From patchwork Sat Jun 12 04:51:55 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kuan-Ying Lee X-Patchwork-Id: 12316865 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,FREEMAIL_FORGED_FROMDOMAIN, FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8715C48BCF for ; Sat, 12 Jun 2021 04:52:51 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 4F3E061246 for ; Sat, 12 Jun 2021 04:52:51 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4F3E061246 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E62576B0070; Sat, 12 Jun 2021 00:52:50 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E38266B0071; Sat, 12 Jun 2021 00:52:50 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D27386B0072; Sat, 12 Jun 2021 00:52:50 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0188.hostedemail.com [216.40.44.188]) by kanga.kvack.org (Postfix) with ESMTP id A01516B0070 for ; Sat, 12 Jun 2021 00:52:50 -0400 (EDT) Received: from smtpin04.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 42B8C181AEF23 for ; Sat, 12 Jun 2021 04:52:50 +0000 (UTC) X-FDA: 78243851700.04.A7B6262 Received: from mail-pf1-f179.google.com (mail-pf1-f179.google.com [209.85.210.179]) by imf27.hostedemail.com (Postfix) with ESMTP id 4EED38019357 for ; Sat, 12 Jun 2021 04:52:43 +0000 (UTC) Received: by mail-pf1-f179.google.com with SMTP id c12so6111727pfl.3 for ; Fri, 11 Jun 2021 21:52:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=xZpi/auc1uYGQ0mhRO9DGP7asmsg6AhH3/5v7rWbUt4=; b=ZcoSxJxrlysj6PmxQnN2feQVMjCpCIEOc0PRD1Sy26SkAFuPCIkNvoHoXBUGV6V/fS k5qMtgjMM2TwijnhyjtVu1R2L4EM0q3Jv/HavpMdsR7cNX6ycFqrPR+ur8B16H90oy7H 7N7oWu9e/+X4X8j0zhHNEkCTbyLKw5BTGQnZw69UwWvYcQwPeT+H3qAV8sDiNhMln+rc yprxgiBbWL3nhvPbMzZDsSEGDP0OKrvl42wL1PswjXyDAn1zSpetFLFlGECSR2NUraLT TWzxV43BA2CliT+jrJBcI6a0PXkWUX8E+fvznOjgAPLj2vWm6jeZ/vsgB9RJGwrb40kX XCUg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=xZpi/auc1uYGQ0mhRO9DGP7asmsg6AhH3/5v7rWbUt4=; b=Bk3+V16Scil+P+f0ov06wMYfVl3sHm4ShKLk8w2+YZrOsK3SXg+aaXJ+vasZHgOzT1 vok1S/IspSW3MkXVM4Eb6IUemQXzYTuFvwlteNlPEbweSm06Ze1cr+j8lZmLoh+ns5ss Kt4/H/Eyff9adlLutP1YsvGCWKgKlLOYn/qMH50GwtGjDPmkcH/qX7IGfwLZEefPNpYE q0aA7kSYzUyzQAsZ3iQo2a9jDFmHvQotbk+7XXgo6gW8Cl6zlGwlXlFp0EwTj5sCCa/S WotQzi+Uw046wlSuk2KhXBTPaX+f7mSkrRcm2z3G0nWuegZ1YUopreeLf03VLeJme1ct vIZw== X-Gm-Message-State: AOAM5322PotOBUG/R9M0ZbEvu91RWHhjlFyrUOuchLzHyq9mz8aHoglq XO98dFgZACHNjKSMaHlizeI= X-Google-Smtp-Source: ABdhPJzYCxYEqyaz6ABWMOjtLQRlRP7Qef7aI/cIPnMZcc1dhVxo6XcVVu99GccmnKVrWEGv1SrlRg== X-Received: by 2002:a63:7d2:: with SMTP id 201mr7032031pgh.14.1623473569284; Fri, 11 Jun 2021 21:52:49 -0700 (PDT) Received: from lee-virtual-machine.localdomain (61-230-42-225.dynamic-ip.hinet.net. [61.230.42.225]) by smtp.gmail.com with ESMTPSA id m1sm6076572pgd.78.2021.06.11.21.52.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 11 Jun 2021 21:52:49 -0700 (PDT) From: Kuan-Ying Lee To: Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Andrew Morton Cc: kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Kuan-Ying Lee , Marco Elver Subject: [PATCH v2 2/3] kasan: integrate the common part of two KASAN tag-based modes Date: Sat, 12 Jun 2021 12:51:55 +0800 Message-Id: <20210612045156.44763-3-kylee0686026@gmail.com> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210612045156.44763-1-kylee0686026@gmail.com> References: <20210612045156.44763-1-kylee0686026@gmail.com> MIME-Version: 1.0 Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=gmail.com header.s=20161025 header.b=ZcoSxJxr; spf=pass (imf27.hostedemail.com: domain of kylee0686026@gmail.com designates 209.85.210.179 as permitted sender) smtp.mailfrom=kylee0686026@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-Stat-Signature: tzt7u3kyana9ng48i63bohb3mdocm589 X-Rspamd-Queue-Id: 4EED38019357 X-Rspamd-Server: rspam06 X-HE-Tag: 1623473563-142012 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: 1. Move kasan_get_free_track() and kasan_set_free_info() into tags.c 2. Move kasan_get_bug_type() to header file Signed-off-by: Kuan-Ying Lee Suggested-by: Marco Elver Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Dmitry Vyukov Cc: Andrew Morton --- mm/kasan/Makefile | 4 +-- mm/kasan/hw_tags.c | 22 --------------- mm/kasan/report_hw_tags.c | 6 +--- mm/kasan/report_sw_tags.c | 46 +------------------------------ mm/kasan/report_tags.h | 56 +++++++++++++++++++++++++++++++++++++ mm/kasan/sw_tags.c | 41 --------------------------- mm/kasan/tags.c | 58 +++++++++++++++++++++++++++++++++++++++ 7 files changed, 118 insertions(+), 115 deletions(-) create mode 100644 mm/kasan/report_tags.h create mode 100644 mm/kasan/tags.c diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile index 9fe39a66388a..634de6c1da9b 100644 --- a/mm/kasan/Makefile +++ b/mm/kasan/Makefile @@ -37,5 +37,5 @@ CFLAGS_sw_tags.o := $(CC_FLAGS_KASAN_RUNTIME) obj-$(CONFIG_KASAN) := common.o report.o obj-$(CONFIG_KASAN_GENERIC) += init.o generic.o report_generic.o shadow.o quarantine.o -obj-$(CONFIG_KASAN_HW_TAGS) += hw_tags.o report_hw_tags.o -obj-$(CONFIG_KASAN_SW_TAGS) += init.o report_sw_tags.o shadow.o sw_tags.o +obj-$(CONFIG_KASAN_HW_TAGS) += hw_tags.o report_hw_tags.o tags.o +obj-$(CONFIG_KASAN_SW_TAGS) += init.o report_sw_tags.o shadow.o sw_tags.o tags.o diff --git a/mm/kasan/hw_tags.c b/mm/kasan/hw_tags.c index ed5e5b833d61..4ea8c368b5b8 100644 --- a/mm/kasan/hw_tags.c +++ b/mm/kasan/hw_tags.c @@ -216,28 +216,6 @@ void __init kasan_init_hw_tags(void) pr_info("KernelAddressSanitizer initialized\n"); } -void kasan_set_free_info(struct kmem_cache *cache, - void *object, u8 tag) -{ - struct kasan_alloc_meta *alloc_meta; - - alloc_meta = kasan_get_alloc_meta(cache, object); - if (alloc_meta) - kasan_set_track(&alloc_meta->free_track[0], GFP_NOWAIT); -} - -struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, - void *object, u8 tag) -{ - struct kasan_alloc_meta *alloc_meta; - - alloc_meta = kasan_get_alloc_meta(cache, object); - if (!alloc_meta) - return NULL; - - return &alloc_meta->free_track[0]; -} - void kasan_alloc_pages(struct page *page, unsigned int order, gfp_t flags) { /* diff --git a/mm/kasan/report_hw_tags.c b/mm/kasan/report_hw_tags.c index 42b2168755d6..ef5e7378f3aa 100644 --- a/mm/kasan/report_hw_tags.c +++ b/mm/kasan/report_hw_tags.c @@ -14,11 +14,7 @@ #include #include "kasan.h" - -const char *kasan_get_bug_type(struct kasan_access_info *info) -{ - return "invalid-access"; -} +#include "report_tags.h" void *kasan_find_first_bad_addr(void *addr, size_t size) { diff --git a/mm/kasan/report_sw_tags.c b/mm/kasan/report_sw_tags.c index 821a14a19a92..d965a170083e 100644 --- a/mm/kasan/report_sw_tags.c +++ b/mm/kasan/report_sw_tags.c @@ -26,51 +26,7 @@ #include -#include "kasan.h" -#include "../slab.h" - -const char *kasan_get_bug_type(struct kasan_access_info *info) -{ -#ifdef CONFIG_KASAN_TAGS_IDENTIFY - struct kasan_alloc_meta *alloc_meta; - struct kmem_cache *cache; - struct page *page; - const void *addr; - void *object; - u8 tag; - int i; - - tag = get_tag(info->access_addr); - addr = kasan_reset_tag(info->access_addr); - page = kasan_addr_to_page(addr); - if (page && PageSlab(page)) { - cache = page->slab_cache; - object = nearest_obj(cache, page, (void *)addr); - alloc_meta = kasan_get_alloc_meta(cache, object); - - if (alloc_meta) { - for (i = 0; i < KASAN_NR_FREE_STACKS; i++) { - if (alloc_meta->free_pointer_tag[i] == tag) - return "use-after-free"; - } - } - return "out-of-bounds"; - } - -#endif - /* - * If access_size is a negative number, then it has reason to be - * defined as out-of-bounds bug type. - * - * Casting negative numbers to size_t would indeed turn up as - * a large size_t and its value will be larger than ULONG_MAX/2, - * so that this can qualify as out-of-bounds. - */ - if (info->access_addr + info->access_size < info->access_addr) - return "out-of-bounds"; - - return "invalid-access"; -} +#include "report_tags.h" void *kasan_find_first_bad_addr(void *addr, size_t size) { diff --git a/mm/kasan/report_tags.h b/mm/kasan/report_tags.h new file mode 100644 index 000000000000..4f740d4d99ee --- /dev/null +++ b/mm/kasan/report_tags.h @@ -0,0 +1,56 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __MM_KASAN_REPORT_TAGS_H +#define __MM_KASAN_REPORT_TAGS_H + +#include "kasan.h" +#include "../slab.h" + +#ifdef CONFIG_KASAN_TAGS_IDENTIFY +const char *kasan_get_bug_type(struct kasan_access_info *info) +{ + struct kasan_alloc_meta *alloc_meta; + struct kmem_cache *cache; + struct page *page; + const void *addr; + void *object; + u8 tag; + int i; + + tag = get_tag(info->access_addr); + addr = kasan_reset_tag(info->access_addr); + page = kasan_addr_to_page(addr); + if (page && PageSlab(page)) { + cache = page->slab_cache; + object = nearest_obj(cache, page, (void *)addr); + alloc_meta = kasan_get_alloc_meta(cache, object); + + if (alloc_meta) { + for (i = 0; i < KASAN_NR_FREE_STACKS; i++) { + if (alloc_meta->free_pointer_tag[i] == tag) + return "use-after-free"; + } + } + return "out-of-bounds"; + } + + /* + * If access_size is a negative number, then it has reason to be + * defined as out-of-bounds bug type. + * + * Casting negative numbers to size_t would indeed turn up as + * a large size_t and its value will be larger than ULONG_MAX/2, + * so that this can qualify as out-of-bounds. + */ + if (info->access_addr + info->access_size < info->access_addr) + return "out-of-bounds"; + + return "invalid-access"; +} +#else +const char *kasan_get_bug_type(struct kasan_access_info *info) +{ + return "invalid-access"; +} +#endif + +#endif diff --git a/mm/kasan/sw_tags.c b/mm/kasan/sw_tags.c index dd05e6c801fa..bd3f540feb47 100644 --- a/mm/kasan/sw_tags.c +++ b/mm/kasan/sw_tags.c @@ -167,47 +167,6 @@ void __hwasan_tag_memory(unsigned long addr, u8 tag, unsigned long size) } EXPORT_SYMBOL(__hwasan_tag_memory); -void kasan_set_free_info(struct kmem_cache *cache, - void *object, u8 tag) -{ - struct kasan_alloc_meta *alloc_meta; - u8 idx = 0; - - alloc_meta = kasan_get_alloc_meta(cache, object); - if (!alloc_meta) - return; - -#ifdef CONFIG_KASAN_TAGS_IDENTIFY - idx = alloc_meta->free_track_idx; - alloc_meta->free_pointer_tag[idx] = tag; - alloc_meta->free_track_idx = (idx + 1) % KASAN_NR_FREE_STACKS; -#endif - - kasan_set_track(&alloc_meta->free_track[idx], GFP_NOWAIT); -} - -struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, - void *object, u8 tag) -{ - struct kasan_alloc_meta *alloc_meta; - int i = 0; - - alloc_meta = kasan_get_alloc_meta(cache, object); - if (!alloc_meta) - return NULL; - -#ifdef CONFIG_KASAN_TAGS_IDENTIFY - for (i = 0; i < KASAN_NR_FREE_STACKS; i++) { - if (alloc_meta->free_pointer_tag[i] == tag) - break; - } - if (i == KASAN_NR_FREE_STACKS) - i = alloc_meta->free_track_idx; -#endif - - return &alloc_meta->free_track[i]; -} - void kasan_tag_mismatch(unsigned long addr, unsigned long access_info, unsigned long ret_ip) { diff --git a/mm/kasan/tags.c b/mm/kasan/tags.c new file mode 100644 index 000000000000..9c33c0ebe1d1 --- /dev/null +++ b/mm/kasan/tags.c @@ -0,0 +1,58 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * This file contains common tag-based KASAN code. + * + * Author: Kuan-Ying Lee + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +#include "kasan.h" + +void kasan_set_free_info(struct kmem_cache *cache, + void *object, u8 tag) +{ + struct kasan_alloc_meta *alloc_meta; + u8 idx = 0; + + alloc_meta = kasan_get_alloc_meta(cache, object); + if (!alloc_meta) + return; + +#ifdef CONFIG_KASAN_TAGS_IDENTIFY + idx = alloc_meta->free_track_idx; + alloc_meta->free_pointer_tag[idx] = tag; + alloc_meta->free_track_idx = (idx + 1) % KASAN_NR_FREE_STACKS; +#endif + + kasan_set_track(&alloc_meta->free_track[idx], GFP_NOWAIT); +} + +struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, + void *object, u8 tag) +{ + struct kasan_alloc_meta *alloc_meta; + int i = 0; + + alloc_meta = kasan_get_alloc_meta(cache, object); + if (!alloc_meta) + return NULL; + +#ifdef CONFIG_KASAN_TAGS_IDENTIFY + for (i = 0; i < KASAN_NR_FREE_STACKS; i++) { + if (alloc_meta->free_pointer_tag[i] == tag) + break; + } + if (i == KASAN_NR_FREE_STACKS) + i = alloc_meta->free_track_idx; +#endif + + return &alloc_meta->free_track[i]; +}