| Message ID | 20231212232659.18839-1-npache@redhat.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | kunit: kasan_test: disable fortify string checker on kmalloc_oob_memset | expand |
On Wed, Dec 13, 2023 at 12:27 AM Nico Pache <npache@redhat.com> wrote: > > similar to commit 09c6304e38e4 ("kasan: test: fix compatibility with > FORTIFY_SOURCE") the kernel is panicing in kmalloc_oob_memset_*. > > This is due to the `ptr` not being hidden from the optimizer which would > disable the runtime fortify string checker. > > kernel BUG at lib/string_helpers.c:1048! > Call Trace: > [<00000000272502e2>] fortify_panic+0x2a/0x30 > ([<00000000272502de>] fortify_panic+0x26/0x30) > [<001bffff817045c4>] kmalloc_oob_memset_2+0x22c/0x230 [kasan_test] > > Hide the `ptr` variable from the optimizer to fix the kernel panic. > Also define a size2 variable and hide that as well. This cleans up > the code and follows the same convention as other tests. > > Signed-off-by: Nico Pache <npache@redhat.com> > --- > mm/kasan/kasan_test.c | 20 ++++++++++++++++---- > 1 file changed, 16 insertions(+), 4 deletions(-) > > diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c > index 8281eb42464b..5aeba810ba70 100644 > --- a/mm/kasan/kasan_test.c > +++ b/mm/kasan/kasan_test.c > @@ -493,14 +493,17 @@ static void kmalloc_oob_memset_2(struct kunit *test) > { > char *ptr; > size_t size = 128 - KASAN_GRANULE_SIZE; > + size_t size2 = 2; Let's name this variable access_size or memset_size. Here and in the other changed tests. > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); > + OPTIMIZER_HIDE_VAR(size2); > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, size2)); > kfree(ptr); > } > > @@ -508,14 +511,17 @@ static void kmalloc_oob_memset_4(struct kunit *test) > { > char *ptr; > size_t size = 128 - KASAN_GRANULE_SIZE; > + size_t size2 = 4; > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); > + OPTIMIZER_HIDE_VAR(size2); > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, size2)); > kfree(ptr); > } > > @@ -523,14 +529,17 @@ static void kmalloc_oob_memset_8(struct kunit *test) > { > char *ptr; > size_t size = 128 - KASAN_GRANULE_SIZE; > + size_t size2 = 8; > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); > + OPTIMIZER_HIDE_VAR(size2); > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, size2)); > kfree(ptr); > } > > @@ -538,14 +547,17 @@ static void kmalloc_oob_memset_16(struct kunit *test) > { > char *ptr; > size_t size = 128 - KASAN_GRANULE_SIZE; > + size_t size2 = 16; > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > ptr = kmalloc(size, GFP_KERNEL); > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > + OPTIMIZER_HIDE_VAR(ptr); > OPTIMIZER_HIDE_VAR(size); > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); > + OPTIMIZER_HIDE_VAR(size2); > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, size2)); > kfree(ptr); > } > > -- > 2.43.0 > With the fix mentioned above addressed: Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
On Wed, Dec 13, 2023 at 7:34 AM Andrey Konovalov <andreyknvl@gmail.com> wrote: > > On Wed, Dec 13, 2023 at 12:27 AM Nico Pache <npache@redhat.com> wrote: > > > > similar to commit 09c6304e38e4 ("kasan: test: fix compatibility with > > FORTIFY_SOURCE") the kernel is panicing in kmalloc_oob_memset_*. > > > > This is due to the `ptr` not being hidden from the optimizer which would > > disable the runtime fortify string checker. > > > > kernel BUG at lib/string_helpers.c:1048! > > Call Trace: > > [<00000000272502e2>] fortify_panic+0x2a/0x30 > > ([<00000000272502de>] fortify_panic+0x26/0x30) > > [<001bffff817045c4>] kmalloc_oob_memset_2+0x22c/0x230 [kasan_test] > > > > Hide the `ptr` variable from the optimizer to fix the kernel panic. > > Also define a size2 variable and hide that as well. This cleans up > > the code and follows the same convention as other tests. > > > > Signed-off-by: Nico Pache <npache@redhat.com> > > --- > > mm/kasan/kasan_test.c | 20 ++++++++++++++++---- > > 1 file changed, 16 insertions(+), 4 deletions(-) > > > > diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c > > index 8281eb42464b..5aeba810ba70 100644 > > --- a/mm/kasan/kasan_test.c > > +++ b/mm/kasan/kasan_test.c > > @@ -493,14 +493,17 @@ static void kmalloc_oob_memset_2(struct kunit *test) > > { > > char *ptr; > > size_t size = 128 - KASAN_GRANULE_SIZE; > > + size_t size2 = 2; > > Let's name this variable access_size or memset_size. Here and in the > other changed tests. Hi Andrey, I agree that is a better variable name, but I chose size2 because other kasan tests follow the same pattern. Please let me know if you still want me to update it given that info and I'll send a V2. Cheers, -- Nico > > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > > > ptr = kmalloc(size, GFP_KERNEL); > > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > > > + OPTIMIZER_HIDE_VAR(ptr); > > OPTIMIZER_HIDE_VAR(size); > > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); > > + OPTIMIZER_HIDE_VAR(size2); > > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, size2)); > > kfree(ptr); > > } > > > > @@ -508,14 +511,17 @@ static void kmalloc_oob_memset_4(struct kunit *test) > > { > > char *ptr; > > size_t size = 128 - KASAN_GRANULE_SIZE; > > + size_t size2 = 4; > > > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > > > ptr = kmalloc(size, GFP_KERNEL); > > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > > > + OPTIMIZER_HIDE_VAR(ptr); > > OPTIMIZER_HIDE_VAR(size); > > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); > > + OPTIMIZER_HIDE_VAR(size2); > > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, size2)); > > kfree(ptr); > > } > > > > @@ -523,14 +529,17 @@ static void kmalloc_oob_memset_8(struct kunit *test) > > { > > char *ptr; > > size_t size = 128 - KASAN_GRANULE_SIZE; > > + size_t size2 = 8; > > > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > > > ptr = kmalloc(size, GFP_KERNEL); > > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > > > + OPTIMIZER_HIDE_VAR(ptr); > > OPTIMIZER_HIDE_VAR(size); > > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); > > + OPTIMIZER_HIDE_VAR(size2); > > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, size2)); > > kfree(ptr); > > } > > > > @@ -538,14 +547,17 @@ static void kmalloc_oob_memset_16(struct kunit *test) > > { > > char *ptr; > > size_t size = 128 - KASAN_GRANULE_SIZE; > > + size_t size2 = 16; > > > > KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); > > > > ptr = kmalloc(size, GFP_KERNEL); > > KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); > > > > + OPTIMIZER_HIDE_VAR(ptr); > > OPTIMIZER_HIDE_VAR(size); > > - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); > > + OPTIMIZER_HIDE_VAR(size2); > > + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, size2)); > > kfree(ptr); > > } > > > > -- > > 2.43.0 > > > > With the fix mentioned above addressed: > > Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> >
On Wed, Dec 13, 2023 at 10:42 PM Nico Pache <npache@redhat.com> wrote: > > > > diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c > > > index 8281eb42464b..5aeba810ba70 100644 > > > --- a/mm/kasan/kasan_test.c > > > +++ b/mm/kasan/kasan_test.c > > > @@ -493,14 +493,17 @@ static void kmalloc_oob_memset_2(struct kunit *test) > > > { > > > char *ptr; > > > size_t size = 128 - KASAN_GRANULE_SIZE; > > > + size_t size2 = 2; > > > > Let's name this variable access_size or memset_size. Here and in the > > other changed tests. > > Hi Andrey, > > I agree that is a better variable name, but I chose size2 because > other kasan tests follow the same pattern. These other tests use size1 and size2 to refer to different sizes of krealloc allocations, which seems reasonable. > Please let me know if you still want me to update it given that info > and I'll send a V2. Yes, please update the name. Thank you!
diff --git a/mm/kasan/kasan_test.c b/mm/kasan/kasan_test.c index 8281eb42464b..5aeba810ba70 100644 --- a/mm/kasan/kasan_test.c +++ b/mm/kasan/kasan_test.c @@ -493,14 +493,17 @@ static void kmalloc_oob_memset_2(struct kunit *test) { char *ptr; size_t size = 128 - KASAN_GRANULE_SIZE; + size_t size2 = 2; KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + OPTIMIZER_HIDE_VAR(ptr); OPTIMIZER_HIDE_VAR(size); - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, 2)); + OPTIMIZER_HIDE_VAR(size2); + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 1, 0, size2)); kfree(ptr); } @@ -508,14 +511,17 @@ static void kmalloc_oob_memset_4(struct kunit *test) { char *ptr; size_t size = 128 - KASAN_GRANULE_SIZE; + size_t size2 = 4; KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + OPTIMIZER_HIDE_VAR(ptr); OPTIMIZER_HIDE_VAR(size); - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, 4)); + OPTIMIZER_HIDE_VAR(size2); + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 3, 0, size2)); kfree(ptr); } @@ -523,14 +529,17 @@ static void kmalloc_oob_memset_8(struct kunit *test) { char *ptr; size_t size = 128 - KASAN_GRANULE_SIZE; + size_t size2 = 8; KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + OPTIMIZER_HIDE_VAR(ptr); OPTIMIZER_HIDE_VAR(size); - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, 8)); + OPTIMIZER_HIDE_VAR(size2); + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 7, 0, size2)); kfree(ptr); } @@ -538,14 +547,17 @@ static void kmalloc_oob_memset_16(struct kunit *test) { char *ptr; size_t size = 128 - KASAN_GRANULE_SIZE; + size_t size2 = 16; KASAN_TEST_NEEDS_CHECKED_MEMINTRINSICS(test); ptr = kmalloc(size, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr); + OPTIMIZER_HIDE_VAR(ptr); OPTIMIZER_HIDE_VAR(size); - KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, 16)); + OPTIMIZER_HIDE_VAR(size2); + KUNIT_EXPECT_KASAN_FAIL(test, memset(ptr + size - 15, 0, size2)); kfree(ptr); }
similar to commit 09c6304e38e4 ("kasan: test: fix compatibility with FORTIFY_SOURCE") the kernel is panicing in kmalloc_oob_memset_*. This is due to the `ptr` not being hidden from the optimizer which would disable the runtime fortify string checker. kernel BUG at lib/string_helpers.c:1048! Call Trace: [<00000000272502e2>] fortify_panic+0x2a/0x30 ([<00000000272502de>] fortify_panic+0x26/0x30) [<001bffff817045c4>] kmalloc_oob_memset_2+0x22c/0x230 [kasan_test] Hide the `ptr` variable from the optimizer to fix the kernel panic. Also define a size2 variable and hide that as well. This cleans up the code and follows the same convention as other tests. Signed-off-by: Nico Pache <npache@redhat.com> --- mm/kasan/kasan_test.c | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-)