From patchwork Thu Sep 14 08:08:33 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Haibo Li X-Patchwork-Id: 13384776 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E909FEDE98F for ; Thu, 14 Sep 2023 08:09:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6F24E8D0016; Thu, 14 Sep 2023 04:09:04 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 6A2948D0001; Thu, 14 Sep 2023 04:09:04 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 56A758D0016; Thu, 14 Sep 2023 04:09:04 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 431588D0001 for ; Thu, 14 Sep 2023 04:09:04 -0400 (EDT) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 17CEA121101 for ; Thu, 14 Sep 2023 08:09:04 +0000 (UTC) X-FDA: 81234477408.29.F4C9E2D Received: from mailgw02.mediatek.com (mailgw02.mediatek.com [216.200.240.185]) by imf10.hostedemail.com (Postfix) with ESMTP id 19405C0014 for ; Thu, 14 Sep 2023 08:09:00 +0000 (UTC) Authentication-Results: imf10.hostedemail.com; dkim=pass header.d=mediatek.com header.s=dk header.b=nbN5kH2Z; dmarc=pass (policy=quarantine) header.from=mediatek.com; spf=pass (imf10.hostedemail.com: domain of haibo.li@mediatek.com designates 216.200.240.185 as permitted sender) smtp.mailfrom=haibo.li@mediatek.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1694678942; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=mlOEeXuSL3Jd9KWoAGMasqY7uUX1ru96a24IVEsPgXk=; b=xmw6YcVeqdpWfUbEM3i66utrDWHSnAwVEaXPg0hg9VBFXiHIm6zHjfMt3GeARM0kudcGRk zxqvOlzsTj/GClSDCrNjPvymsET2ElTKnQyXeo9viWYOESInWPLPLeGVUnFaLqqo7Nx9Bp DGLhf/Pe7mzsOZ5B7ida85xCQy9LKuE= ARC-Authentication-Results: i=1; imf10.hostedemail.com; dkim=pass header.d=mediatek.com header.s=dk header.b=nbN5kH2Z; dmarc=pass (policy=quarantine) header.from=mediatek.com; spf=pass (imf10.hostedemail.com: domain of haibo.li@mediatek.com designates 216.200.240.185 as permitted sender) smtp.mailfrom=haibo.li@mediatek.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1694678942; a=rsa-sha256; cv=none; b=worZlLuM/6pdnlYrM29GwGtO0itJnaxOVah0ry46ngRIxRtrcgU3354OlY3o0I1Kj6onCW JEKbnLI2xltDRjbJd5+x7VLwhNTKBk/6rx2zzzGLtNiDZfEsu6JngwbXjclX05dN+1r/Do DOXAUvCyJCoOfXzhmMtlgqCnrip2rR4= X-UUID: f1efcb1c52d511ee86758d4a7c00f3a0-20230914 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=mlOEeXuSL3Jd9KWoAGMasqY7uUX1ru96a24IVEsPgXk=; b=nbN5kH2ZHeBSmRDbusxGl/9eZ7H7OM8VxEjN4Ceca7hkyiE0CFGeQkeuunWg5eIxbwkPkmeufwzTexRgUinXlwQ7jnxFzPWvyYuJLwqC/Lu3A8Lec/y8ZBCSLi0HkNR5XSRzUt5nmpMC2GJwBAABc2a32vq8tNsraXzIPxgHiVg=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.31,REQID:d9c1bb89-a0b9-41d5-abb9-5a5aca5353d4,IP:0,U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:0ad78a4,CLOUDID:ab31ee13-4929-4845-9571-38c601e9c3c9,B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0,EDM:-3,IP:nil,U RL:11|1,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR: NO,DKR:0,DKP:0,BRR:0,BRE:0 X-CID-BVR: 0,NGT X-CID-BAS: 0,NGT,0,_ X-CID-FACTOR: TF_CID_SPAM_SNR,TF_CID_SPAM_ULN X-UUID: f1efcb1c52d511ee86758d4a7c00f3a0-20230914 Received: from mtkmbs11n1.mediatek.inc [(172.21.101.185)] by mailgw02.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 805472291; Thu, 14 Sep 2023 01:08:53 -0700 Received: from mtkmbs13n1.mediatek.inc (172.21.101.193) by mtkmbs11n1.mediatek.inc (172.21.101.185) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.26; Thu, 14 Sep 2023 16:08:35 +0800 Received: from mszsdtlt101.gcn.mediatek.inc (10.16.4.141) by mtkmbs13n1.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.1118.26 via Frontend Transport; Thu, 14 Sep 2023 16:08:34 +0800 From: Haibo Li To: CC: , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton , Matthias Brugger , AngeloGioacchino Del Regno , , , , , Haibo Li Subject: [PATCH] kasan:fix access invalid shadow address when input is illegal Date: Thu, 14 Sep 2023 16:08:33 +0800 Message-ID: <20230914080833.50026-1-haibo.li@mediatek.com> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-MTK: N X-Rspamd-Queue-Id: 19405C0014 X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: xgaw881h9g8rfi5ncm1i18apod8rnats X-HE-Tag: 1694678940-963849 X-HE-Meta: U2FsdGVkX19GpN7vH0zRcebDh3EgJBklmrtqDtrpBcUU1zfYFvOAkJY3qR66mAYrnySGXeRwSRTXsLXPGfFUtbnopE9btAckzuzyoUC7jLOS1cIiZ3dJd57aHsGrw9TdF6ZxkhldXrUjH+OZ2kZHec4stUcVogrbYOZe4Ww3fYrnTqd8AWsCjKqvNdPHT2XPLxIy+o0yL617z5xpe1YKJE2vdfTV0Yu04cnr7uaarA21U9WaCd/HeQ3FoT90064nH6/fBJ3mbvD+xrbLYMZ65WpdGEKECB1G050/p6QZFHAJu+IRj7BjCaL1NBVjzYe6NwvL2tw2nbVgmXQQPIkWmAVmIiW1p4dwb0KM7D+1gZaizGdQTBhyPeKcKoxf6LCNl8/SqpmLVH4xdgIv3ltEPtqIvVFPeAFiNRp+0vYXvOZmpW2bSzSYeosRWmrsqNOMerHSUEcrSCpVsNv6elstSjmfNF1bnhxx0gdsc+VIFr2puejWi74sQ/li1e4qZbjXrouoZJ9butyw3SwD7GnbbIfsGu/aeNsJzK0JA5vZom2TSAAC2lkgHz/0soQIx/qpakVPwFrUdufKG9eUkv+6mDx/s6+eR4AHoKpxTyu9t8k0pjTjiE86eY5xAU2EuPYKScXrY60+VyIZSBJ5GgvxL6eyNnxyQ7IjEtsnUIyX37ZvBPpe+xc4cAXVOIuw7Cdu7EFTj+YwaImRwmyth91tYEmsBZdRziZsL1P0e4/5nGCcndCVEMysJcT/kvKS3o+pNvc0bd//FK84GClykej0YAp6BjbfDtOdmSBt7o707v1wKNfFdX0sKsLkNHI1uhI19xIIB5Dv/NLjLnmCOGA2xH6dnv61kd21jyHHm/9fM8hGNR/8KDhEAi1qfaDof2cR1bskgYbDql9S9E+PeK+v1N2cUhGvvGxFGtPEgN1IjaigaVs+xQ79x5xUy/KHEJAADZ15OEL7HqgHFcZ3X5k GDuSYnT6 N632YNdTU5LarzTCDtLKQfVpVariWaa4RX3MvztXPLZUsBfM790Sfje/JelEcVQJ3Omz9SVKURAwP0IoODqPbHMd4zM1TlU/saxe9ZtOUbHg74Qd9CrAY2HlVezJrIvZf1+Uezpt1t4P/s8AqRGsdFn7yZykx+1TaTxtxZP3+wBRE2e4xc93SygosV7grsdkMeyDKAV520VORRRH4Xr+uOWsPnKORLUbIpM+3J9Wk/L0XO97OiUqqa8Ad/cwHYGfZsWZd4izT/Aqw/WyfLRth3d+l6aNDUbt9d3Af X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: when the input address is illegal,the corresponding shadow address from kasan_mem_to_shadow may have no mapping in mmu table. Access such shadow address causes kernel oops. Here is a sample about oops on arm64(VA 39bit) with KASAN_SW_TAGS on: [ffffffb80aaaaaaa] pgd=000000005d3ce003, p4d=000000005d3ce003, pud=000000005d3ce003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 3 PID: 100 Comm: sh Not tainted 6.6.0-rc1-dirty #43 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __hwasan_load8_noabort+0x5c/0x90 lr : do_ib_ob+0xf4/0x110 ffffffb80aaaaaaa is the shadow address for efffff80aaaaaaaa. The problem is reading invalid shadow in kasan_check_range. The generic kasan also has similar oops. To fix it,check shadow address by reading it with no fault. After this patch,KASAN is able to report invalid memory access for this case. Signed-off-by: Haibo Li --- mm/kasan/kasan.h | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index f70e3d7a602e..bd30f35e18b2 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -304,8 +304,17 @@ static __always_inline bool addr_has_metadata(const void *addr) #ifdef __HAVE_ARCH_SHADOW_MAP return (kasan_mem_to_shadow((void *)addr) != NULL); #else - return (kasan_reset_tag(addr) >= - kasan_shadow_to_mem((void *)KASAN_SHADOW_START)); + u8 *shadow, shadow_val; + + if (kasan_reset_tag(addr) < + kasan_shadow_to_mem((void *)KASAN_SHADOW_START)) + return false; + /* use read with nofault to check whether the shadow is accessible */ + shadow = kasan_mem_to_shadow((void *)addr); + __get_kernel_nofault(&shadow_val, shadow, u8, fault); + return true; +fault: + return false; #endif }