From patchwork Fri Feb 5 17:34:41 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Konovalov X-Patchwork-Id: 12070591 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.1 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 434DCC433E6 for ; Fri, 5 Feb 2021 17:37:25 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id D742E64DD4 for ; Fri, 5 Feb 2021 17:37:24 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D742E64DD4 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:To:From:Subject:References:Mime-Version:Message-Id: In-Reply-To:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=vc01b6T5vX6Tv93xEtlFwB+V49qmS+FbCTgXvG6ILpY=; b=SK027k++LZxfYs7zTnFcMzUyk 4c5huepSgdF8BqxuyGy67eQehM66yh063B3sxRStsCj2r/YpH+cCieedfhFGC1ealsxW09c+tajYr LUQpEHanGz7ECn6Tec2Ftfunm0L88/KG3d8dlpgDasFprc48UNTv2DQz4kVL7l41JnuR/FSOtQfwA +HNZPyaINGi6hZLvHzmDnnqgMIwYX3c7ku19/vCGxFGde8LhhxJPWpmQd3rntWV4E1Lz6orfciEMS 3K3+VPEwamoioRYzRYAMDvzrw1b7u2+OHNRpExHyb/+AhymzZOfbyZLPYRV8w7u5HYl5qNJe/mam3 4ohAGNxeg==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1l851S-0005Dt-VX; Fri, 05 Feb 2021 17:35:59 +0000 Received: from mail-wm1-x34a.google.com ([2a00:1450:4864:20::34a]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1l850h-0004uE-8I for linux-arm-kernel@lists.infradead.org; Fri, 05 Feb 2021 17:35:20 +0000 Received: by mail-wm1-x34a.google.com with SMTP id t13so4075990wmq.7 for ; Fri, 05 Feb 2021 09:35:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:in-reply-to:message-id:mime-version:references:subject :from:to:cc; bh=6RV3PXvNWDRRLwJfhc9nA9uOtjOO4vRR2YJTlHhgy1g=; b=hr9DzLw8PMFXDmOtc8ZAyVLRhSu9H1GXAWRc7Isd9/XTI8Cgi/jOQVN1GFDvZnERyB G0HDSX6x8jQqkjNbE1UygZ3nJdUqxCSAPKSLVU27KQJjuRq2fa0ClujER0+PhSTzUcbZ nrhIBgxy8C9/vLXSIHaHysZ86Cf8ZxwaoECfAGez4vWWEVDoSH037sAnwgHeL68Yg5iV FjqojbgDKu9rTiWhHFSCGcCAnibfMdcmw/QUZF+vozj8e9iaXiBtzMtFGaPsuvLT80Kw 2VNm/yfw0oadQd2OIkqOcJCfOagcSL+70vJBOSCrH8Uczn7HUXpEpK1ijgH8yi9KwdHb prUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=6RV3PXvNWDRRLwJfhc9nA9uOtjOO4vRR2YJTlHhgy1g=; b=IyDZ7z/9kd91twFzoijXgF+VM75bClGWExZSpBmfvYpcXP6BYK9JHcsp/vo4+3e7VL 9JYip1BuBbqluc+FY9wtjKzk3P9jYmKuJqUA9CWqBSengg/Uk+UVKEZZkL5DAZbXjnqt f+/+U8uBrWhCAR2TfrWlQjBqmkhb0S2/Gw9T6DIqj4QfhbIOilc8NexW3MnIORDoB0D4 vvE+iC48K92iY0OIe9kEfJTMBIs1Aq6NZ8cZHjyV3K49HaS/rkpAvcCQ6LdDAWUrWVmG vgCiO7BnWn+KJczH+TQ50KurDjtJT8j+UJZFmcz48Oa3uOAqo9p8YP//Eg8kDGBL/4AS DBuA== X-Gm-Message-State: AOAM533dBogtW0GrEJK+9mA9NGpPRjqt2I7Si5VTc7kW8qJL626U295N bXA+oOyc2oCrWIW1b3jAka3/l/w9TuOnjjlz X-Google-Smtp-Source: ABdhPJytRzXE5voKMAWTVE7tb2OGC2+Y1oliS+AIv9OdSPsqoc+dVJE3s1RRE+LkSF8dIUprMqGcmE4wi/aHTTwX X-Received: from andreyknvl3.muc.corp.google.com ([2a00:79e0:15:13:edb8:b79c:2e20:e531]) (user=andreyknvl job=sendgmr) by 2002:a1c:3185:: with SMTP id x127mr4375625wmx.117.1612546507585; Fri, 05 Feb 2021 09:35:07 -0800 (PST) Date: Fri, 5 Feb 2021 18:34:41 +0100 In-Reply-To: Message-Id: Mime-Version: 1.0 References: X-Mailer: git-send-email 2.30.0.365.g02bc693789-goog Subject: [PATCH v3 mm 07/13] kasan, mm: fail krealloc on freed objects From: Andrey Konovalov To: Andrew Morton , Catalin Marinas , Vincenzo Frascino , Dmitry Vyukov , Alexander Potapenko , Marco Elver X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210205_123511_342369_80A716F6 X-CRM114-Status: GOOD ( 17.62 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Branislav Rankov , Andrey Konovalov , Kevin Brodsky , Will Deacon , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, Andrey Ryabinin , Peter Collingbourne , Evgenii Stepanov Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Currently, if krealloc() is called on a freed object with KASAN enabled, it allocates and returns a new object, but doesn't copy any memory from the old one as ksize() returns 0. This makes the caller believe that krealloc() succeeded (KASAN report is printed though). This patch adds an accessibility check into __do_krealloc(). If the check fails, krealloc() returns NULL. This check duplicates the one in ksize(); this is fixed in the following patch. This patch also adds a KASAN-KUnit test to check krealloc() behaviour when it's called on a freed object. Reviewed-by: Marco Elver Signed-off-by: Andrey Konovalov --- lib/test_kasan.c | 20 ++++++++++++++++++++ mm/slab_common.c | 3 +++ 2 files changed, 23 insertions(+) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index ffebad2f0e6e..1328c468fdb5 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -353,6 +353,25 @@ static void krealloc_pagealloc_less_oob(struct kunit *test) KMALLOC_MAX_CACHE_SIZE + 201); } +/* + * Check that krealloc() detects a use-after-free, returns NULL, + * and doesn't unpoison the freed object. + */ +static void krealloc_uaf(struct kunit *test) +{ + char *ptr1, *ptr2; + int size1 = 201; + int size2 = 235; + + ptr1 = kmalloc(size1, GFP_KERNEL); + KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1); + kfree(ptr1); + + KUNIT_EXPECT_KASAN_FAIL(test, ptr2 = krealloc(ptr1, size2, GFP_KERNEL)); + KUNIT_ASSERT_PTR_EQ(test, (void *)ptr2, NULL); + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)ptr1); +} + static void kmalloc_oob_16(struct kunit *test) { struct { @@ -1050,6 +1069,7 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(krealloc_less_oob), KUNIT_CASE(krealloc_pagealloc_more_oob), KUNIT_CASE(krealloc_pagealloc_less_oob), + KUNIT_CASE(krealloc_uaf), KUNIT_CASE(kmalloc_oob_16), KUNIT_CASE(kmalloc_uaf_16), KUNIT_CASE(kmalloc_oob_in_memset), diff --git a/mm/slab_common.c b/mm/slab_common.c index 39d1a8ff9bb8..dad70239b54c 100644 --- a/mm/slab_common.c +++ b/mm/slab_common.c @@ -1140,6 +1140,9 @@ static __always_inline void *__do_krealloc(const void *p, size_t new_size, void *ret; size_t ks; + if (likely(!ZERO_OR_NULL_PTR(p)) && !kasan_check_byte(p)) + return NULL; + ks = ksize(p); if (ks >= new_size) {