From patchwork Thu Jan 16 01:23:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11335781 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5F94C13BD for ; Thu, 16 Jan 2020 01:24:26 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1FA842084D for ; Thu, 16 Jan 2020 01:24:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="Oy7tVeYN" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1FA842084D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id EEE118E0018; Wed, 15 Jan 2020 20:24:23 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id E32228E0017; Wed, 15 Jan 2020 20:24:23 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CC9D78E0017; Wed, 15 Jan 2020 20:24:23 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0211.hostedemail.com [216.40.44.211]) by kanga.kvack.org (Postfix) with ESMTP id B52BD8E0003 for ; Wed, 15 Jan 2020 20:24:23 -0500 (EST) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with SMTP id 57C4A181AEF00 for ; Thu, 16 Jan 2020 01:24:23 +0000 (UTC) X-FDA: 76381752006.24.cork34_7d8f3449aff3a X-Spam-Summary: 30,2,0,b7907f0ed43ac55b,d41d8cd98f00b204,keescook@chromium.org,:akpm@linux-foundation.org:keescook@chromium.org:lenaptr@google.com:dvyukov@google.com:aryabinin@virtuozzo.com:glider@google.com:dan.carpenter@oracle.com:gustavo@embeddedor.com:arnd@arndb.de:ard.biesheuvel@linaro.org:kasan-dev@googlegroups.com::linux-kernel@vger.kernel.org:kernel-hardening@lists.openwall.com:syzkaller@googlegroups.com,RULES_HIT:41:355:379:472:541:800:960:968:973:982:988:989:1260:1311:1314:1345:1359:1437:1515:1535:1544:1605:1711:1730:1747:1777:1792:2198:2199:2393:2553:2559:2562:2731:2736:2899:3138:3139:3140:3141:3142:3865:3866:3867:3868:3870:3871:3874:4118:4250:4321:4605:5007:6119:6261:6653:6742:6755:7903:8603:8660:8784:10004:11026:11232:11473:11658:11914:12043:12219:12296:12297:12438:12517:12519:12555:12895:12986:13148:13161:13221:13229:13230:13894:13972:14093:14096:14181:14394:14721:21080:21325:21433:21444:21451:21611:21627:21889:30012:30054:30062:30074:30089:30090,0,RBL:209.85.21 4.195:@c X-HE-Tag: cork34_7d8f3449aff3a X-Filterd-Recvd-Size: 7651 Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) by imf33.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jan 2020 01:24:22 +0000 (UTC) Received: by mail-pl1-f195.google.com with SMTP id p9so7599607plk.9 for ; Wed, 15 Jan 2020 17:24:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=vuuIloFbVRb0p706sR0GRT1NGf5G9e2wBRiCGVrk15E=; b=Oy7tVeYNPp0hMeW43ro1kUxZsX6Njfchn0Sj8KLauamE0IQ5/ZcQQvued6aW9DGWR3 paKAkOW6vFMjIv5kwJMgb3gND1N355kK/DklI4mQTum8ktjUMFMsucit8FJWWHODr3VT XMEgVnvesouIuqJQTp6QooK7ke5EW6pbJuNPQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=vuuIloFbVRb0p706sR0GRT1NGf5G9e2wBRiCGVrk15E=; b=iI01LcR7fOHB1O5O/HkBLZAH8ggiZlKcc9tkxSLAiOPFR7NC2AClcgQIcuGQq3EejA 0Qs+cHBPmkv0PaUGp9RjaQGltg5VjBByqVzsoM7nkHmPMPP1XyUFajITcBZ194OW6j04 e6PYfOwpUkvUWl847MGApPzzGbsV5l2fgDtDTvbKnbp8rDAnoIcEKXNCcwzgymi+YAzf +bNIclT0joNZmX9BtXIGIeaYJr1OmCFgcdvcZbRTVTgsW0Q9lCq5uZgm0G4uXckIiW9K MCn/L0ec+RMaU6lIoa83v/kOIc3uDq14v3l1zwt4xRqVI5PQ9LtRzXpsjMQ5eQ0oNT22 0R+Q== X-Gm-Message-State: APjAAAUSsS+VTP6bu5CKK4HDb/sO+c1ZKRcCwgTCzSlC7dWUv8/10Zsy FkbYrG/Zy3Jz2a768dUHJ9OIUQ== X-Google-Smtp-Source: APXvYqyC9MlZJFpJmPX7iF7s8KlOdlx6EtYanuy9X2Oycwg3CfRRGIXJ/hs/r4iAQKjQ5AAGjmfBLg== X-Received: by 2002:a17:90b:258:: with SMTP id fz24mr3458273pjb.6.1579137861582; Wed, 15 Jan 2020 17:24:21 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id 189sm23827180pfw.73.2020.01.15.17.24.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jan 2020 17:24:18 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Elena Petrova , Dmitry Vyukov , Andrey Ryabinin , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v3 1/6] ubsan: Add trap instrumentation option Date: Wed, 15 Jan 2020 17:23:16 -0800 Message-Id: <20200116012321.26254-2-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116012321.26254-1-keescook@chromium.org> References: <20200116012321.26254-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The Undefined Behavior Sanitizer can operate in two modes: warning reporting mode via lib/ubsan.c handler calls, or trap mode, which uses __builtin_trap() as the handler. Using lib/ubsan.c means the kernel image is about 5% larger (due to all the debugging text and reporting structures to capture details about the warning conditions). Using the trap mode, the image size changes are much smaller, though at the loss of the "warning only" mode. In order to give greater flexibility to system builders that want minimal changes to image size and are prepared to deal with kernel code being aborted and potentially destabilizing the system, this introduces CONFIG_UBSAN_TRAP. The resulting image sizes comparison: text data bss dec hex filename 19533663 6183037 18554956 44271656 2a38828 vmlinux.stock 19991849 7618513 18874448 46484810 2c54d4a vmlinux.ubsan 19712181 6284181 18366540 44362902 2a4ec96 vmlinux.ubsan-trap CONFIG_UBSAN=y: image +4.8% (text +2.3%, data +18.9%) CONFIG_UBSAN_TRAP=y: image +0.2% (text +0.9%, data +1.6%) Additionally adjusts the CONFIG_UBSAN Kconfig help for clarity and removes the mention of non-existing boot param "ubsan_handle". Suggested-by: Elena Petrova Signed-off-by: Kees Cook Acked-by: Dmitry Vyukov --- lib/Kconfig.ubsan | 22 ++++++++++++++++++---- lib/Makefile | 2 ++ scripts/Makefile.ubsan | 9 +++++++-- 3 files changed, 27 insertions(+), 6 deletions(-) diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan index 0e04fcb3ab3d..9deb655838b0 100644 --- a/lib/Kconfig.ubsan +++ b/lib/Kconfig.ubsan @@ -5,11 +5,25 @@ config ARCH_HAS_UBSAN_SANITIZE_ALL config UBSAN bool "Undefined behaviour sanity checker" help - This option enables undefined behaviour sanity checker + This option enables the Undefined Behaviour sanity checker. Compile-time instrumentation is used to detect various undefined - behaviours in runtime. Various types of checks may be enabled - via boot parameter ubsan_handle - (see: Documentation/dev-tools/ubsan.rst). + behaviours at runtime. For more details, see: + Documentation/dev-tools/ubsan.rst + +config UBSAN_TRAP + bool "On Sanitizer warnings, abort the running kernel code" + depends on UBSAN + depends on $(cc-option, -fsanitize-undefined-trap-on-error) + help + Building kernels with Sanitizer features enabled tends to grow + the kernel size by around 5%, due to adding all the debugging + text on failure paths. To avoid this, Sanitizer instrumentation + can just issue a trap. This reduces the kernel size overhead but + turns all warnings (including potentially harmless conditions) + into full exceptions that abort the running kernel code + (regardless of context, locks held, etc), which may destabilize + the system. For some system builders this is an acceptable + trade-off. config UBSAN_SANITIZE_ALL bool "Enable instrumentation for the entire kernel" diff --git a/lib/Makefile b/lib/Makefile index 93217d44237f..3114ef1727f8 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -275,7 +275,9 @@ quiet_cmd_build_OID_registry = GEN $@ clean-files += oid_registry_data.c obj-$(CONFIG_UCS2_STRING) += ucs2_string.o +ifneq ($(CONFIG_UBSAN_TRAP),y) obj-$(CONFIG_UBSAN) += ubsan.o +endif UBSAN_SANITIZE_ubsan.o := n KASAN_SANITIZE_ubsan.o := n diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan index 019771b845c5..668a91510bfe 100644 --- a/scripts/Makefile.ubsan +++ b/scripts/Makefile.ubsan @@ -1,5 +1,10 @@ # SPDX-License-Identifier: GPL-2.0 ifdef CONFIG_UBSAN + +ifdef CONFIG_UBSAN_ALIGNMENT + CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment) +endif + CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift) CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero) CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable) @@ -9,8 +14,8 @@ ifdef CONFIG_UBSAN CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool) CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum) -ifdef CONFIG_UBSAN_ALIGNMENT - CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment) +ifdef CONFIG_UBSAN_TRAP + CFLAGS_UBSAN += $(call cc-option, -fsanitize-undefined-trap-on-error) endif # -fsanitize=* options makes GCC less smart than usual and From patchwork Thu Jan 16 01:23:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11335785 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 68EC113B4 for ; Thu, 16 Jan 2020 01:24:31 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 27F3C24686 for ; Thu, 16 Jan 2020 01:24:31 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="F0L+2cGd" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 27F3C24686 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 294DC8E001B; Wed, 15 Jan 2020 20:24:25 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 1F5908E001A; Wed, 15 Jan 2020 20:24:25 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id F378F8E0019; Wed, 15 Jan 2020 20:24:24 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0202.hostedemail.com [216.40.44.202]) by kanga.kvack.org (Postfix) with ESMTP id D73B78E0003 for ; Wed, 15 Jan 2020 20:24:24 -0500 (EST) Received: from smtpin23.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with SMTP id 80CD8180AD815 for ; Thu, 16 Jan 2020 01:24:24 +0000 (UTC) X-FDA: 76381752048.23.stone08_7db866be30855 X-Spam-Summary: 2,0,0,2d526b671fa40c8b,d41d8cd98f00b204,keescook@chromium.org,:akpm@linux-foundation.org:keescook@chromium.org:lenaptr@google.com:aryabinin@virtuozzo.com:dvyukov@google.com:glider@google.com:dan.carpenter@oracle.com:gustavo@embeddedor.com:arnd@arndb.de:ard.biesheuvel@linaro.org:kasan-dev@googlegroups.com::linux-kernel@vger.kernel.org:kernel-hardening@lists.openwall.com:syzkaller@googlegroups.com,RULES_HIT:2:41:355:379:541:800:960:967:973:982:988:989:1260:1311:1314:1345:1359:1431:1437:1515:1535:1605:1606:1730:1747:1777:1792:2198:2199:2393:2525:2559:2564:2682:2685:2693:2731:2859:2897:2912:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3743:3865:3866:3867:3868:3870:3871:3872:3873:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4119:4250:4321:4605:5007:6119:6261:6653:6691:6742:6755:7808:7903:7904:8603:8660:8784:9025:10004:11026:11473:11658:11914:12043:12219:12291:12296:12297:12438:12517:12519:12555:12698:12737:12895:13148:13230:13894: 14096:14 X-HE-Tag: stone08_7db866be30855 X-Filterd-Recvd-Size: 8308 Received: from mail-pj1-f67.google.com (mail-pj1-f67.google.com [209.85.216.67]) by imf29.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jan 2020 01:24:23 +0000 (UTC) Received: by mail-pj1-f67.google.com with SMTP id a6so747465pjh.2 for ; Wed, 15 Jan 2020 17:24:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=TZN5E5934TvMDmRyA6YbiUZA3oVW+HYGx9jzlGs1fas=; b=F0L+2cGdglf0WmtEJtbNhOu0tsLJbuHzAC7gr4O8WS8Pef8z+2Vopixa6Qc3xKDykF ZoaqE4KS2detzrDvFlhnL183vD9G0Dlxu8bnnwMSiGSnJcw/wPEDZryJJwgTsO6cSIbV K3ySX8KnuTXqinCV6KX6X9zhMd+7hECdOUe18= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=TZN5E5934TvMDmRyA6YbiUZA3oVW+HYGx9jzlGs1fas=; b=NOe35VBj8VDsDetFwR3TQ3Qfy1WAg2NlIrfQf4aitQcKMmL8/LLKMPbCmx9iDOP93k FMe1UZdATGDFlgVXhutn8cJaPmZwgaPI2pnSKeMdrtB69OPnMv1QiB77q36qqnKVnbBe xH/lZG2NGb9AiASW0SVtQcd9SrnJAmqbCcRB2FaycQVYlwMUj50PWl8H+VT9pMPWNLiY QuhrLZh/50Ud0YRW8jNYi9TzQxZ0rJFYM/8ieZaUcDMlLRMX6gQ1KRq+Stoa8jTNIcni 0v6OzBGMvFCSaDXpHsSQSUmgn/lwcvmXa5CNaSxawPZ/O1Uisl1XAsHAG9HazLJRG+oN WrGg== X-Gm-Message-State: APjAAAX62frCXyCuyAFKFftsX2kXitjTBGDzrTmcxeV4g+nxVBLpLLlJ LAgYLtY1sd/b159OUdyVUtostA== X-Google-Smtp-Source: APXvYqzlIkM2MJkOvtIuhX2DY3fkspjNHpusBb4F4dDHo3Ua3MtimiH7urAXuSIo/Hb9h6dfm3wosA== X-Received: by 2002:a17:902:124:: with SMTP id 33mr28734328plb.115.1579137862886; Wed, 15 Jan 2020 17:24:22 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id y38sm21836186pgk.33.2020.01.15.17.24.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jan 2020 17:24:18 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Elena Petrova , Andrey Ryabinin , Dmitry Vyukov , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v3 2/6] ubsan: Split "bounds" checker from other options Date: Wed, 15 Jan 2020 17:23:17 -0800 Message-Id: <20200116012321.26254-3-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116012321.26254-1-keescook@chromium.org> References: <20200116012321.26254-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: In order to do kernel builds with the bounds checker individually available, introduce CONFIG_UBSAN_BOUNDS, with the remaining options under CONFIG_UBSAN_MISC. For example, using this, we can start to expand the coverage syzkaller is providing. Right now, all of UBSan is disabled for syzbot builds because taken as a whole, it is too noisy. This will let us focus on one feature at a time. For the bounds checker specifically, this provides a mechanism to eliminate an entire class of array overflows with close to zero performance overhead (I cannot measure a difference). In my (mostly) defconfig, enabling bounds checking adds ~4200 checks to the kernel. Performance changes are in the noise, likely due to the branch predictors optimizing for the non-fail path. Some notes on the bounds checker: - it does not instrument {mem,str}*()-family functions, it only instruments direct indexed accesses (e.g. "foo[i]"). Dealing with the {mem,str}*()-family functions is a work-in-progress around CONFIG_FORTIFY_SOURCE[1]. - it ignores flexible array members, including the very old single byte (e.g. "int foo[1];") declarations. (Note that GCC's implementation appears to ignore _all_ trailing arrays, but Clang only ignores empty, 0, and 1 byte arrays[2].) [1] https://github.com/KSPP/linux/issues/6 [2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92589 Suggested-by: Elena Petrova Signed-off-by: Kees Cook Reviewed-by: Andrey Ryabinin Acked-by: Dmitry Vyukov --- lib/Kconfig.ubsan | 29 ++++++++++++++++++++++++----- scripts/Makefile.ubsan | 7 ++++++- 2 files changed, 30 insertions(+), 6 deletions(-) diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan index 9deb655838b0..48469c95d78e 100644 --- a/lib/Kconfig.ubsan +++ b/lib/Kconfig.ubsan @@ -2,7 +2,7 @@ config ARCH_HAS_UBSAN_SANITIZE_ALL bool -config UBSAN +menuconfig UBSAN bool "Undefined behaviour sanity checker" help This option enables the Undefined Behaviour sanity checker. @@ -10,9 +10,10 @@ config UBSAN behaviours at runtime. For more details, see: Documentation/dev-tools/ubsan.rst +if UBSAN + config UBSAN_TRAP bool "On Sanitizer warnings, abort the running kernel code" - depends on UBSAN depends on $(cc-option, -fsanitize-undefined-trap-on-error) help Building kernels with Sanitizer features enabled tends to grow @@ -25,9 +26,26 @@ config UBSAN_TRAP the system. For some system builders this is an acceptable trade-off. +config UBSAN_BOUNDS + bool "Perform array index bounds checking" + default UBSAN + help + This option enables detection of directly indexed out of bounds + array accesses, where the array size is known at compile time. + Note that this does not protect array overflows via bad calls + to the {str,mem}*cpy() family of functions (that is addressed + by CONFIG_FORTIFY_SOURCE). + +config UBSAN_MISC + bool "Enable all other Undefined Behavior sanity checks" + default UBSAN + help + This option enables all sanity checks that don't have their + own Kconfig options. Disable this if you only want to have + individually selected checks. + config UBSAN_SANITIZE_ALL bool "Enable instrumentation for the entire kernel" - depends on UBSAN depends on ARCH_HAS_UBSAN_SANITIZE_ALL # We build with -Wno-maybe-uninitilzed, but we still want to @@ -44,7 +62,6 @@ config UBSAN_SANITIZE_ALL config UBSAN_NO_ALIGNMENT bool "Disable checking of pointers alignment" - depends on UBSAN default y if HAVE_EFFICIENT_UNALIGNED_ACCESS help This option disables the check of unaligned memory accesses. @@ -57,7 +74,9 @@ config UBSAN_ALIGNMENT config TEST_UBSAN tristate "Module for testing for undefined behavior detection" - depends on m && UBSAN + depends on m help This is a test module for UBSAN. It triggers various undefined behavior, and detect it. + +endif # if UBSAN diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan index 668a91510bfe..5b15bc425ec9 100644 --- a/scripts/Makefile.ubsan +++ b/scripts/Makefile.ubsan @@ -5,14 +5,19 @@ ifdef CONFIG_UBSAN_ALIGNMENT CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment) endif +ifdef CONFIG_UBSAN_BOUNDS + CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds) +endif + +ifdef CONFIG_UBSAN_MISC CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift) CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero) CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable) CFLAGS_UBSAN += $(call cc-option, -fsanitize=signed-integer-overflow) - CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds) CFLAGS_UBSAN += $(call cc-option, -fsanitize=object-size) CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool) CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum) +endif ifdef CONFIG_UBSAN_TRAP CFLAGS_UBSAN += $(call cc-option, -fsanitize-undefined-trap-on-error) From patchwork Thu Jan 16 01:23:18 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11335783 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id DB98713BD for ; Thu, 16 Jan 2020 01:24:28 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 9EB8A24686 for ; Thu, 16 Jan 2020 01:24:28 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="JhPSOz2w" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 9EB8A24686 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 353778E0017; Wed, 15 Jan 2020 20:24:24 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 32C508E0003; Wed, 15 Jan 2020 20:24:24 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1A6828E0019; Wed, 15 Jan 2020 20:24:23 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0106.hostedemail.com [216.40.44.106]) by kanga.kvack.org (Postfix) with ESMTP id DE7078E0003 for ; Wed, 15 Jan 2020 20:24:23 -0500 (EST) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with SMTP id 8F73A181AEF07 for ; Thu, 16 Jan 2020 01:24:23 +0000 (UTC) X-FDA: 76381752006.10.rod93_7d9ab576aee48 X-Spam-Summary: 2,0,0,6d96f4355b9e3025,d41d8cd98f00b204,keescook@chromium.org,:akpm@linux-foundation.org:keescook@chromium.org:dvyukov@google.com:aryabinin@virtuozzo.com:lenaptr@google.com:glider@google.com:dan.carpenter@oracle.com:gustavo@embeddedor.com:arnd@arndb.de:ard.biesheuvel@linaro.org:kasan-dev@googlegroups.com::linux-kernel@vger.kernel.org:kernel-hardening@lists.openwall.com:syzkaller@googlegroups.com,RULES_HIT:41:355:379:541:800:960:966:973:988:989:1260:1311:1314:1345:1359:1431:1437:1515:1535:1543:1711:1730:1747:1777:1792:2196:2199:2393:2559:2562:2901:2915:3138:3139:3140:3141:3142:3354:3865:3866:3867:3868:3870:3871:3872:4117:4250:4321:4385:5007:6261:6653:6742:8603:10004:11026:11473:11658:11914:12043:12291:12296:12297:12438:12517:12519:12555:12683:12895:12986:13894:14096:14110:14181:14394:14721:21080:21444:21451:21627:21972:21990:30054:30070,0,RBL:209.85.215.193:@chromium.org:.lbl8.mailshell.net-62.2.0.100 66.100.201.201,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:no ne,Domai X-HE-Tag: rod93_7d9ab576aee48 X-Filterd-Recvd-Size: 6781 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) by imf10.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jan 2020 01:24:22 +0000 (UTC) Received: by mail-pg1-f193.google.com with SMTP id 6so9059964pgk.0 for ; Wed, 15 Jan 2020 17:24:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=ZQ9IDbK60uG/o5/jdnQdHcQ/z86svExWfXh/mgZ1IxQ=; b=JhPSOz2wy2KhqjLTwWd8bW+JKPDmGoVaXZP9oCcHd+fHg7HRI5E0s/u1yyGLOTIDEc pQubh4QYxk4DaYwTIbZQmMYaVhzfwFLnt4CexaUDEESG8dkMiNuviq4wxMtA1wZFoiEP VsfAOc8Ltn/vQiAHFNJJYhhj9y21futDud5MY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=ZQ9IDbK60uG/o5/jdnQdHcQ/z86svExWfXh/mgZ1IxQ=; b=LWV5At10Y82+cRJikpek1nZzT++Hvqy0f1gZuS/DlD/xLiNfVyd1aCgG3wK2TQNzBE 61vZp4/8UXd8HrehBTlLEUxK+eqEcJRaDivO/K4MsZzdwU+GTEzbkeVP76//C8W5CZZd eb4IYTLJqYsZQCxRTiJaxI2hvbWarBABPK+bN1TS09O4q6qvUi9lZvDhqOdPf4DcsVmf NAqz1yaO/A7jYLNm8hds6i01sGnCpes6doDtAQFgDnpyDTDb7ctR+3cy9gY7YOgdVmuK J540IlJo78pi7CprVXTwQ1GXswcTZBAApu8SStwtlUXo8lMo6cRLNDq8IeopZ3Uk0XyG n/0Q== X-Gm-Message-State: APjAAAXubAAgNMRA5Jg49BmAuhRiJhouVhOXrseGfJ21Z7o3wWs39GBX slv0dl5c/FawuPrUjpgsCt0dOw== X-Google-Smtp-Source: APXvYqxz8Jx6t6Okpu/J7+9lMYElG9PJli4chhVh8tEjNqkJmp7Gs0nQdkFUotLWKGIUhIG1GowFyw== X-Received: by 2002:a63:201d:: with SMTP id g29mr37572832pgg.427.1579137862140; Wed, 15 Jan 2020 17:24:22 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id q21sm22396012pff.105.2020.01.15.17.24.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jan 2020 17:24:18 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Dmitry Vyukov , Andrey Ryabinin , Elena Petrova , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v3 3/6] lkdtm/bugs: Add arithmetic overflow and array bounds checks Date: Wed, 15 Jan 2020 17:23:18 -0800 Message-Id: <20200116012321.26254-4-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116012321.26254-1-keescook@chromium.org> References: <20200116012321.26254-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Adds LKDTM tests for arithmetic overflow (both signed and unsigned), as well as array bounds checking. Signed-off-by: Kees Cook Acked-by: Dmitry Vyukov --- drivers/misc/lkdtm/bugs.c | 75 ++++++++++++++++++++++++++++++++++++++ drivers/misc/lkdtm/core.c | 3 ++ drivers/misc/lkdtm/lkdtm.h | 3 ++ 3 files changed, 81 insertions(+) diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index a4fdad04809a..aeee2b1c7663 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -11,6 +11,7 @@ #include #include #include +#include #ifdef CONFIG_X86_32 #include @@ -175,6 +176,80 @@ void lkdtm_HUNG_TASK(void) schedule(); } +volatile unsigned int huge = INT_MAX - 2; +volatile unsigned int ignored; + +void lkdtm_OVERFLOW_SIGNED(void) +{ + int value; + + value = huge; + pr_info("Normal signed addition ...\n"); + value += 1; + ignored = value; + + pr_info("Overflowing signed addition ...\n"); + value += 4; + ignored = value; +} + + +void lkdtm_OVERFLOW_UNSIGNED(void) +{ + unsigned int value; + + value = huge; + pr_info("Normal unsigned addition ...\n"); + value += 1; + ignored = value; + + pr_info("Overflowing unsigned addition ...\n"); + value += 4; + ignored = value; +} + +/* Intentially using old-style flex array definition of 1 byte. */ +struct array_bounds_flex_array { + int one; + int two; + char data[1]; +}; + +struct array_bounds { + int one; + int two; + char data[8]; + int three; +}; + +void lkdtm_ARRAY_BOUNDS(void) +{ + struct array_bounds_flex_array *not_checked; + struct array_bounds *checked; + volatile int i; + + not_checked = kmalloc(sizeof(*not_checked) * 2, GFP_KERNEL); + checked = kmalloc(sizeof(*checked) * 2, GFP_KERNEL); + + pr_info("Array access within bounds ...\n"); + /* For both, touch all bytes in the actual member size. */ + for (i = 0; i < sizeof(checked->data); i++) + checked->data[i] = 'A'; + /* + * For the uninstrumented flex array member, also touch 1 byte + * beyond to verify it is correctly uninstrumented. + */ + for (i = 0; i < sizeof(not_checked->data) + 1; i++) + not_checked->data[i] = 'A'; + + pr_info("Array access beyond bounds ...\n"); + for (i = 0; i < sizeof(checked->data) + 1; i++) + checked->data[i] = 'B'; + + kfree(not_checked); + kfree(checked); +} + void lkdtm_CORRUPT_LIST_ADD(void) { /* diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c index ee0d6e721441..2e04719b503c 100644 --- a/drivers/misc/lkdtm/core.c +++ b/drivers/misc/lkdtm/core.c @@ -129,6 +129,9 @@ static const struct crashtype crashtypes[] = { CRASHTYPE(HARDLOCKUP), CRASHTYPE(SPINLOCKUP), CRASHTYPE(HUNG_TASK), + CRASHTYPE(OVERFLOW_SIGNED), + CRASHTYPE(OVERFLOW_UNSIGNED), + CRASHTYPE(ARRAY_BOUNDS), CRASHTYPE(EXEC_DATA), CRASHTYPE(EXEC_STACK), CRASHTYPE(EXEC_KMALLOC), diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h index c56d23e37643..8391081c6f13 100644 --- a/drivers/misc/lkdtm/lkdtm.h +++ b/drivers/misc/lkdtm/lkdtm.h @@ -22,6 +22,9 @@ void lkdtm_SOFTLOCKUP(void); void lkdtm_HARDLOCKUP(void); void lkdtm_SPINLOCKUP(void); void lkdtm_HUNG_TASK(void); +void lkdtm_OVERFLOW_SIGNED(void); +void lkdtm_OVERFLOW_UNSIGNED(void); +void lkdtm_ARRAY_BOUNDS(void); void lkdtm_CORRUPT_LIST_ADD(void); void lkdtm_CORRUPT_LIST_DEL(void); void lkdtm_CORRUPT_USER_DS(void); From patchwork Thu Jan 16 01:23:19 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11335787 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id D074213B4 for ; Thu, 16 Jan 2020 01:24:33 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 939352467E for ; Thu, 16 Jan 2020 01:24:33 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="SJwnin5n" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 939352467E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 59DFC8E0019; Wed, 15 Jan 2020 20:24:25 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 5506F8E0003; Wed, 15 Jan 2020 20:24:25 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 294208E0019; Wed, 15 Jan 2020 20:24:25 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0229.hostedemail.com [216.40.44.229]) by kanga.kvack.org (Postfix) with ESMTP id 0B03A8E0003 for ; Wed, 15 Jan 2020 20:24:25 -0500 (EST) Received: from smtpin29.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with SMTP id AB75E40FB for ; Thu, 16 Jan 2020 01:24:24 +0000 (UTC) X-FDA: 76381752048.29.rub88_7dca2295f5752 X-Spam-Summary: 2,0,0,0fe10bee4529a0a7,d41d8cd98f00b204,keescook@chromium.org,:akpm@linux-foundation.org:keescook@chromium.org:aryabinin@virtuozzo.com:lenaptr@google.com:glider@google.com:dan.carpenter@oracle.com:gustavo@embeddedor.com:arnd@arndb.de:ard.biesheuvel@linaro.org:kasan-dev@googlegroups.com::linux-kernel@vger.kernel.org:kernel-hardening@lists.openwall.com:syzkaller@googlegroups.com,RULES_HIT:41:355:379:541:800:960:967:973:988:989:1260:1311:1314:1345:1359:1437:1515:1534:1541:1711:1730:1747:1777:1792:2393:2525:2553:2559:2563:2682:2685:2689:2859:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3352:3865:3867:3870:3871:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4250:4321:5007:6261:6653:6742:7903:8957:9025:10004:11026:11658:11914:12043:12291:12296:12297:12438:12517:12519:12555:12679:12683:12895:13069:13311:13357:13894:14181:14384:14394:14721:14777:21080:21444:21627:21740:21939:21983:30054:30070:30090,0,RBL:209.85.210.196:@chromium.org:.l bl8.mail X-HE-Tag: rub88_7dca2295f5752 X-Filterd-Recvd-Size: 4207 Received: from mail-pf1-f196.google.com (mail-pf1-f196.google.com [209.85.210.196]) by imf43.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jan 2020 01:24:24 +0000 (UTC) Received: by mail-pf1-f196.google.com with SMTP id x185so9379648pfc.5 for ; Wed, 15 Jan 2020 17:24:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=46Z0N6nNFPIgM2OuwNgkHRjYe659IsqNoWw8FG0hdrY=; b=SJwnin5nMwZBKrhpnWtYLNNA2XESjaBA5OMZZUiC+dLBovxajhmbEreGNQuSCGlJwg rzwLtTnueeZeF9mo1NZWc/UG++85l/gf4xMNaTD7Mi65olwyiNctPjj7SEzVTf8lz6JY y2wkfmtBIGevOe/HcrOjcNSuIe8PF7VSzsSEI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=46Z0N6nNFPIgM2OuwNgkHRjYe659IsqNoWw8FG0hdrY=; b=PxyPZvw+AoZjxVwtrqw4qGsmCIVYQX5IN5Uko4X59QyrwszjlO7H44qfCqBNsy+kJI Pc+OiFGgDHhHknAG2xLHXeX3HUrFzO+ql/vVaRa9MvK/GHKV2XPjY6FgntV3yrQT+Opr 0ftgiyJAtrLHaUhYZjN9AsIYYWZEz9HcdK+2pjK5tj9Uu/h9wYURWhRE/BDc6UsDsAzw DZjSdCIs/RAMmExMiM1eiY29EuxhlRrI9UEV5S+MvaBJvX23EavhNjpYz14ChMXpq9ir kCfoieC9JwHyrFEKFOxViV9UKQ7kh+FjBw3wOJ6KnwKzSYJQjRtloOR9YtBnh71ylRXo 05cA== X-Gm-Message-State: APjAAAWMiWPsXiPE5PKDvY8mMLiBUH4k421N1TcSEWuSWVU2YcPLoePz ShP88WxQ1MxJo50p2pKzr6p2WQ== X-Google-Smtp-Source: APXvYqxsGknX6bnO/GaSkj5DHw5Et7M+pO9sTANSMwjDnHU91axQ6Z/1Fsl4MvtQ189Vh73/ukEWVg== X-Received: by 2002:aa7:9816:: with SMTP id e22mr35105862pfl.229.1579137863425; Wed, 15 Jan 2020 17:24:23 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id d20sm1058272pjs.2.2020.01.15.17.24.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jan 2020 17:24:18 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Andrey Ryabinin , Elena Petrova , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v3 4/6] ubsan: Check panic_on_warn Date: Wed, 15 Jan 2020 17:23:19 -0800 Message-Id: <20200116012321.26254-5-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116012321.26254-1-keescook@chromium.org> References: <20200116012321.26254-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Syzkaller expects kernel warnings to panic when the panic_on_warn sysctl is set. More work is needed here to have UBSan reuse the WARN infrastructure, but for now, just check the flag manually. Link: https://lore.kernel.org/lkml/CACT4Y+bsLJ-wFx_TaXqax3JByUOWB3uk787LsyMVcfW6JzzGvg@mail.gmail.com Signed-off-by: Kees Cook --- lib/ubsan.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/ubsan.c b/lib/ubsan.c index 7b9b58aee72c..429663eef6a7 100644 --- a/lib/ubsan.c +++ b/lib/ubsan.c @@ -156,6 +156,17 @@ static void ubsan_epilogue(void) "========================================\n"); current->in_ubsan--; + + if (panic_on_warn) { + /* + * This thread may hit another WARN() in the panic path. + * Resetting this prevents additional WARN() from panicking the + * system on this thread. Other threads are blocked by the + * panic_mutex in panic(). + */ + panic_on_warn = 0; + panic("panic_on_warn set ...\n"); + } } static void handle_overflow(struct overflow_data *data, void *lhs, From patchwork Thu Jan 16 01:23:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11335791 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1B5BF13BD for ; Thu, 16 Jan 2020 01:24:39 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D939924681 for ; Thu, 16 Jan 2020 01:24:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="YBfsq7Ez" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D939924681 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 044B98E0003; Wed, 15 Jan 2020 20:24:27 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id F38268E001C; Wed, 15 Jan 2020 20:24:26 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DFF498E0003; Wed, 15 Jan 2020 20:24:26 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0233.hostedemail.com [216.40.44.233]) by kanga.kvack.org (Postfix) with ESMTP id C6E588E001C for ; Wed, 15 Jan 2020 20:24:26 -0500 (EST) Received: from smtpin21.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with SMTP id 71393180AD815 for ; Thu, 16 Jan 2020 01:24:26 +0000 (UTC) X-FDA: 76381752132.21.spark05_7e0ae06a22b4c X-Spam-Summary: 13,1.2,0,fd5090cf75800968,d41d8cd98f00b204,keescook@chromium.org,:akpm@linux-foundation.org:keescook@chromium.org:aryabinin@virtuozzo.com:lenaptr@google.com:glider@google.com:dan.carpenter@oracle.com:gustavo@embeddedor.com:arnd@arndb.de:ard.biesheuvel@linaro.org:kasan-dev@googlegroups.com::linux-kernel@vger.kernel.org:kernel-hardening@lists.openwall.com:syzkaller@googlegroups.com,RULES_HIT:41:355:379:541:800:960:973:988:989:1260:1311:1314:1345:1359:1437:1515:1534:1541:1711:1730:1747:1777:1792:2393:2553:2559:2562:3138:3139:3140:3141:3142:3352:3865:3867:3870:4321:5007:6261:6653:6742:7903:10008:11026:11473:11658:11914:12043:12291:12297:12438:12517:12519:12555:12683:12895:12986:13069:13311:13357:13894:14181:14384:14394:14721:21080:21212:21444:21627:21983:30054:30090,0,RBL:209.85.210.195:@chromium.org:.lbl8.mailshell.net-62.2.0.100 66.100.201.201,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:1: 0,LFtime X-HE-Tag: spark05_7e0ae06a22b4c X-Filterd-Recvd-Size: 4186 Received: from mail-pf1-f195.google.com (mail-pf1-f195.google.com [209.85.210.195]) by imf10.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jan 2020 01:24:26 +0000 (UTC) Received: by mail-pf1-f195.google.com with SMTP id i6so9378692pfc.1 for ; Wed, 15 Jan 2020 17:24:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=8H0Ju2Tzkc7Hi4GTApYP4I+j3crkZ0C4oDWnN2FFbsw=; b=YBfsq7Ezv9QYWZccbUoWAnosaxltJReREbQgD47d8e4wJ+Ejg4Gn/vs3HhD5eYzXQr oJSYxgIJL4FY50iMU0/0GHsjGfjdVuL9/LFpgrcASS5CbKRGtx4pLqrpDWIs3X6BUzT1 x8tB+7PXLZLkr6MHrizsmnC10IzFOgJdvcjV8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=8H0Ju2Tzkc7Hi4GTApYP4I+j3crkZ0C4oDWnN2FFbsw=; b=BT7aw7fa8ftbuh1ui4xcI9SxSrybVDwcGyqha62hBLb/Y1vP3CQsXzrAm77tsNMqH7 vfA2W6c4fTMddjAnx6FSfWCqFyOxeAlf6hIFhKYceRWJw28ONp7fxgKYEVURK9bGT38n VHsmW0rFkrQ7rT1YmD6rn6bEPoZQB/cGvX1V1TiiRVWkkSA4e5Fy0IozAF1HmoBBOtPT BUqXF/QMSbtmaG0mzq2SaDsCLlN0a0Q2qjUhYGd4TFETXXsMd2htlIulpnJV9dgGJN3W eHsF9spz13vCgmrXzgHeDr0WaRWM36yiCb/SImmNHgjg9SxQQfzSGfs6kygcTPybbcAG oyKA== X-Gm-Message-State: APjAAAWOiBDo5fAmZd7jyXFPjLeu/ORuslfHr3tTLBlAaE5wGg+Bo8oU e1/DxgTisDpc3BfUCPWm9tWvlg== X-Google-Smtp-Source: APXvYqyCry89U8JhHB2JmnnGGqfqp6e2/sFNsw+rUzw40rZSQ9y3ohq76mRbxz8eJb3EdmcaMK/hOw== X-Received: by 2002:aa7:98d0:: with SMTP id e16mr33457061pfm.77.1579137865146; Wed, 15 Jan 2020 17:24:25 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id d1sm1046181pjx.6.2020.01.15.17.24.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jan 2020 17:24:23 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Andrey Ryabinin , Elena Petrova , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v3 5/6] kasan: Unset panic_on_warn before calling panic() Date: Wed, 15 Jan 2020 17:23:20 -0800 Message-Id: <20200116012321.26254-6-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116012321.26254-1-keescook@chromium.org> References: <20200116012321.26254-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: As done in the full WARN() handler, panic_on_warn needs to be cleared before calling panic() to avoid recursive panics. Signed-off-by: Kees Cook Acked-by: Dmitry Vyukov --- mm/kasan/report.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/mm/kasan/report.c b/mm/kasan/report.c index 621782100eaa..844554e78893 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -92,8 +92,16 @@ static void end_report(unsigned long *flags) pr_err("==================================================================\n"); add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); spin_unlock_irqrestore(&report_lock, *flags); - if (panic_on_warn) + if (panic_on_warn) { + /* + * This thread may hit another WARN() in the panic path. + * Resetting this prevents additional WARN() from panicking the + * system on this thread. Other threads are blocked by the + * panic_mutex in panic(). + */ + panic_on_warn = 0; panic("panic_on_warn set ...\n"); + } kasan_enable_current(); } From patchwork Thu Jan 16 01:23:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11335789 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8E63A13BD for ; Thu, 16 Jan 2020 01:24:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 505302467E for ; Thu, 16 Jan 2020 01:24:36 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="B7I20849" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 505302467E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id B6A498E001A; Wed, 15 Jan 2020 20:24:26 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id AF2668E0003; Wed, 15 Jan 2020 20:24:26 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 96ED08E001A; Wed, 15 Jan 2020 20:24:26 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0135.hostedemail.com [216.40.44.135]) by kanga.kvack.org (Postfix) with ESMTP id 7E0428E0003 for ; Wed, 15 Jan 2020 20:24:26 -0500 (EST) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with SMTP id 34C6A8248047 for ; Thu, 16 Jan 2020 01:24:26 +0000 (UTC) X-FDA: 76381752132.27.skin83_7df859f45b158 X-Spam-Summary: 2,0,0,873d0f7068367db5,d41d8cd98f00b204,keescook@chromium.org,:akpm@linux-foundation.org:keescook@chromium.org:dvyukov@google.com:aryabinin@virtuozzo.com:lenaptr@google.com:glider@google.com:dan.carpenter@oracle.com:gustavo@embeddedor.com:arnd@arndb.de:ard.biesheuvel@linaro.org:kasan-dev@googlegroups.com::linux-kernel@vger.kernel.org:kernel-hardening@lists.openwall.com:syzkaller@googlegroups.com,RULES_HIT:2:41:69:355:379:541:800:960:967:973:982:988:989:1260:1311:1314:1345:1359:1437:1515:1535:1606:1730:1747:1777:1792:2393:2525:2559:2563:2682:2685:2859:2901:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3355:3865:3866:3867:3870:3871:3872:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4119:4250:4321:5007:6261:6653:6742:8603:8957:9025:9592:10004:11026:11658:11914:12043:12291:12296:12297:12438:12517:12519:12555:12679:12683:12895:13894:14394:21080:21444:21451:21627:21939:21990:30003:30025:30030:30054:30070,0,RBL:209.85.215.193:@ch romium.o X-HE-Tag: skin83_7df859f45b158 X-Filterd-Recvd-Size: 8734 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) by imf29.hostedemail.com (Postfix) with ESMTP for ; Thu, 16 Jan 2020 01:24:25 +0000 (UTC) Received: by mail-pg1-f193.google.com with SMTP id r11so9059489pgf.1 for ; Wed, 15 Jan 2020 17:24:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=q9yyIQHmH5l6RRr9oXrsGBCw2p7gy7/zKkbegYq6Q+s=; b=B7I20849zduaZUej22ttALxy7KpacppyUhdQv1th1EbyGmfRtv2NhklqGAXCd1Yk/D A2MkOc6mg+JxfrAnAoKrmKGlVo+my3T/Ah2SNdDuBATJOSh66n91QfvL5cLmwAOnMA1w CKqyQ779gOAv3EBPiHu5x7+K4nn9ELNeDZaUA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=q9yyIQHmH5l6RRr9oXrsGBCw2p7gy7/zKkbegYq6Q+s=; b=VFIT8pYznNXaGC/QgoP+c09C5enjuRL1V8ZNHDWjEy7nq7r7TDX6EFYV71dgQy3TW8 OVlBj17ueur5zMdfR/ItbsueHfBMSfxpuR3+IYBbEvl8UPtYTJ3hcHhPYHK8UXD3nE9N fBd4ZgGzasXDygY5KIENwDHyDa98zKXLYahsd59PbsErVv2JUUBuBq4rJ2LOoebG6p9Y U4PaSqui6NnlBl8asK9pcxf86blt4rAjSBauOtD2iw6rOYnkYUd7b2hToDaj5+qOXOT2 cRuMjIUv5YOL5mRjuR5je9U7BkOmaUOzI9Cyltex4hkoWuKacEu0/qaMepblXmsl3fsL o1vQ== X-Gm-Message-State: APjAAAXT+k9CxA9Sn8lJVXb1TcxOvzA3Zri623Wa+whX+NMTEP1eRUHc QG6KkiIpaQ77lF0s36R5Y1OLRg== X-Google-Smtp-Source: APXvYqyOAYblAndR/UL8Abnum2Ky8g1e0MSKZwDdBzyR2nJu09CRBhIWbjiNtyWu1tUKWCTcaalMuw== X-Received: by 2002:a63:e0f:: with SMTP id d15mr36134094pgl.255.1579137864589; Wed, 15 Jan 2020 17:24:24 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id bo19sm150751pjb.25.2020.01.15.17.24.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jan 2020 17:24:23 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Dmitry Vyukov , Andrey Ryabinin , Elena Petrova , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v3 6/6] ubsan: Include bug type in report header Date: Wed, 15 Jan 2020 17:23:21 -0800 Message-Id: <20200116012321.26254-7-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200116012321.26254-1-keescook@chromium.org> References: <20200116012321.26254-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When syzbot tries to figure out how to deduplicate bug reports, it prefers seeing a hint about a specific bug type (we can do better than just "UBSAN"). This lifts the handler reason into the UBSAN report line that includes the file path that tripped a check. Unfortunately, UBSAN does not provide function names. Suggested-by: Dmitry Vyukov Link: https://lore.kernel.org/lkml/CACT4Y+bsLJ-wFx_TaXqax3JByUOWB3uk787LsyMVcfW6JzzGvg@mail.gmail.com Signed-off-by: Kees Cook --- lib/ubsan.c | 36 +++++++++++++++--------------------- 1 file changed, 15 insertions(+), 21 deletions(-) diff --git a/lib/ubsan.c b/lib/ubsan.c index 429663eef6a7..057d5375bfc6 100644 --- a/lib/ubsan.c +++ b/lib/ubsan.c @@ -45,13 +45,6 @@ static bool was_reported(struct source_location *location) return test_and_set_bit(REPORTED_BIT, &location->reported); } -static void print_source_location(const char *prefix, - struct source_location *loc) -{ - pr_err("%s %s:%d:%d\n", prefix, loc->file_name, - loc->line & LINE_MASK, loc->column & COLUMN_MASK); -} - static bool suppress_report(struct source_location *loc) { return current->in_ubsan || was_reported(loc); @@ -140,13 +133,14 @@ static void val_to_string(char *str, size_t size, struct type_descriptor *type, } } -static void ubsan_prologue(struct source_location *location) +static void ubsan_prologue(struct source_location *loc, const char *reason) { current->in_ubsan++; pr_err("========================================" "========================================\n"); - print_source_location("UBSAN: Undefined behaviour in", location); + pr_err("UBSAN: %s in %s:%d:%d\n", reason, loc->file_name, + loc->line & LINE_MASK, loc->column & COLUMN_MASK); } static void ubsan_epilogue(void) @@ -180,12 +174,12 @@ static void handle_overflow(struct overflow_data *data, void *lhs, if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, type_is_signed(type) ? + "signed integer overflow" : + "unsigned integer overflow"); val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs); val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs); - pr_err("%s integer overflow:\n", - type_is_signed(type) ? "signed" : "unsigned"); pr_err("%s %c %s cannot be represented in type %s\n", lhs_val_str, op, @@ -225,7 +219,7 @@ void __ubsan_handle_negate_overflow(struct overflow_data *data, if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "negation overflow"); val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val); @@ -245,7 +239,7 @@ void __ubsan_handle_divrem_overflow(struct overflow_data *data, if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "division overflow"); val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs); @@ -264,7 +258,7 @@ static void handle_null_ptr_deref(struct type_mismatch_data_common *data) if (suppress_report(data->location)) return; - ubsan_prologue(data->location); + ubsan_prologue(data->location, "NULL pointer dereference"); pr_err("%s null pointer of type %s\n", type_check_kinds[data->type_check_kind], @@ -279,7 +273,7 @@ static void handle_misaligned_access(struct type_mismatch_data_common *data, if (suppress_report(data->location)) return; - ubsan_prologue(data->location); + ubsan_prologue(data->location, "misaligned access"); pr_err("%s misaligned address %p for type %s\n", type_check_kinds[data->type_check_kind], @@ -295,7 +289,7 @@ static void handle_object_size_mismatch(struct type_mismatch_data_common *data, if (suppress_report(data->location)) return; - ubsan_prologue(data->location); + ubsan_prologue(data->location, "object size mismatch"); pr_err("%s address %p with insufficient space\n", type_check_kinds[data->type_check_kind], (void *) ptr); @@ -354,7 +348,7 @@ void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "array index out of bounds"); val_to_string(index_str, sizeof(index_str), data->index_type, index); pr_err("index %s is out of range for type %s\n", index_str, @@ -375,7 +369,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, if (suppress_report(&data->location)) goto out; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "shift out of bounds"); val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs); val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs); @@ -407,7 +401,7 @@ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) { - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "unreachable"); pr_err("calling __builtin_unreachable()\n"); ubsan_epilogue(); panic("can't return from __builtin_unreachable()"); @@ -422,7 +416,7 @@ void __ubsan_handle_load_invalid_value(struct invalid_value_data *data, if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "invalid load"); val_to_string(val_str, sizeof(val_str), data->type, val);