From patchwork Mon Sep 5 21:05:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 12966573 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5E6AECAAD3 for ; Mon, 5 Sep 2022 21:11:26 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4CFDE80229; Mon, 5 Sep 2022 17:11:24 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 47E6780224; Mon, 5 Sep 2022 17:11:24 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 236ED80229; Mon, 5 Sep 2022 17:11:24 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 0E23D80224 for ; Mon, 5 Sep 2022 17:11:24 -0400 (EDT) Received: from smtpin02.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id E675A80533 for ; Mon, 5 Sep 2022 21:11:23 +0000 (UTC) X-FDA: 79879277646.02.E70520E Received: from out2.migadu.com (out2.migadu.com [188.165.223.204]) by imf20.hostedemail.com (Postfix) with ESMTP id 731C01C0088 for ; Mon, 5 Sep 2022 21:11:23 +0000 (UTC) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1662412282; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TrkbSYuQGAnlXN7bh4mnqFPtjr4fL87+nLp2f5EX6NA=; b=hFYsB+FzPJ+FMrutd8rfqpTd1/qyrIHDsk10pkOlOch0JdxywpM+FON5VmXfk94r6IrdeN 2KcXHltXuShi44sD2apcKfLPXWzkG+tZROT87p4SyY5zw97cgHWRkxAWVLWNNRMPYrZrft YKn/EmvzNmY4bEmebCNuwgrpxR4lM1c= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Peter Collingbourne , Evgenii Stepanov , Florian Mayer , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm v3 34/34] kasan: add another use-after-free test Date: Mon, 5 Sep 2022 23:05:49 +0200 Message-Id: <0659cfa15809dd38faa02bc0a59d0b5dbbd81211.1662411800.git.andreyknvl@google.com> In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Migadu-Auth-User: linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1662412283; a=rsa-sha256; cv=none; b=iseAUFSmfBHipa5zoQIGi6I0W0ywlgVG/gRyVG7OsUZW+VBFqSSk/KxD5m6fopGmvZTSzL 0jZIObLqGcQZMEc1NNtzeIiubjmEFhQctlDqpF5e4qfjK7Lc+g3joSrHeWIkUr4yi9rK/h 8FrkXnPzKQqAI+6Zsqsm7MsozDBhTnc= ARC-Authentication-Results: i=1; imf20.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=hFYsB+Fz; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf20.hostedemail.com: domain of andrey.konovalov@linux.dev designates 188.165.223.204 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1662412283; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=TrkbSYuQGAnlXN7bh4mnqFPtjr4fL87+nLp2f5EX6NA=; b=h+aBkyu7oPoL9sQlHeG+qTT90WcLqdCmGbXOvxlrBC5JtsK16smebF4N10Di6ohJrENOGA VwujfYUTeB5lD5seaM5Sxd0XBTVqWtkpJsWDK8FEORyr+dx2EniGlvSwr1db5yB6Yh7hw/ FeSmSl6K8zwVnDSCdQrio65zYCGMH4s= X-Rspamd-Queue-Id: 731C01C0088 X-Rspam-User: Authentication-Results: imf20.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=hFYsB+Fz; dmarc=pass (policy=none) header.from=linux.dev; spf=pass (imf20.hostedemail.com: domain of andrey.konovalov@linux.dev designates 188.165.223.204 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev X-Rspamd-Server: rspam10 X-Stat-Signature: u4imadxjk8rby7yz8wsiyk3668unrqqn X-HE-Tag: 1662412283-355905 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Andrey Konovalov Add a new use-after-free test that checks that KASAN detects use-after-free when another object was allocated in the same slot. This test is mainly relevant for the tag-based modes, which do not use quarantine. Once [1] is resolved, this test can be extended to check that the stack traces in the report point to the proper kmalloc/kfree calls. [1] https://bugzilla.kernel.org/show_bug.cgi?id=212203 Signed-off-by: Andrey Konovalov --- Changes v2->v3: - This is a new patch. --- lib/test_kasan.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 58c1b01ccfe2..505f77ffad27 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -612,6 +612,29 @@ static void kmalloc_uaf2(struct kunit *test) kfree(ptr2); } +/* + * Check that KASAN detects use-after-free when another object was allocated in + * the same slot. Relevant for the tag-based modes, which do not use quarantine. + */ +static void kmalloc_uaf3(struct kunit *test) +{ + char *ptr1, *ptr2; + size_t size = 100; + + /* This test is specifically crafted for tag-based modes. */ + KASAN_TEST_NEEDS_CONFIG_OFF(test, CONFIG_KASAN_GENERIC); + + ptr1 = kmalloc(size, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); + kfree(ptr1); + + ptr2 = kmalloc(size, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2); + kfree(ptr2); + + KUNIT_EXPECT_KASAN_FAIL(test, ((volatile char *)ptr1)[8]); +} + static void kfree_via_page(struct kunit *test) { char *ptr; @@ -1382,6 +1405,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kmalloc_uaf), KUNIT_CASE(kmalloc_uaf_memset), KUNIT_CASE(kmalloc_uaf2), + KUNIT_CASE(kmalloc_uaf3), KUNIT_CASE(kfree_via_page), KUNIT_CASE(kfree_via_phys), KUNIT_CASE(kmem_cache_oob),