); EXPORT_SYMBOL(strrchr); EXPORT_SYMBOL(strcmp); EXPORT_SYMBOL(strncmp); EXPORT_SYMBOL(strlen); EXPORT_SYMBOL(strnlen); +#endif EXPORT_SYMBOL(memset); EXPORT_SYMBOL(memcpy); EXPORT_SYMBOL(memmove); diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile index 68755fd..aa2d457 100644 --- a/arch/arm64/lib/Makefile +++ b/arch/arm64/lib/Makefile @@ -2,9 +2,11 @@ lib-y := clear_user.o delay.o copy_from_user.o \ copy_to_user.o copy_in_user.o copy_page.o \ clear_page.o memchr.o memcpy.o memmove.o memset.o \ - memcmp.o strcmp.o strncmp.o strlen.o strnlen.o \ - strchr.o strrchr.o tishift.o - + memcmp.o tishift.o +ifndef CONFIG_KASAN +lib-y := strcmp.o strncmp.o strlen.o strnlen.o \ + strchr.o strrchr.o +endif # Tell the compiler to treat all general purpose registers (with the # exception of the IP registers, which are already handled by the caller # in case of a PLT) as callee-saved, which allows for efficient runtime