From patchwork Wed Jan 18 09:38:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: =?utf-8?b?S3Vhbi1ZaW5nIExlZSAo5p2O5Yag56mOKQ==?= X-Patchwork-Id: 13105967 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5EA47C004D4 for ; Wed, 18 Jan 2023 09:39:12 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 840356B0078; Wed, 18 Jan 2023 04:39:11 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 7EFB06B007B; Wed, 18 Jan 2023 04:39:11 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 690696B007D; Wed, 18 Jan 2023 04:39:11 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 56C126B0078 for ; Wed, 18 Jan 2023 04:39:11 -0500 (EST) Received: from smtpin10.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 249E8403E5 for ; Wed, 18 Jan 2023 09:39:11 +0000 (UTC) X-FDA: 80367421302.10.1C0715F Received: from mailgw01.mediatek.com (mailgw01.mediatek.com [216.200.240.184]) by imf17.hostedemail.com (Postfix) with ESMTP id 18BC640004 for ; Wed, 18 Jan 2023 09:39:07 +0000 (UTC) Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=mediatek.com header.s=dk header.b=V8eIWzGw; spf=pass (imf17.hostedemail.com: domain of kuan-ying.lee@mediatek.com designates 216.200.240.184 as permitted sender) smtp.mailfrom=kuan-ying.lee@mediatek.com; dmarc=pass (policy=quarantine) header.from=mediatek.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1674034749; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=WaDG+rrqxlJT/6GIGWHNWGiT1aQrPsWBNzoW/dbYNnM=; b=QaghOesgqhIb0aMiChG2Kot0cEIsTYecV4mACn3IRTw/TZPcc15YafRkIJv2T1vNXgcgHN EhmmbaVLq+51uUAe1LzCu48BQE0aP/VGx71dibhW9YJDel398bDlXysSoXjjTt4KAxZD/2 wXZkVlL4ekPFhVMFKf0rWvw2EaFPJvA= ARC-Authentication-Results: i=1; imf17.hostedemail.com; dkim=pass header.d=mediatek.com header.s=dk header.b=V8eIWzGw; spf=pass (imf17.hostedemail.com: domain of kuan-ying.lee@mediatek.com designates 216.200.240.184 as permitted sender) smtp.mailfrom=kuan-ying.lee@mediatek.com; dmarc=pass (policy=quarantine) header.from=mediatek.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1674034749; a=rsa-sha256; cv=none; b=XBmv0t31MNQFIohxyyETOSLhE4JGIjolN7IXC87muYKJjC9gK/hVFKiTOp68IHcUWvrSK/ 4UpndEhCv5PeD5ILaXMh19t246Th6cSwbCYRNyiAac3GnmbGSYefYM/4e4WGQQacR6Ftmk OyyfcmrQQlGR8ENLjxytfNfmSxSq++c= X-UUID: efb136fc971311edbbe3f76fe852e059-20230118 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=WaDG+rrqxlJT/6GIGWHNWGiT1aQrPsWBNzoW/dbYNnM=; b=V8eIWzGwUm3H3qqhVEsZDmJB+fBOvydGVPyVJrVUyXF7+fnAFH8F0U84AmMsTqCt3u81Cdj2I7KV+YxTbqLNn6bUX1wWF3yjr41Ld1o9RmNKa/TiL4ySSLQh05BjDfVOy6+ZhXio0+Njmg5yMzHXEInFK6SwXn/BqDJmMHit1fk=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.18,REQID:96488671-7f99-4e40-acc7-fb014ad925b8,IP:0,U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:95,FILE:0,BULK:0,RULE:Release_Ham,ACTION :release,TS:95 X-CID-INFO: VERSION:1.1.18,REQID:96488671-7f99-4e40-acc7-fb014ad925b8,IP:0,URL :0,TC:0,Content:0,EDM:0,RT:0,SF:95,FILE:0,BULK:0,RULE:Spam_GS981B3D,ACTION :quarantine,TS:95 X-CID-META: VersionHash:3ca2d6b,CLOUDID:7fd90055-dd49-462e-a4be-2143a3ddc739,B ulkID:230118173901PP2WWLL9,BulkQuantity:0,Recheck:0,SF:38|28|17|19|48,TC:n il,Content:0,EDM:-3,IP:nil,URL:1,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OS I:0,OSA:0 X-CID-BVR: 0 X-UUID: efb136fc971311edbbe3f76fe852e059-20230118 Received: from mtkmbs13n1.mediatek.inc [(172.21.101.193)] by mailgw01.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1680895235; Wed, 18 Jan 2023 02:38:59 -0700 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs10n1.mediatek.inc (172.21.101.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.15; Wed, 18 Jan 2023 17:38:57 +0800 Received: from mtksdccf07.mediatek.inc (172.21.84.99) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.792.15 via Frontend Transport; Wed, 18 Jan 2023 17:38:57 +0800 From: Kuan-Ying Lee To: Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , "Andrew Morton" , Matthias Brugger CC: , , Kuan-Ying Lee , , , , , Subject: [PATCH v2] kasan: infer the requested size by scanning shadow memory Date: Wed, 18 Jan 2023 17:38:30 +0800 Message-ID: <20230118093832.1945-1-Kuan-Ying.Lee@mediatek.com> X-Mailer: git-send-email 2.18.0 MIME-Version: 1.0 X-MTK: N X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 18BC640004 X-Stat-Signature: tnk9uxi7uody63ic6xjtf3phn31kqjiy X-HE-Tag: 1674034747-81208 X-HE-Meta: U2FsdGVkX1/3HYD/eBgffTqWVg80cAqMsn78ZJNy7PLicc900FBcxyik0T4Hfx30wanAqZVNKh9SHKtyoBWDAtWg7BC8UMWhTGIcOIQusaL3A3AtERsaI9EfvY3Jm8znOu1IvqrxRv72HxibWqYRIdgoTwCbTLw4/5p9jbHcVrV67KI5p9cDeZhN7CVruWxFnSKawTS8CY9vE4mdJWzJid27zi5FIDvNBW2GxkMGQrzHWkYmJ5c9GQYWe20xqdofoaSgYuIeSloc8V09TegH5mLWV2YqXBb4G3tRxdY1Cb9q1QhnMfmuqwhDeTdRlKIRdalT6QRySG6aHBUZVTkMqx/Km70zuUgpuhNzCibA0RzIQ/E350tsbGrTOX23OZ738SVPg+av6IRwlktXANCdHTjt2JSfSfhbX4Rhf3/0SZ+O5iUo27roXZFqcbTirQ9e2gcBk9KZmaR/rCiwzUp6OSuBD7zsPW06ee+g/viydUIxSRG0UY/v35eE1mFXrJlwmszc53cYvZe0UV9XRytJGxyj87DSGhu6Tfk7FgwyqBCmF23jmxW2vi092Oyx4UtSlBa4pPEUh9lu8ynmV3FWTaSYmMo0WLOFP9jIKCX91mnUKVm6N6ZAqFvup/HRY0o5y3nO7BPxZaoq46p9YB7t/rYg4IB4JMhcs+p4LOgC51xe5pzhZDN8TInc020Sc6+35j3Vhk5MLJl59sAImINbcU8EbJbKpR8xS5o4uuRS/FMDT7KSRBA77X3yhuxFLTlhAivh3dh3Te/ESFWh3V3avXnlCugoflsss6V3AeD/4FSqEtjol+RCacovvxtgw6716h99mWmqlQhvTZuZshPRES/Ot2dSJ87PIj62rgNXml9dn3PNL1FE9hjtxZjUYblv5605iHUCr5OiNcQqpv7XHBFVEY0djWQXMlXonjUqVfQ482rtX7BBxLMuh026rBTK4y3F9OrlZ58= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: We scan the shadow memory to infer the requested size instead of printing cache->object_size directly. This patch will fix the confusing kasan slab-out-of-bounds report like below. [1] Report shows "cache kmalloc-192 of size 192", but user actually kmalloc(184). ================================================================== BUG: KASAN: slab-out-of-bounds in _find_next_bit+0x143/0x160 lib/find_bit.c:109 Read of size 8 at addr ffff8880175766b8 by task kworker/1:1/26 ... The buggy address belongs to the object at ffff888017576600 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 184 bytes inside of 192-byte region [ffff888017576600, ffff8880175766c0) ... Memory state around the buggy address: ffff888017576580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff888017576600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888017576680: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ^ ffff888017576700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888017576780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== After this patch, slab-out-of-bounds report will show as below. ================================================================== ... The buggy address belongs to the object at ffff888017576600 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 0 bytes right of allocated 184-byte region [ffff888017576600, ffff8880175766b8) ... ================================================================== Link: https://bugzilla.kernel.org/show_bug.cgi?id=216457 [1] Signed-off-by: Kuan-Ying Lee --- V1 -> V2: - Implement getting allocated size of object for tag-based kasan. - Refine the kasan report. - Check if it is slab-out-of-bounds report type. - Thanks for Andrey and Dmitry suggestion. mm/kasan/kasan.h | 2 ++ mm/kasan/report.c | 20 +++++++++++++------- mm/kasan/report_generic.c | 24 ++++++++++++++++++++++++ mm/kasan/report_hw_tags.c | 18 ++++++++++++++++++ mm/kasan/report_sw_tags.c | 17 +++++++++++++++++ mm/kasan/report_tags.c | 8 ++++++++ 6 files changed, 82 insertions(+), 7 deletions(-) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index abbcc1b0eec5..15ffd46fec6a 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -185,6 +185,7 @@ struct kasan_report_info { const char *bug_type; struct kasan_track alloc_track; struct kasan_track free_track; + int obj_size; }; /* Do not change the struct layout: compiler ABI. */ @@ -306,6 +307,7 @@ static inline bool addr_has_metadata(const void *addr) void *kasan_find_first_bad_addr(void *addr, size_t size); void kasan_complete_mode_report_info(struct kasan_report_info *info); void kasan_metadata_fetch_row(char *buffer, void *row); +int kasan_get_alloc_size(void *object_addr, struct kmem_cache *cache); #if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) void kasan_print_tags(u8 addr_tag, const void *addr); diff --git a/mm/kasan/report.c b/mm/kasan/report.c index df3602062bfd..dae0d4ae8fe9 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -210,12 +210,13 @@ static inline struct page *addr_to_page(const void *addr) } static void describe_object_addr(const void *addr, struct kmem_cache *cache, - void *object) + void *object, int obj_size, const char *bug_type) { unsigned long access_addr = (unsigned long)addr; unsigned long object_addr = (unsigned long)object; const char *rel_type; int rel_bytes; + bool slab_oob = false; pr_err("The buggy address belongs to the object at %px\n" " which belongs to the cache %s of size %d\n", @@ -224,18 +225,22 @@ static void describe_object_addr(const void *addr, struct kmem_cache *cache, if (access_addr < object_addr) { rel_type = "to the left"; rel_bytes = object_addr - access_addr; - } else if (access_addr >= object_addr + cache->object_size) { + } else if (access_addr >= object_addr + obj_size) { rel_type = "to the right"; - rel_bytes = access_addr - (object_addr + cache->object_size); + rel_bytes = access_addr - (object_addr + obj_size); } else { rel_type = "inside"; rel_bytes = access_addr - object_addr; } + if (strcmp(bug_type, "slab-out-of-bounds") == 0) + slab_oob = true; + pr_err("The buggy address is located %d bytes %s of\n" - " %d-byte region [%px, %px)\n", - rel_bytes, rel_type, cache->object_size, (void *)object_addr, - (void *)(object_addr + cache->object_size)); + " %s%d-byte region [%px, %px)\n", + rel_bytes, rel_type, slab_oob ? "allocated " : "", + obj_size, (void *)object_addr, + (void *)(object_addr + obj_size)); } static void describe_object_stacks(struct kasan_report_info *info) @@ -257,7 +262,8 @@ static void describe_object(const void *addr, struct kasan_report_info *info) { if (kasan_stack_collection_enabled()) describe_object_stacks(info); - describe_object_addr(addr, info->cache, info->object); + describe_object_addr(addr, info->cache, info->object, info->obj_size, + info->bug_type); } static inline bool kernel_or_module_addr(const void *addr) diff --git a/mm/kasan/report_generic.c b/mm/kasan/report_generic.c index 043c94b04605..7b4bec9e6d1a 100644 --- a/mm/kasan/report_generic.c +++ b/mm/kasan/report_generic.c @@ -43,6 +43,25 @@ void *kasan_find_first_bad_addr(void *addr, size_t size) return p; } +int kasan_get_alloc_size(void *addr, struct kmem_cache *cache) +{ + int size = 0; + u8 *shadow; + + shadow = (u8 *)kasan_mem_to_shadow(addr); + while (size < cache->object_size) { + if (*shadow == 0) + size += KASAN_GRANULE_SIZE; + else if (*shadow >= 1 && *shadow <= KASAN_GRANULE_SIZE - 1) + size += *shadow; + else + return size; + shadow++; + } + + return cache->object_size; +} + static const char *get_shadow_bug_type(struct kasan_report_info *info) { const char *bug_type = "unknown-crash"; @@ -149,6 +168,11 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) memcpy(&info->free_track, &free_meta->free_track, sizeof(info->free_track)); } + + if (strcmp(info->bug_type, "slab-out-of-bounds") == 0) + info->obj_size = kasan_get_alloc_size(info->object, info->cache); + else + info->obj_size = info->cache->object_size; } void kasan_metadata_fetch_row(char *buffer, void *row) diff --git a/mm/kasan/report_hw_tags.c b/mm/kasan/report_hw_tags.c index f3d3be614e4b..e462dd750fe2 100644 --- a/mm/kasan/report_hw_tags.c +++ b/mm/kasan/report_hw_tags.c @@ -21,6 +21,24 @@ void *kasan_find_first_bad_addr(void *addr, size_t size) return kasan_reset_tag(addr); } +int kasan_get_alloc_size(void *addr, struct kmem_cache *cache) +{ + int size = 0, i = 0; + u8 memory_tag; + + while (size < cache->object_size) { + memory_tag = hw_get_mem_tag(addr + i * KASAN_GRANULE_SIZE); + + if (memory_tag != KASAN_TAG_INVALID) + size += KASAN_GRANULE_SIZE; + else + return size; + i++; + } + + return cache->object_size; +} + void kasan_metadata_fetch_row(char *buffer, void *row) { int i; diff --git a/mm/kasan/report_sw_tags.c b/mm/kasan/report_sw_tags.c index 7a26397297ed..d50caefd7fd5 100644 --- a/mm/kasan/report_sw_tags.c +++ b/mm/kasan/report_sw_tags.c @@ -45,6 +45,23 @@ void *kasan_find_first_bad_addr(void *addr, size_t size) return p; } +int kasan_get_alloc_size(void *addr, struct kmem_cache *cache) +{ + int size = 0; + u8 *shadow; + + shadow = (u8 *)kasan_mem_to_shadow(addr); + while (size < cache->object_size) { + if (*shadow != KASAN_TAG_INVALID) + size += KASAN_GRANULE_SIZE; + else + return size; + shadow++; + } + + return cache->object_size; +} + void kasan_metadata_fetch_row(char *buffer, void *row) { memcpy(buffer, kasan_mem_to_shadow(row), META_BYTES_PER_ROW); diff --git a/mm/kasan/report_tags.c b/mm/kasan/report_tags.c index ecede06ef374..b349a0ae1b83 100644 --- a/mm/kasan/report_tags.c +++ b/mm/kasan/report_tags.c @@ -7,6 +7,7 @@ #include #include "kasan.h" +#include "../slab.h" extern struct kasan_stack_ring stack_ring; @@ -113,4 +114,11 @@ void kasan_complete_mode_report_info(struct kasan_report_info *info) /* Assign the common bug type if no entries were found. */ if (!info->bug_type) info->bug_type = get_common_bug_type(info); + + if (info->object && info->cache) { + if (strcmp(info->bug_type, "slab-out-of-bounds") == 0) + info->obj_size = kasan_get_alloc_size(info->object, info->cache); + else + info->obj_size = info->cache->object_size; + } }