From patchwork Thu Feb 27 19:35:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11409553 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CD12314E3 for ; Thu, 27 Feb 2020 19:35:29 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 8C2452468E for ; Thu, 27 Feb 2020 19:35:29 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="eKbq1uyx" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 8C2452468E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 60FE56B0007; Thu, 27 Feb 2020 14:35:25 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 598C46B0008; Thu, 27 Feb 2020 14:35:25 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 461EB6B000A; Thu, 27 Feb 2020 14:35:25 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0159.hostedemail.com [216.40.44.159]) by kanga.kvack.org (Postfix) with ESMTP id 2E5CA6B0007 for ; Thu, 27 Feb 2020 14:35:25 -0500 (EST) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 2280A180AD802 for ; Thu, 27 Feb 2020 19:35:25 +0000 (UTC) X-FDA: 76536911010.10.cakes46_1226794090151 X-Spam-Summary: 30,2,0,2c1ba021d0e02c8b,d41d8cd98f00b204,keescook@chromium.org,,RULES_HIT:41:355:379:472:541:800:960:968:973:982:988:989:1260:1311:1314:1345:1359:1437:1515:1535:1544:1605:1711:1730:1747:1777:1792:2198:2199:2393:2553:2559:2562:2731:2736:2899:3138:3139:3140:3141:3142:3865:3866:3867:3868:3870:3871:3874:4118:4250:4321:4605:5007:6119:6261:6653:6742:6755:7903:8603:8660:8784:10004:11026:11232:11473:11658:11914:12043:12219:12296:12297:12438:12517:12519:12555:12895:12986:13148:13161:13221:13229:13230:13894:13972:14093:14096:14181:14394:14721:21080:21325:21433:21444:21451:21611:21627:21889:21939:30012:30054:30062:30074:30089:30090,0,RBL:209.85.216.68:@chromium.org:.lbl8.mailshell.net-66.100.201.201 62.2.0.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:24,LUA_SUMMARY:none X-HE-Tag: cakes46_1226794090151 X-Filterd-Recvd-Size: 7692 Received: from mail-pj1-f68.google.com (mail-pj1-f68.google.com [209.85.216.68]) by imf39.hostedemail.com (Postfix) with ESMTP for ; Thu, 27 Feb 2020 19:35:24 +0000 (UTC) Received: by mail-pj1-f68.google.com with SMTP id fa20so221991pjb.1 for ; Thu, 27 Feb 2020 11:35:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=ouVhJC1LzbMtIjBpkBkXzJDLKbzWPj7ADPmF+3aq9S8=; b=eKbq1uyxj9sdlKd8KWlneIzqahwkro68DRX4rRBijPFKNce5ok5QxzJT6Ig9AabiKE 6wTImMPfJk6hvjOiqFoNJIrRNWOqk/eMQzD3Sn8a3wtYnD8lTY/23SEpWi1CDHEb78B+ UP8RTZTWnKxekxqZDolSm+CIiKJsffOwIQXck= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=ouVhJC1LzbMtIjBpkBkXzJDLKbzWPj7ADPmF+3aq9S8=; b=mzlmKWDnGRarY6sob8XN4R8PBWLBDOjxHkscxAHWesmFIOpQIPjXoo+BOoMm5sOtS4 1GBjLZmXUoc46c9/ZzY6Kz45GC5CQMwoJ1UHr9eC2q+2QcaGOqLfB4/SVXGDi6C6EKad P2hvdCpgFt0Fwzd/X8XpOcAP2z4yL8rcwy0aNcrITAjuTvnvfi9Z6a9iMZKNx8ks1nne H/KJwsKiAEJUxBxQ/3VqzxZ1CjAWZzxbhn13xehbIbLj+dzrOUhCTmtZXklbQb2jxsok PJnJl+Sv85+9kNEjDT+ti/cQ+0p44pPZHdZMn9+z0nZY4+2zPbKXYTcLA37KyrgBFh8X S3IA== X-Gm-Message-State: APjAAAWUdYxNHxTKNqR6PBPJJfqJXxwbm0Gkfr6Lt2/idyKg8JT8HYqb v9eyuInKJgL1tlW0hwma8IQfDQ== X-Google-Smtp-Source: APXvYqxTwZu2muMNOSE/MnDg7HrxUrqj2WJlHpWI6A4QY/3Gzc92Hs6WuLhx1gx2liU6bGiSGd3vuA== X-Received: by 2002:a17:902:ba8a:: with SMTP id k10mr312829pls.333.1582832123523; Thu, 27 Feb 2020 11:35:23 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id v22sm4018043pfe.49.2020.02.27.11.35.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Feb 2020 11:35:20 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Elena Petrova , Dmitry Vyukov , Andrey Ryabinin , Andrey Konovalov , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v5 1/6] ubsan: Add trap instrumentation option Date: Thu, 27 Feb 2020 11:35:11 -0800 Message-Id: <20200227193516.32566-2-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200227193516.32566-1-keescook@chromium.org> References: <20200227193516.32566-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: The Undefined Behavior Sanitizer can operate in two modes: warning reporting mode via lib/ubsan.c handler calls, or trap mode, which uses __builtin_trap() as the handler. Using lib/ubsan.c means the kernel image is about 5% larger (due to all the debugging text and reporting structures to capture details about the warning conditions). Using the trap mode, the image size changes are much smaller, though at the loss of the "warning only" mode. In order to give greater flexibility to system builders that want minimal changes to image size and are prepared to deal with kernel code being aborted and potentially destabilizing the system, this introduces CONFIG_UBSAN_TRAP. The resulting image sizes comparison: text data bss dec hex filename 19533663 6183037 18554956 44271656 2a38828 vmlinux.stock 19991849 7618513 18874448 46484810 2c54d4a vmlinux.ubsan 19712181 6284181 18366540 44362902 2a4ec96 vmlinux.ubsan-trap CONFIG_UBSAN=y: image +4.8% (text +2.3%, data +18.9%) CONFIG_UBSAN_TRAP=y: image +0.2% (text +0.9%, data +1.6%) Additionally adjusts the CONFIG_UBSAN Kconfig help for clarity and removes the mention of non-existing boot param "ubsan_handle". Suggested-by: Elena Petrova Signed-off-by: Kees Cook Acked-by: Dmitry Vyukov --- lib/Kconfig.ubsan | 22 ++++++++++++++++++---- lib/Makefile | 2 ++ scripts/Makefile.ubsan | 9 +++++++-- 3 files changed, 27 insertions(+), 6 deletions(-) diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan index 0e04fcb3ab3d..9deb655838b0 100644 --- a/lib/Kconfig.ubsan +++ b/lib/Kconfig.ubsan @@ -5,11 +5,25 @@ config ARCH_HAS_UBSAN_SANITIZE_ALL config UBSAN bool "Undefined behaviour sanity checker" help - This option enables undefined behaviour sanity checker + This option enables the Undefined Behaviour sanity checker. Compile-time instrumentation is used to detect various undefined - behaviours in runtime. Various types of checks may be enabled - via boot parameter ubsan_handle - (see: Documentation/dev-tools/ubsan.rst). + behaviours at runtime. For more details, see: + Documentation/dev-tools/ubsan.rst + +config UBSAN_TRAP + bool "On Sanitizer warnings, abort the running kernel code" + depends on UBSAN + depends on $(cc-option, -fsanitize-undefined-trap-on-error) + help + Building kernels with Sanitizer features enabled tends to grow + the kernel size by around 5%, due to adding all the debugging + text on failure paths. To avoid this, Sanitizer instrumentation + can just issue a trap. This reduces the kernel size overhead but + turns all warnings (including potentially harmless conditions) + into full exceptions that abort the running kernel code + (regardless of context, locks held, etc), which may destabilize + the system. For some system builders this is an acceptable + trade-off. config UBSAN_SANITIZE_ALL bool "Enable instrumentation for the entire kernel" diff --git a/lib/Makefile b/lib/Makefile index 611872c06926..55cc8d73cd43 100644 --- a/lib/Makefile +++ b/lib/Makefile @@ -279,7 +279,9 @@ quiet_cmd_build_OID_registry = GEN $@ clean-files += oid_registry_data.c obj-$(CONFIG_UCS2_STRING) += ucs2_string.o +ifneq ($(CONFIG_UBSAN_TRAP),y) obj-$(CONFIG_UBSAN) += ubsan.o +endif UBSAN_SANITIZE_ubsan.o := n KASAN_SANITIZE_ubsan.o := n diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan index 019771b845c5..668a91510bfe 100644 --- a/scripts/Makefile.ubsan +++ b/scripts/Makefile.ubsan @@ -1,5 +1,10 @@ # SPDX-License-Identifier: GPL-2.0 ifdef CONFIG_UBSAN + +ifdef CONFIG_UBSAN_ALIGNMENT + CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment) +endif + CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift) CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero) CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable) @@ -9,8 +14,8 @@ ifdef CONFIG_UBSAN CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool) CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum) -ifdef CONFIG_UBSAN_ALIGNMENT - CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment) +ifdef CONFIG_UBSAN_TRAP + CFLAGS_UBSAN += $(call cc-option, -fsanitize-undefined-trap-on-error) endif # -fsanitize=* options makes GCC less smart than usual and From patchwork Thu Feb 27 19:35:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11409551 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8C91314E3 for ; Thu, 27 Feb 2020 19:35:27 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 47A462468E for ; Thu, 27 Feb 2020 19:35:27 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="fhU4ZWts" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 47A462468E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id B8E2D6B0006; Thu, 27 Feb 2020 14:35:24 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id AC8556B0007; Thu, 27 Feb 2020 14:35:24 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9B5B46B0008; Thu, 27 Feb 2020 14:35:24 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0235.hostedemail.com [216.40.44.235]) by kanga.kvack.org (Postfix) with ESMTP id 81F5B6B0006 for ; Thu, 27 Feb 2020 14:35:24 -0500 (EST) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 6E052B9E9 for ; Thu, 27 Feb 2020 19:35:24 +0000 (UTC) X-FDA: 76536910968.28.music86_12089389c9b0f X-Spam-Summary: 2,0,0,2d526b671fa40c8b,d41d8cd98f00b204,keescook@chromium.org,,RULES_HIT:2:41:355:379:541:800:960:967:973:982:988:989:1260:1311:1314:1345:1359:1431:1437:1515:1535:1605:1606:1730:1747:1777:1792:2198:2199:2393:2525:2559:2564:2682:2685:2693:2731:2859:2897:2912:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3743:3865:3866:3867:3868:3870:3871:3872:3873:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4119:4250:4321:4605:5007:6119:6261:6653:6691:6742:6755:7808:7903:7904:8603:8660:8784:9025:10004:11026:11473:11658:11914:12043:12219:12291:12296:12297:12438:12517:12519:12555:12698:12737:12895:13148:13230:13894:14096:14394:21063:21080:21444:21451:21627:21740:21966:21972:30012:30054:30056:30062:30070:30074,0,RBL:209.85.214.195:@chromium.org:.lbl8.mailshell.net-62.2.0.100 66.100.201.201,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:26,LUA_SUMMARY:none X-HE-Tag: music86_12089389c9b0f X-Filterd-Recvd-Size: 8352 Received: from mail-pl1-f195.google.com (mail-pl1-f195.google.com [209.85.214.195]) by imf04.hostedemail.com (Postfix) with ESMTP for ; Thu, 27 Feb 2020 19:35:23 +0000 (UTC) Received: by mail-pl1-f195.google.com with SMTP id t14so199143plr.8 for ; Thu, 27 Feb 2020 11:35:23 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=TZN5E5934TvMDmRyA6YbiUZA3oVW+HYGx9jzlGs1fas=; b=fhU4ZWtsMwSX2mupe2qPd38EZqvMNduMdASxFGXOeV4vpARzuW/YSPVaTMFGN08Hhc XliIaYkwUiNY8jqwNeYkG4jQoqhhnqvlU2l4wKiF6qSNMzXt1xWnxElExOLM5ZL41m7y Z7z1AWZH5EHP1O9W7xlNQcsJwhj4eFUdEyy5Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=TZN5E5934TvMDmRyA6YbiUZA3oVW+HYGx9jzlGs1fas=; b=ToSmDGoB7H6YFzXto2bzYloX8r0UNr45M7QvUkCbxk+71NsxYYFI8ONKtc9tyKTwrP hFS0xz9nnKUMTN7NEwz7uLZ/SLcLCz/AHSj/rGAt8H4PmLccjdu6a9aSZEMPUyxbz4Rb HM5yE8IaIr3Irq+C1q3hjmq8Se5Mm/tgDCq+cdSf9dB9FXogiBzJnsyrV+/Fl6D413oA tlQdWibr5tkstxp2GV9X131PWGNRTd976jL4k77BAoRufkPi/PsBhcpU9rqW1ipCVJfl +If6wOd5zteThlWaGQxXRjmWGyTA+nXOqisU9ua9R/3+c4yCnP98ad/LEwBX85oHlkon vR4A== X-Gm-Message-State: APjAAAVBuOUXHWtnNZemSw1J+j/A1ngB2nOH7DLg1rI8lQGQa3xRjM9j tn6wvDRZO6gJ116odopP4OqRXA== X-Google-Smtp-Source: APXvYqy8bVQH818HJGFZc2ql+d1GQcz5CnyZ/Lu/Mb9ddeqTtnjcaB2N07vWUnQwqSXTy5cLxuMyQA== X-Received: by 2002:a17:902:7048:: with SMTP id h8mr383251plt.64.1582832122570; Thu, 27 Feb 2020 11:35:22 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id x7sm4244205pgp.0.2020.02.27.11.35.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Feb 2020 11:35:20 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Elena Petrova , Andrey Ryabinin , Dmitry Vyukov , Andrey Konovalov , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v5 2/6] ubsan: Split "bounds" checker from other options Date: Thu, 27 Feb 2020 11:35:12 -0800 Message-Id: <20200227193516.32566-3-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200227193516.32566-1-keescook@chromium.org> References: <20200227193516.32566-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: In order to do kernel builds with the bounds checker individually available, introduce CONFIG_UBSAN_BOUNDS, with the remaining options under CONFIG_UBSAN_MISC. For example, using this, we can start to expand the coverage syzkaller is providing. Right now, all of UBSan is disabled for syzbot builds because taken as a whole, it is too noisy. This will let us focus on one feature at a time. For the bounds checker specifically, this provides a mechanism to eliminate an entire class of array overflows with close to zero performance overhead (I cannot measure a difference). In my (mostly) defconfig, enabling bounds checking adds ~4200 checks to the kernel. Performance changes are in the noise, likely due to the branch predictors optimizing for the non-fail path. Some notes on the bounds checker: - it does not instrument {mem,str}*()-family functions, it only instruments direct indexed accesses (e.g. "foo[i]"). Dealing with the {mem,str}*()-family functions is a work-in-progress around CONFIG_FORTIFY_SOURCE[1]. - it ignores flexible array members, including the very old single byte (e.g. "int foo[1];") declarations. (Note that GCC's implementation appears to ignore _all_ trailing arrays, but Clang only ignores empty, 0, and 1 byte arrays[2].) [1] https://github.com/KSPP/linux/issues/6 [2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92589 Suggested-by: Elena Petrova Signed-off-by: Kees Cook Reviewed-by: Andrey Ryabinin Acked-by: Dmitry Vyukov --- lib/Kconfig.ubsan | 29 ++++++++++++++++++++++++----- scripts/Makefile.ubsan | 7 ++++++- 2 files changed, 30 insertions(+), 6 deletions(-) diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan index 9deb655838b0..48469c95d78e 100644 --- a/lib/Kconfig.ubsan +++ b/lib/Kconfig.ubsan @@ -2,7 +2,7 @@ config ARCH_HAS_UBSAN_SANITIZE_ALL bool -config UBSAN +menuconfig UBSAN bool "Undefined behaviour sanity checker" help This option enables the Undefined Behaviour sanity checker. @@ -10,9 +10,10 @@ config UBSAN behaviours at runtime. For more details, see: Documentation/dev-tools/ubsan.rst +if UBSAN + config UBSAN_TRAP bool "On Sanitizer warnings, abort the running kernel code" - depends on UBSAN depends on $(cc-option, -fsanitize-undefined-trap-on-error) help Building kernels with Sanitizer features enabled tends to grow @@ -25,9 +26,26 @@ config UBSAN_TRAP the system. For some system builders this is an acceptable trade-off. +config UBSAN_BOUNDS + bool "Perform array index bounds checking" + default UBSAN + help + This option enables detection of directly indexed out of bounds + array accesses, where the array size is known at compile time. + Note that this does not protect array overflows via bad calls + to the {str,mem}*cpy() family of functions (that is addressed + by CONFIG_FORTIFY_SOURCE). + +config UBSAN_MISC + bool "Enable all other Undefined Behavior sanity checks" + default UBSAN + help + This option enables all sanity checks that don't have their + own Kconfig options. Disable this if you only want to have + individually selected checks. + config UBSAN_SANITIZE_ALL bool "Enable instrumentation for the entire kernel" - depends on UBSAN depends on ARCH_HAS_UBSAN_SANITIZE_ALL # We build with -Wno-maybe-uninitilzed, but we still want to @@ -44,7 +62,6 @@ config UBSAN_SANITIZE_ALL config UBSAN_NO_ALIGNMENT bool "Disable checking of pointers alignment" - depends on UBSAN default y if HAVE_EFFICIENT_UNALIGNED_ACCESS help This option disables the check of unaligned memory accesses. @@ -57,7 +74,9 @@ config UBSAN_ALIGNMENT config TEST_UBSAN tristate "Module for testing for undefined behavior detection" - depends on m && UBSAN + depends on m help This is a test module for UBSAN. It triggers various undefined behavior, and detect it. + +endif # if UBSAN diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan index 668a91510bfe..5b15bc425ec9 100644 --- a/scripts/Makefile.ubsan +++ b/scripts/Makefile.ubsan @@ -5,14 +5,19 @@ ifdef CONFIG_UBSAN_ALIGNMENT CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment) endif +ifdef CONFIG_UBSAN_BOUNDS + CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds) +endif + +ifdef CONFIG_UBSAN_MISC CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift) CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero) CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable) CFLAGS_UBSAN += $(call cc-option, -fsanitize=signed-integer-overflow) - CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds) CFLAGS_UBSAN += $(call cc-option, -fsanitize=object-size) CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool) CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum) +endif ifdef CONFIG_UBSAN_TRAP CFLAGS_UBSAN += $(call cc-option, -fsanitize-undefined-trap-on-error) From patchwork Thu Feb 27 19:35:13 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11409557 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 7F19F159A for ; Thu, 27 Feb 2020 19:35:34 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 429E62468E for ; Thu, 27 Feb 2020 19:35:34 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="U18RVdaW" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 429E62468E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id CA0356B000A; Thu, 27 Feb 2020 14:35:27 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id C5ED26B000C; Thu, 27 Feb 2020 14:35:27 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A57526B000D; Thu, 27 Feb 2020 14:35:27 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0094.hostedemail.com [216.40.44.94]) by kanga.kvack.org (Postfix) with ESMTP id 8F0D26B000A for ; Thu, 27 Feb 2020 14:35:27 -0500 (EST) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 7FD41180AD802 for ; Thu, 27 Feb 2020 19:35:27 +0000 (UTC) X-FDA: 76536911094.10.house02_1279992d5e558 X-Spam-Summary: 2,0,0,b0e3d643c6037ee7,d41d8cd98f00b204,keescook@chromium.org,,RULES_HIT:41:355:379:541:800:960:966:973:988:989:1260:1311:1314:1345:1359:1431:1437:1515:1535:1543:1711:1730:1747:1777:1792:2196:2199:2393:2559:2562:2901:2915:3138:3139:3140:3141:3142:3354:3865:3866:3867:3868:3870:3871:3872:4117:4250:4321:4385:5007:6261:6653:6742:8603:10004:11026:11473:11658:11914:12043:12291:12296:12297:12438:12517:12519:12555:12683:12694:12737:12895:12986:13894:14096:14110:14181:14394:14721:21080:21444:21451:21627:21972:21990:30054:30070,0,RBL:209.85.215.193:@chromium.org:.lbl8.mailshell.net-66.100.201.201 62.2.0.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:24,LUA_SUMMARY:none X-HE-Tag: house02_1279992d5e558 X-Filterd-Recvd-Size: 6820 Received: from mail-pg1-f193.google.com (mail-pg1-f193.google.com [209.85.215.193]) by imf32.hostedemail.com (Postfix) with ESMTP for ; Thu, 27 Feb 2020 19:35:26 +0000 (UTC) Received: by mail-pg1-f193.google.com with SMTP id j15so202813pgm.6 for ; Thu, 27 Feb 2020 11:35:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=tZTI1WKOfKcUGuqkPLx5fh8/0duDs7Ezr+5qHoGz4tY=; b=U18RVdaWlP4fBhZgQ7gfvBZ661edo3X9oUFSv45hHr9vetX28ZNvck46LUZ1rbgFl7 CoC4XHpp5cC7LAS3bYtkiJL7toH48S68r6LeXzb4rPgznn2+AxmV9w7kxkJPj9fN2INY Amg3+QBFjZeomIWu5Uc7552gBpvlzUK6BPO/k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=tZTI1WKOfKcUGuqkPLx5fh8/0duDs7Ezr+5qHoGz4tY=; b=soFkTN/XyrbNYK5WIqw7jiiGE7RKW4MuUfvyTM0SVkxyH+IzCm2sA9XXV7zjbiCK9Z AzyxRxGUU9rya/miTkEJjU8dOA2+TRx6BnGUkAxbEyktmQEdcPAHmc6m3cYquh+pnng2 C7sYndWYVI9PZ9P4aGsZb0E7PBfh4MvP7Xb1C1sOC8sw0cFrS+qnXCNpneuAvozQsqjY i8sMAyWiI3pYamRXu0n+D/vcSuoDNvtb5ADKJQsCEvxUCaAr5fo+udfLGd2doYDNG7j0 IFPvioOYdOG3GeT0apG/ZFrwYrDBR7M4rQoraHNPBJi05L0IKia+Ee4UW2Hq+ri3pNrR eoTA== X-Gm-Message-State: APjAAAWzhFm+Eu65abzXBXUJ2Qgxw+cM/iCEUHTWqCzPXcAYUvdoe/D6 KBQW+p5HigGINJrtIsd96x/BDQ== X-Google-Smtp-Source: APXvYqxyCvij60VoJLTsJE+/xAjIsKAshftPcvHqagxU4eIhmZpMwxKx52I39qHK7Pkm7LLOl0iliA== X-Received: by 2002:a65:668c:: with SMTP id b12mr914117pgw.14.1582832125520; Thu, 27 Feb 2020 11:35:25 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id w11sm7478980pgh.5.2020.02.27.11.35.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Feb 2020 11:35:20 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Dmitry Vyukov , Andrey Ryabinin , Elena Petrova , Andrey Konovalov , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v5 3/6] lkdtm/bugs: Add arithmetic overflow and array bounds checks Date: Thu, 27 Feb 2020 11:35:13 -0800 Message-Id: <20200227193516.32566-4-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200227193516.32566-1-keescook@chromium.org> References: <20200227193516.32566-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Adds LKDTM tests for arithmetic overflow (both signed and unsigned), as well as array bounds checking. Signed-off-by: Kees Cook Acked-by: Dmitry Vyukov --- drivers/misc/lkdtm/bugs.c | 75 ++++++++++++++++++++++++++++++++++++++ drivers/misc/lkdtm/core.c | 3 ++ drivers/misc/lkdtm/lkdtm.h | 3 ++ 3 files changed, 81 insertions(+) diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index de87693cf557..e4c61ffea35c 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -11,6 +11,7 @@ #include #include #include +#include #ifdef CONFIG_X86_32 #include @@ -175,6 +176,80 @@ void lkdtm_HUNG_TASK(void) schedule(); } +volatile unsigned int huge = INT_MAX - 2; +volatile unsigned int ignored; + +void lkdtm_OVERFLOW_SIGNED(void) +{ + int value; + + value = huge; + pr_info("Normal signed addition ...\n"); + value += 1; + ignored = value; + + pr_info("Overflowing signed addition ...\n"); + value += 4; + ignored = value; +} + + +void lkdtm_OVERFLOW_UNSIGNED(void) +{ + unsigned int value; + + value = huge; + pr_info("Normal unsigned addition ...\n"); + value += 1; + ignored = value; + + pr_info("Overflowing unsigned addition ...\n"); + value += 4; + ignored = value; +} + +/* Intentially using old-style flex array definition of 1 byte. */ +struct array_bounds_flex_array { + int one; + int two; + char data[1]; +}; + +struct array_bounds { + int one; + int two; + char data[8]; + int three; +}; + +void lkdtm_ARRAY_BOUNDS(void) +{ + struct array_bounds_flex_array *not_checked; + struct array_bounds *checked; + volatile int i; + + not_checked = kmalloc(sizeof(*not_checked) * 2, GFP_KERNEL); + checked = kmalloc(sizeof(*checked) * 2, GFP_KERNEL); + + pr_info("Array access within bounds ...\n"); + /* For both, touch all bytes in the actual member size. */ + for (i = 0; i < sizeof(checked->data); i++) + checked->data[i] = 'A'; + /* + * For the uninstrumented flex array member, also touch 1 byte + * beyond to verify it is correctly uninstrumented. + */ + for (i = 0; i < sizeof(not_checked->data) + 1; i++) + not_checked->data[i] = 'A'; + + pr_info("Array access beyond bounds ...\n"); + for (i = 0; i < sizeof(checked->data) + 1; i++) + checked->data[i] = 'B'; + + kfree(not_checked); + kfree(checked); +} + void lkdtm_CORRUPT_LIST_ADD(void) { /* diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c index ee0d6e721441..2e04719b503c 100644 --- a/drivers/misc/lkdtm/core.c +++ b/drivers/misc/lkdtm/core.c @@ -129,6 +129,9 @@ static const struct crashtype crashtypes[] = { CRASHTYPE(HARDLOCKUP), CRASHTYPE(SPINLOCKUP), CRASHTYPE(HUNG_TASK), + CRASHTYPE(OVERFLOW_SIGNED), + CRASHTYPE(OVERFLOW_UNSIGNED), + CRASHTYPE(ARRAY_BOUNDS), CRASHTYPE(EXEC_DATA), CRASHTYPE(EXEC_STACK), CRASHTYPE(EXEC_KMALLOC), diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h index c56d23e37643..8391081c6f13 100644 --- a/drivers/misc/lkdtm/lkdtm.h +++ b/drivers/misc/lkdtm/lkdtm.h @@ -22,6 +22,9 @@ void lkdtm_SOFTLOCKUP(void); void lkdtm_HARDLOCKUP(void); void lkdtm_SPINLOCKUP(void); void lkdtm_HUNG_TASK(void); +void lkdtm_OVERFLOW_SIGNED(void); +void lkdtm_OVERFLOW_UNSIGNED(void); +void lkdtm_ARRAY_BOUNDS(void); void lkdtm_CORRUPT_LIST_ADD(void); void lkdtm_CORRUPT_LIST_DEL(void); void lkdtm_CORRUPT_USER_DS(void); From patchwork Thu Feb 27 19:35:14 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11409549 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 36639159A for ; Thu, 27 Feb 2020 19:35:25 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id E0C97246A3 for ; Thu, 27 Feb 2020 19:35:24 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="g/0EvsSA" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org E0C97246A3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 1A1786B0005; Thu, 27 Feb 2020 14:35:24 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 152716B0006; Thu, 27 Feb 2020 14:35:24 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 019A36B0007; Thu, 27 Feb 2020 14:35:23 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0041.hostedemail.com [216.40.44.41]) by kanga.kvack.org (Postfix) with ESMTP id DB3B96B0005 for ; Thu, 27 Feb 2020 14:35:23 -0500 (EST) Received: from smtpin21.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id B58208245578 for ; Thu, 27 Feb 2020 19:35:23 +0000 (UTC) X-FDA: 76536910926.21.drain28_11f133e8af607 X-Spam-Summary: 2,0,0,0fe10bee4529a0a7,d41d8cd98f00b204,keescook@chromium.org,,RULES_HIT:41:355:379:541:800:960:967:973:988:989:1260:1311:1314:1345:1359:1437:1515:1534:1541:1711:1730:1747:1777:1792:2393:2525:2553:2559:2563:2682:2685:2689:2859:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3352:3865:3867:3870:3871:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4250:4321:5007:6261:6653:6742:7903:8957:9025:10004:11026:11658:11914:12043:12291:12296:12297:12438:12517:12519:12555:12679:12683:12895:13069:13311:13357:13894:14181:14384:14394:14721:14777:21080:21444:21627:21740:21939:21983:30054:30070:30090,0,RBL:209.85.216.67:@chromium.org:.lbl8.mailshell.net-66.100.201.201 62.2.0.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:23,LUA_SUMMARY:none X-HE-Tag: drain28_11f133e8af607 X-Filterd-Recvd-Size: 4248 Received: from mail-pj1-f67.google.com (mail-pj1-f67.google.com [209.85.216.67]) by imf34.hostedemail.com (Postfix) with ESMTP for ; Thu, 27 Feb 2020 19:35:23 +0000 (UTC) Received: by mail-pj1-f67.google.com with SMTP id m7so3556042pjs.0 for ; Thu, 27 Feb 2020 11:35:22 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=46Z0N6nNFPIgM2OuwNgkHRjYe659IsqNoWw8FG0hdrY=; b=g/0EvsSAMFLQMs3F4fsuSd2nVZEd0UnWu4D3Sl3dqAK2cD5B2JP/5fjn+Xf0mTTCA1 5qBJKz6rexuU4wD/Fm2T6RKX1mqL5z11ejipV8pBRRNCR/z0fgr1nevk9cbdozCY3z4J CEEvmhdGXWUBzU64x5LbmMXX3iFxMU4Y/Igq8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=46Z0N6nNFPIgM2OuwNgkHRjYe659IsqNoWw8FG0hdrY=; b=fkeie0tHx5z6BRX4HUHxxFKZsiZ6VmxG79ToScUZGcGAIWwcAyDqWkuTJxsR1pwu1y VFniz+bU42747AVQ+AkMbDSJPYFh2LvW+1/vXdIiZwPHU6fnuBx1RwAus0GKiIR8w5d3 TulMi0A4xBXbzahGmpI5pMU+lucMgy8/Nc9w6Pge+hn+mrwydDgsFryAvpNthVRYvTUV Oxb8FVXJNcGwjKe+iXuGVSz947fasxiw/2wom/L2B2GRdU3iPfSa9pQu5FeNU8gA3AkU u4WAsCSmoyp7+CuCWYKmRrD/24j07oQsjs+/xjbNP9SaBMW8Wuxy1mpbNZ+WrmiLt8tN unGA== X-Gm-Message-State: APjAAAXhaTThPEXzyDHjU5AXrW7peHiEw5WJKF5hCKJZz+qPDSK+nP8f bLbwvI0k1EPI7YGcV1DBLRBaPw== X-Google-Smtp-Source: APXvYqyO3xXE1iYRbSHC6/Q9hVVz43xR0biiVO0z4es+cZucLAEsJlQuw4NFe3BlB1tUhIBv2xxm2g== X-Received: by 2002:a17:90a:c24c:: with SMTP id d12mr520844pjx.113.1582832121953; Thu, 27 Feb 2020 11:35:21 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id p18sm11620140pjo.3.2020.02.27.11.35.20 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Feb 2020 11:35:20 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Andrey Ryabinin , Elena Petrova , Andrey Konovalov , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v5 4/6] ubsan: Check panic_on_warn Date: Thu, 27 Feb 2020 11:35:14 -0800 Message-Id: <20200227193516.32566-5-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200227193516.32566-1-keescook@chromium.org> References: <20200227193516.32566-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Syzkaller expects kernel warnings to panic when the panic_on_warn sysctl is set. More work is needed here to have UBSan reuse the WARN infrastructure, but for now, just check the flag manually. Link: https://lore.kernel.org/lkml/CACT4Y+bsLJ-wFx_TaXqax3JByUOWB3uk787LsyMVcfW6JzzGvg@mail.gmail.com Signed-off-by: Kees Cook --- lib/ubsan.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/ubsan.c b/lib/ubsan.c index 7b9b58aee72c..429663eef6a7 100644 --- a/lib/ubsan.c +++ b/lib/ubsan.c @@ -156,6 +156,17 @@ static void ubsan_epilogue(void) "========================================\n"); current->in_ubsan--; + + if (panic_on_warn) { + /* + * This thread may hit another WARN() in the panic path. + * Resetting this prevents additional WARN() from panicking the + * system on this thread. Other threads are blocked by the + * panic_mutex in panic(). + */ + panic_on_warn = 0; + panic("panic_on_warn set ...\n"); + } } static void handle_overflow(struct overflow_data *data, void *lhs, From patchwork Thu Feb 27 19:35:15 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11409559 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id A1CAF159A for ; Thu, 27 Feb 2020 19:35:36 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 6EA762468E for ; Thu, 27 Feb 2020 19:35:36 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="YBkqK4RC" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 6EA762468E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 6AC606B000C; Thu, 27 Feb 2020 14:35:30 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 635036B000D; Thu, 27 Feb 2020 14:35:30 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4FD626B000E; Thu, 27 Feb 2020 14:35:30 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0018.hostedemail.com [216.40.44.18]) by kanga.kvack.org (Postfix) with ESMTP id 38BAB6B000C for ; Thu, 27 Feb 2020 14:35:30 -0500 (EST) Received: from smtpin07.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 2DCA0180AD802 for ; Thu, 27 Feb 2020 19:35:30 +0000 (UTC) X-FDA: 76536911220.07.dress88_12e031262d015 X-Spam-Summary: 13,1.2,0,3f4db963fc90d8a7,d41d8cd98f00b204,keescook@chromium.org,,RULES_HIT:41:355:379:541:800:960:973:988:989:1260:1311:1314:1345:1359:1437:1515:1534:1541:1711:1730:1747:1777:1792:2393:2553:2559:2562:3138:3139:3140:3141:3142:3352:3865:3867:3870:5007:6261:6653:6742:7903:10008:11026:11473:11658:11914:12043:12291:12297:12438:12517:12519:12555:12683:12895:13069:13311:13357:13894:14181:14384:14394:14721:21080:21212:21444:21451:21627:21939:21983:30054:30090,0,RBL:209.85.214.193:@chromium.org:.lbl8.mailshell.net-66.100.201.201 62.2.0.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:1:0,LFtime:24,LUA_SUMMARY:none X-HE-Tag: dress88_12e031262d015 X-Filterd-Recvd-Size: 4321 Received: from mail-pl1-f193.google.com (mail-pl1-f193.google.com [209.85.214.193]) by imf34.hostedemail.com (Postfix) with ESMTP for ; Thu, 27 Feb 2020 19:35:29 +0000 (UTC) Received: by mail-pl1-f193.google.com with SMTP id y1so202316plp.7 for ; Thu, 27 Feb 2020 11:35:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=sVbVapbdvm9D9bZT8RLizJdch6+5SIEY/KYRYQVG8Tk=; b=YBkqK4RCOblb4V5cg2JjztQtg3wh+brHnQ/Xnw/4IBUFJRhh4GeFiQP9nVouaSw+sY Iq7R/urAShHZ7CPMQvKGeXyT+FOvmE0vy0gms+GZvnF1oUTIeAIqmZaTytVTOmRvhGYp 9u4+wigHHHW5WR6VelBYcFCmp7ofnwGN7wT7U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=sVbVapbdvm9D9bZT8RLizJdch6+5SIEY/KYRYQVG8Tk=; b=c0rsxwPA1Eg0GyFhMcon7f3Pl88J3rDD2VkBGqPHHWJ2iL5EzSrirAX/VrdbnE8lLq htdXtV09gSczrJflv+b2FjR/id8iWm9V1F5CKCQ7P3jqXLphhIkJNHQiUvlCrlfZ7/MD cifGjyUVpoT8wUZvMre1Rx+yXgSiuZ0hs6AfsaCUflSomnH2hbsgddXC+SGqZP2Og00k gfiYO3buRZ/ebepl+FAYMjQNdLr8DrfUiiTFfEnW2G3ID77oJN7PyJeBQ+WQSuMjGDgj vANawJ03lpxt4FYp39bj8mfLXcOYEAWPyVmz6BEFqh8ZDAxQoVNh8eMQuUTpDo9+YR3T 4R3Q== X-Gm-Message-State: APjAAAWxNwf+DI0EQ6Oz98xx5XFDHS8M8fXdtyDFsQtXGdxg5Dl7Oriu Ka8ipA6E344OmKclOFtlhWE6VOQqn58= X-Google-Smtp-Source: APXvYqwJAU0YQCF3NBelWYbAkfjhxYyfXVhFnc+XRJm1wrTo2TVo3yr52ImKKRO716VR/awYEpFPlg== X-Received: by 2002:a17:90a:3266:: with SMTP id k93mr527984pjb.23.1582832128663; Thu, 27 Feb 2020 11:35:28 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id c26sm7957064pfi.46.2020.02.27.11.35.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Feb 2020 11:35:27 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Dmitry Vyukov , Andrey Ryabinin , Elena Petrova , Andrey Konovalov , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v5 5/6] kasan: Unset panic_on_warn before calling panic() Date: Thu, 27 Feb 2020 11:35:15 -0800 Message-Id: <20200227193516.32566-6-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200227193516.32566-1-keescook@chromium.org> References: <20200227193516.32566-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: As done in the full WARN() handler, panic_on_warn needs to be cleared before calling panic() to avoid recursive panics. Signed-off-by: Kees Cook Acked-by: Dmitry Vyukov --- mm/kasan/report.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/mm/kasan/report.c b/mm/kasan/report.c index 5ef9f24f566b..54bd98a1fc7b 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -92,8 +92,16 @@ static void end_report(unsigned long *flags) pr_err("==================================================================\n"); add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); spin_unlock_irqrestore(&report_lock, *flags); - if (panic_on_warn) + if (panic_on_warn) { + /* + * This thread may hit another WARN() in the panic path. + * Resetting this prevents additional WARN() from panicking the + * system on this thread. Other threads are blocked by the + * panic_mutex in panic(). + */ + panic_on_warn = 0; panic("panic_on_warn set ...\n"); + } kasan_enable_current(); } From patchwork Thu Feb 27 19:35:16 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11409563 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BE3FD17E0 for ; Thu, 27 Feb 2020 19:35:38 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7CDC82468E for ; Thu, 27 Feb 2020 19:35:38 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="RHZfJ6Zj" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7CDC82468E Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id CF06C6B000D; Thu, 27 Feb 2020 14:35:31 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id C76B26B000E; Thu, 27 Feb 2020 14:35:31 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B3D3E6B0010; Thu, 27 Feb 2020 14:35:31 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0172.hostedemail.com [216.40.44.172]) by kanga.kvack.org (Postfix) with ESMTP id 9C3C76B000D for ; Thu, 27 Feb 2020 14:35:31 -0500 (EST) Received: from smtpin23.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 7C740B9F4 for ; Thu, 27 Feb 2020 19:35:31 +0000 (UTC) X-FDA: 76536911262.23.use89_1312987a5621d X-Spam-Summary: 2,0,0,bd07272bfc17e69e,d41d8cd98f00b204,keescook@chromium.org,,RULES_HIT:2:41:69:355:379:541:800:960:967:973:982:988:989:1260:1311:1314:1345:1359:1437:1515:1535:1606:1730:1747:1777:1792:2393:2525:2559:2563:2682:2685:2859:2901:2902:2933:2937:2939:2942:2945:2947:2951:2954:3022:3138:3139:3140:3141:3142:3355:3865:3866:3867:3870:3871:3872:3874:3934:3936:3938:3941:3944:3947:3950:3953:3956:3959:4119:4250:4321:5007:6261:6653:6742:8603:8957:9025:9592:10004:11026:11658:11914:12043:12291:12296:12297:12438:12517:12519:12555:12679:12683:12895:13894:14394:21080:21444:21451:21627:21939:21990:30003:30025:30030:30054:30070,0,RBL:209.85.210.194:@chromium.org:.lbl8.mailshell.net-66.100.201.201 62.2.0.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:25,LUA_SUMMARY:none X-HE-Tag: use89_1312987a5621d X-Filterd-Recvd-Size: 8765 Received: from mail-pf1-f194.google.com (mail-pf1-f194.google.com [209.85.210.194]) by imf04.hostedemail.com (Postfix) with ESMTP for ; Thu, 27 Feb 2020 19:35:30 +0000 (UTC) Received: by mail-pf1-f194.google.com with SMTP id 2so333001pfg.12 for ; Thu, 27 Feb 2020 11:35:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=jDKV/BVhQvBMwfS/RHWg5/AFVijLTVXYoYGSEirzUqw=; b=RHZfJ6ZjFp5sp8ipveWK3eF5Dwye7KVaR6z9iE7vnbShK0NUzQN9/ddpgIgrsGsgEK go3dwiZKpqRZ3qYcFoaAv2UquFiu/gPa+ssqiHVgX5UpONSYMHpPyYe45+eKfCqoV6PD imMXzSGoEl4bONAdPTpTrri0RDknPx1NdKggU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=jDKV/BVhQvBMwfS/RHWg5/AFVijLTVXYoYGSEirzUqw=; b=DIiGDzefe9kST2p43BRbhuyndWW5nuUtF5HKTix3aLGcU55gyneMh/mhPMKS5+mXRY ikVfhMu/O94eq/c/1/5UHXEZMwGry4v9yPfQYMOqGNRFIhoMPoPCto5BnwyaJtYY4fUK ZHt4uCdJtXriY50YAT53dPTP9shCTYQ8IVAS5x3pkR3y75amNabWqTQpxmn1aXzXAcz0 NT5wNPuvqlULeSMrMYrbkrYNj5gMFqyXJl1QpgqGy0Wy2o8s4pCOTFk+Dym8YBP4xLkd 2KsGbUJL62YaAtiZKtQhmtjxNxTPDaKbitcO+7H+8ZCAi/RoqO1k9oudcrlvjmjrsfY4 c8Ww== X-Gm-Message-State: APjAAAWBFedzo6Y9BIWr+t9jALvXOX/9d2uhzvGaLTUHwIfEP1l3rfLn vwdAcxPdkHDFWqZWdh2zd4hM5w== X-Google-Smtp-Source: APXvYqyHeYlpEECGTPxzGxPWtF5ov215jrWWJl8MujEvBMWpkviZ0neOmsNjS1WOeToNJ2l0nbJvvA== X-Received: by 2002:a62:e80a:: with SMTP id c10mr518798pfi.129.1582832129371; Thu, 27 Feb 2020 11:35:29 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id o6sm8598900pfg.180.2020.02.27.11.35.22 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Feb 2020 11:35:27 -0800 (PST) From: Kees Cook To: Andrew Morton Cc: Kees Cook , Dmitry Vyukov , Andrey Ryabinin , Elena Petrova , Andrey Konovalov , Alexander Potapenko , Dan Carpenter , "Gustavo A. R. Silva" , Arnd Bergmann , Ard Biesheuvel , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, syzkaller@googlegroups.com Subject: [PATCH v5 6/6] ubsan: Include bug type in report header Date: Thu, 27 Feb 2020 11:35:16 -0800 Message-Id: <20200227193516.32566-7-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200227193516.32566-1-keescook@chromium.org> References: <20200227193516.32566-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: When syzbot tries to figure out how to deduplicate bug reports, it prefers seeing a hint about a specific bug type (we can do better than just "UBSAN"). This lifts the handler reason into the UBSAN report line that includes the file path that tripped a check. Unfortunately, UBSAN does not provide function names. Suggested-by: Dmitry Vyukov Link: https://lore.kernel.org/lkml/CACT4Y+bsLJ-wFx_TaXqax3JByUOWB3uk787LsyMVcfW6JzzGvg@mail.gmail.com Signed-off-by: Kees Cook Acked-by: Andrey Konovalov --- lib/ubsan.c | 36 +++++++++++++++--------------------- 1 file changed, 15 insertions(+), 21 deletions(-) diff --git a/lib/ubsan.c b/lib/ubsan.c index 429663eef6a7..f8c0ccf35f29 100644 --- a/lib/ubsan.c +++ b/lib/ubsan.c @@ -45,13 +45,6 @@ static bool was_reported(struct source_location *location) return test_and_set_bit(REPORTED_BIT, &location->reported); } -static void print_source_location(const char *prefix, - struct source_location *loc) -{ - pr_err("%s %s:%d:%d\n", prefix, loc->file_name, - loc->line & LINE_MASK, loc->column & COLUMN_MASK); -} - static bool suppress_report(struct source_location *loc) { return current->in_ubsan || was_reported(loc); @@ -140,13 +133,14 @@ static void val_to_string(char *str, size_t size, struct type_descriptor *type, } } -static void ubsan_prologue(struct source_location *location) +static void ubsan_prologue(struct source_location *loc, const char *reason) { current->in_ubsan++; pr_err("========================================" "========================================\n"); - print_source_location("UBSAN: Undefined behaviour in", location); + pr_err("UBSAN: %s in %s:%d:%d\n", reason, loc->file_name, + loc->line & LINE_MASK, loc->column & COLUMN_MASK); } static void ubsan_epilogue(void) @@ -180,12 +174,12 @@ static void handle_overflow(struct overflow_data *data, void *lhs, if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, type_is_signed(type) ? + "signed-integer-overflow" : + "unsigned-integer-overflow"); val_to_string(lhs_val_str, sizeof(lhs_val_str), type, lhs); val_to_string(rhs_val_str, sizeof(rhs_val_str), type, rhs); - pr_err("%s integer overflow:\n", - type_is_signed(type) ? "signed" : "unsigned"); pr_err("%s %c %s cannot be represented in type %s\n", lhs_val_str, op, @@ -225,7 +219,7 @@ void __ubsan_handle_negate_overflow(struct overflow_data *data, if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "negation-overflow"); val_to_string(old_val_str, sizeof(old_val_str), data->type, old_val); @@ -245,7 +239,7 @@ void __ubsan_handle_divrem_overflow(struct overflow_data *data, if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "division-overflow"); val_to_string(rhs_val_str, sizeof(rhs_val_str), data->type, rhs); @@ -264,7 +258,7 @@ static void handle_null_ptr_deref(struct type_mismatch_data_common *data) if (suppress_report(data->location)) return; - ubsan_prologue(data->location); + ubsan_prologue(data->location, "null-ptr-deref"); pr_err("%s null pointer of type %s\n", type_check_kinds[data->type_check_kind], @@ -279,7 +273,7 @@ static void handle_misaligned_access(struct type_mismatch_data_common *data, if (suppress_report(data->location)) return; - ubsan_prologue(data->location); + ubsan_prologue(data->location, "misaligned-access"); pr_err("%s misaligned address %p for type %s\n", type_check_kinds[data->type_check_kind], @@ -295,7 +289,7 @@ static void handle_object_size_mismatch(struct type_mismatch_data_common *data, if (suppress_report(data->location)) return; - ubsan_prologue(data->location); + ubsan_prologue(data->location, "object-size-mismatch"); pr_err("%s address %p with insufficient space\n", type_check_kinds[data->type_check_kind], (void *) ptr); @@ -354,7 +348,7 @@ void __ubsan_handle_out_of_bounds(struct out_of_bounds_data *data, void *index) if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "array-index-out-of-bounds"); val_to_string(index_str, sizeof(index_str), data->index_type, index); pr_err("index %s is out of range for type %s\n", index_str, @@ -375,7 +369,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, if (suppress_report(&data->location)) goto out; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "shift-out-of-bounds"); val_to_string(rhs_str, sizeof(rhs_str), rhs_type, rhs); val_to_string(lhs_str, sizeof(lhs_str), lhs_type, lhs); @@ -407,7 +401,7 @@ EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) { - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "unreachable"); pr_err("calling __builtin_unreachable()\n"); ubsan_epilogue(); panic("can't return from __builtin_unreachable()"); @@ -422,7 +416,7 @@ void __ubsan_handle_load_invalid_value(struct invalid_value_data *data, if (suppress_report(&data->location)) return; - ubsan_prologue(&data->location); + ubsan_prologue(&data->location, "invalid-load"); val_to_string(val_str, sizeof(val_str), data->type, val);