From patchwork Thu Dec 21 20:04:45 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13502599 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4CDF2C46CD4 for ; Thu, 21 Dec 2023 20:05:09 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 438F06B0083; Thu, 21 Dec 2023 15:05:04 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 3AB476B0088; Thu, 21 Dec 2023 15:05:04 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 181646B0085; Thu, 21 Dec 2023 15:05:04 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 063F86B0083 for ; Thu, 21 Dec 2023 15:05:04 -0500 (EST) Received: from smtpin23.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id CFBB9A171A for ; Thu, 21 Dec 2023 20:05:03 +0000 (UTC) X-FDA: 81591904086.23.110B37D Received: from out-172.mta1.migadu.com (out-172.mta1.migadu.com [95.215.58.172]) by imf21.hostedemail.com (Postfix) with ESMTP id F1E9B1C0016 for ; Thu, 21 Dec 2023 20:05:01 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Gsy7nZlb; spf=pass (imf21.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.172 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1703189102; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=KWohJbv99PLbGcicyqYuN0s/R1C+lxZK4GlvmO4roNU=; b=MW0veVzPIQwr3vTMK5OA4/LynBsjW19GiOGi/KXu2O/l+dg9iXbME9sAt/UFAkRItZygD4 +ER3EkF2Wr39mo8F29k3OHfCCyge76htnen7r4JkF0XBeVPwx981r/HVAzskggqKiyFpyH bmeJJS9/KbmkgRMlTWT9jYTQ59bFIPM= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1703189102; a=rsa-sha256; cv=none; b=WRcGx2D87XSe2EQ5jG0Qz0jRHKOynDx6Vc0L8my4dfdcBf9YN+xETS+WewhBWrpfFGAvBu MbPOr9PTNhrXaAGxUrQf4k/icOPVgw+vS1CoX6y2OJfLMN90LgxoLeNULY1ExIBUt06WnJ lGJS7WP3VKU0isTnJehFqQDYAek6Tvk= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=Gsy7nZlb; spf=pass (imf21.hostedemail.com: domain of andrey.konovalov@linux.dev designates 95.215.58.172 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1703189100; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=KWohJbv99PLbGcicyqYuN0s/R1C+lxZK4GlvmO4roNU=; b=Gsy7nZlbu3H2IDnesAWQe9qDJ7nAP2p+eXRNRSe4j32CC4JwsP4uLzkQ4/jEEkvX8mdv6F CcL25sh8fWcrq+2FBZ5UvJ9asZqD0ZHeEOOP3+qLu1cMEpc6sPWjqhJ9qWg89a+PRbHrc2 K5hSrC+2HrBEnLQVSDx5tp5XvH3drbU= From: andrey.konovalov@linux.dev To: Marco Elver Cc: Andrey Konovalov , Alexander Potapenko , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Andrew Morton , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH mm 03/11] kasan: improve kasan_non_canonical_hook Date: Thu, 21 Dec 2023 21:04:45 +0100 Message-Id: In-Reply-To: References: MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Stat-Signature: 5r83cnkntujky6h3zaau7ontuww8xqzz X-Rspamd-Server: rspam10 X-Rspamd-Queue-Id: F1E9B1C0016 X-Rspam-User: X-HE-Tag: 1703189101-254883 X-HE-Meta: U2FsdGVkX19UQZSIwY9GEclHgXjpQyt6wRX5CwoPiT2tOzfYarNXG1dFH/CAHi6WZzmTczpamPw8h5pe+xAF+WWTSBmb3A6eleYTP5aYtPW4FTeDctmrqP9x5RXly5zQtlVcGOPE15iR0YMOfulDnMFt+yIVkoDloFAlm3pK41/95ErLcuJsJRodjmW0nRLjJj9fseMBfp3VXkcgG6+U5u3AlhIdsVK+a7GguN9wEDvmTzRwCwIRHBwm9sfJb8mpvw2bw7rg5Jff0Qqlbw+WdljGWi04MwtzlGpOBZwlgAf1r3KdLeSlmSNLatmNSIHY4gtsDHJ1q7j3PPxfEIfdblhsijcKuDsTGYG2Rvl41WQB13R9D/WTB9WdYZ4LYMC23eUWKYP6kaXHnFOaT8X/L2rKoyJPiN3kDcWFP12bF7SjOnPebO8oMCLd44mXLM8qKpO0DjHLCJOP5Mia3dmHpMhA6zbH/2O7SEEFejT5NWouVckGzowewfboQBZ/8fHNuqR+IrJgDu67gbU8l2k0/IAgk1uw+mLbeJBO0ikbAsZeKBqKYCcJT5CJmf9uaoMvPK4oRsMn3ktou/DOoMA5VuriKBiYG7k13DgNAqFJJTRuvmqk+nruLHBwO1AJ3nSD4tYvtu6ExQ9GdVoDYQ06K0JXy9wWHWg8WH2hShxaLmnuzDd0LsghHMSd1WoTmSU58vLS9eYTaWbnOm4uRCp/Q+hmgTQ2rYU/ZDW0V777E5qDmBK1vVf4MSB+N64QnLxqNAov+elbFSBdVq72Zcq5WK/5vIQ3Jttgt42EGIlNPoPnQT5NS9taKNWJC0G4rO3bZf8rederXiujZn0H3jKyYwZwpJ39OeAFKtMkb9ij0NHGMlHslQrBtaHRExkXoKZ7XshFRE79eYJrcdmuu85T4a849rr1pEgzZemmF9D65LCDSk2PMXUeIXuNg3jcifeaC8gA9HyECUZIm5moWxM a4SnOpNf yZvJOi9ZoVMmUUxKJ3PAHEph/qxJd+3U2ZlDGKD5f/jv1tnN43Akd801+9K6Dp51JYOCotRQ32EAqP56N0QjSQQj218c32JdzDcLsYngHNpIi0Xf+1oF19gGmNNo8G5WlL3GRI2tYNF2ItvOLff+XVSXupGrVfwgYd0SyGveNyyQmYBWe65A46Ltbfp0u85Y0pQUcNlsz8GOcG93Z1zu4VIQluISZ0K8yfHDG X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Andrey Konovalov Make kasan_non_canonical_hook to be more sure in its report (i.e. say "probably" instead of "maybe") if the address belongs to the shadow memory region for kernel addresses. Also use the kasan_shadow_to_mem helper to calculate the original address. Also improve the comments in kasan_non_canonical_hook. Signed-off-by: Andrey Konovalov --- mm/kasan/kasan.h | 6 ++++++ mm/kasan/report.c | 34 ++++++++++++++++++++-------------- 2 files changed, 26 insertions(+), 14 deletions(-) diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index 69e4f5e58e33..0e209b823b2c 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -307,6 +307,12 @@ struct kasan_stack_ring { #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) +static __always_inline bool addr_in_shadow(const void *addr) +{ + return addr >= (void *)KASAN_SHADOW_START && + addr < (void *)KASAN_SHADOW_END; +} + #ifndef kasan_shadow_to_mem static inline const void *kasan_shadow_to_mem(const void *shadow_addr) { diff --git a/mm/kasan/report.c b/mm/kasan/report.c index a938237f6882..4bc7ac9fb37d 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -635,37 +635,43 @@ void kasan_report_async(void) #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) /* - * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high - * canonical half of the address space) cause out-of-bounds shadow memory reads - * before the actual access. For addresses in the low canonical half of the - * address space, as well as most non-canonical addresses, that out-of-bounds - * shadow memory access lands in the non-canonical part of the address space. - * Help the user figure out what the original bogus pointer was. + * With compiler-based KASAN modes, accesses to bogus pointers (outside of the + * mapped kernel address space regions) cause faults when KASAN tries to check + * the shadow memory before the actual memory access. This results in cryptic + * GPF reports, which are hard for users to interpret. This hook helps users to + * figure out what the original bogus pointer was. */ void kasan_non_canonical_hook(unsigned long addr) { unsigned long orig_addr; const char *bug_type; + /* + * All addresses that came as a result of the memory-to-shadow mapping + * (even for bogus pointers) must be >= KASAN_SHADOW_OFFSET. + */ if (addr < KASAN_SHADOW_OFFSET) return; - orig_addr = (addr - KASAN_SHADOW_OFFSET) << KASAN_SHADOW_SCALE_SHIFT; + orig_addr = (unsigned long)kasan_shadow_to_mem((void *)addr); + /* * For faults near the shadow address for NULL, we can be fairly certain * that this is a KASAN shadow memory access. - * For faults that correspond to shadow for low canonical addresses, we - * can still be pretty sure - that shadow region is a fairly narrow - * chunk of the non-canonical address space. - * But faults that look like shadow for non-canonical addresses are a - * really large chunk of the address space. In that case, we still - * print the decoded address, but make it clear that this is not - * necessarily what's actually going on. + * For faults that correspond to the shadow for low or high canonical + * addresses, we can still be pretty sure: these shadow regions are a + * fairly narrow chunk of the address space. + * But the shadow for non-canonical addresses is a really large chunk + * of the address space. For this case, we still print the decoded + * address, but make it clear that this is not necessarily what's + * actually going on. */ if (orig_addr < PAGE_SIZE) bug_type = "null-ptr-deref"; else if (orig_addr < TASK_SIZE) bug_type = "probably user-memory-access"; + else if (addr_in_shadow((void *)addr)) + bug_type = "probably wild-memory-access"; else bug_type = "maybe wild-memory-access"; pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type,