From patchwork Wed Nov 17 11:09:16 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Elver X-Patchwork-Id: 12624375 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67238C433EF for ; Wed, 17 Nov 2021 11:09:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id DA040619EA for ; Wed, 17 Nov 2021 11:09:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org DA040619EA Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 5B9566B0072; Wed, 17 Nov 2021 06:09:37 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 569906B0073; Wed, 17 Nov 2021 06:09:37 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 458476B0074; Wed, 17 Nov 2021 06:09:37 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0245.hostedemail.com [216.40.44.245]) by kanga.kvack.org (Postfix) with ESMTP id 37F4F6B0072 for ; Wed, 17 Nov 2021 06:09:37 -0500 (EST) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 044FD8249980 for ; Wed, 17 Nov 2021 11:09:27 +0000 (UTC) X-FDA: 78818151174.18.4ED653C Received: from mail-wm1-f73.google.com (mail-wm1-f73.google.com [209.85.128.73]) by imf21.hostedemail.com (Postfix) with ESMTP id C2C7FD0369CD for ; Wed, 17 Nov 2021 11:09:25 +0000 (UTC) Received: by mail-wm1-f73.google.com with SMTP id k25-20020a05600c1c9900b00332f798ba1dso2674094wms.4 for ; Wed, 17 Nov 2021 03:09:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc; bh=9taf4pcDDL8ZRr8QtehQRp327fUKjZJHKOwSYb8Gk0w=; b=sBRFbICWZPYUZ50hE5OAaZtyFLxiooBBZ0pFKbWrkqhO2PngGbFIFfGNSsWBxOxNL9 GKnU14KQ6vv06Pg4qGp4oye/2kHN+ZuyhnJUBTWfZ5cf+506nJMxZq3KOMsFX1QZRnzC AqS4WMFTLT5Oq05Du2T883L6PEE6psSeTSCcIRuiXXAWfYG8m7MzHt1Rb8dJVzm2pomJ ZlYtSiLmEYu7ePYTe+j9t57XXvDZhnxIBJ8S9M3jDLrc8XCJp/vHFYRCnztiDmhUy2kx fPwmZTwpv1rYw3rypnFUKo0Qk5D2mRWNkUCLdRSY1j9/zajVcCDfPFXYqqdBDCMWgWAb BOLw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=9taf4pcDDL8ZRr8QtehQRp327fUKjZJHKOwSYb8Gk0w=; b=B9Z8LuUJ3v0FrqVIACbt9QJIDpMlkoYS/oVC2E1op1+eWq3I0QZyCMHBb5xPUIZ0GS q/3impk4ygWsVH/9+85M22KRzXn37eyvOJ39qYfQ2+Cs3ubGEgcF7f3eGVfhwqiemVpp BvQO64m7GtT0O1ur0+1yJqlw/AgYUmNTkEorsrnLWkQd4ZY1VapzjnS6ea4xB9jHrIy7 TiNTZquNZ7+9pLtJ/uX7uYuzsqY4N+tajaCyET7L9u+ZsIovf35GRYgIH8dr8aC0lRKC s91D/ywSa6M18C+mYPvWBKAG1FaWQyj/Ra5bcYKzI+ohboTS+rOLpR9+sGocE25Y9agu NRNQ== X-Gm-Message-State: AOAM5313EXZsEj+Dlx3oaB7kRJ6JTw4JPT/DPglezh2vk60qAloyedqy yNhx4mpbM1aGGCSW6dn/hBbDEWFQZw== X-Google-Smtp-Source: ABdhPJyDoLkrFyRZ+xSL7lowBi50Bs7Xbn6xBWOipL4CkZhKDFfQld24YCcWtJPZ+VYkOkwh9kiQnGMQOw== X-Received: from elver.muc.corp.google.com ([2a00:79e0:15:13:80aa:59e4:a6a7:e11e]) (user=elver job=sendgmr) by 2002:a1c:9dc6:: with SMTP id g189mr16624727wme.87.1637147365103; Wed, 17 Nov 2021 03:09:25 -0800 (PST) Date: Wed, 17 Nov 2021 12:09:16 +0100 Message-Id: <20211117110916.97944-1-elver@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.34.0.rc2.393.gf8c9666880-goog Subject: [PATCH] kasan: test: add globals left-out-of-bounds test From: Marco Elver To: elver@google.com, Andrew Morton Cc: Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Kaiwan N Billimoria X-Stat-Signature: hnbk6f7x49wmqoeda3756pdnmqka5gyp Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=sBRFbICW; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf21.hostedemail.com: domain of 35eKUYQUKCBIw3Dw9y66y3w.u64305CF-442Dsu2.69y@flex--elver.bounces.google.com designates 209.85.128.73 as permitted sender) smtp.mailfrom=35eKUYQUKCBIw3Dw9y66y3w.u64305CF-442Dsu2.69y@flex--elver.bounces.google.com X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: C2C7FD0369CD X-HE-Tag: 1637147365-879827 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000004, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Add a test checking that KASAN generic can also detect out-of-bounds accesses to the left of globals. Unfortunately it seems that GCC doesn't catch this (tested GCC 10, 11). The main difference between GCC's globals redzoning and Clang's is that GCC relies on using increased alignment to producing padding, where Clang's redzoning implementation actually adds real data after the global and doesn't rely on alignment to produce padding. I believe this is the main reason why GCC can't reliably catch globals out-of-bounds in this case. Given this is now a known issue, to avoid failing the whole test suite, skip this test case with GCC. Reported-by: Kaiwan N Billimoria Signed-off-by: Marco Elver Reviewed-by: Andrey Konovalov --- lib/test_kasan.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 67ed689a0b1b..69c32c91420b 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -700,7 +700,7 @@ static void kmem_cache_bulk(struct kunit *test) static char global_array[10]; -static void kasan_global_oob(struct kunit *test) +static void kasan_global_oob_right(struct kunit *test) { /* * Deliberate out-of-bounds access. To prevent CONFIG_UBSAN_LOCAL_BOUNDS @@ -723,6 +723,19 @@ static void kasan_global_oob(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); } +static void kasan_global_oob_left(struct kunit *test) +{ + char *volatile array = global_array; + char *p = array - 3; + + /* + * GCC is known to fail this test, skip it. + */ + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_CC_IS_CLANG); + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); +} + /* Check that ksize() makes the whole object accessible. */ static void ksize_unpoisons_memory(struct kunit *test) { @@ -1160,7 +1173,8 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kmem_cache_oob), KUNIT_CASE(kmem_cache_accounted), KUNIT_CASE(kmem_cache_bulk), - KUNIT_CASE(kasan_global_oob), + KUNIT_CASE(kasan_global_oob_right), + KUNIT_CASE(kasan_global_oob_left), KUNIT_CASE(kasan_stack_oob), KUNIT_CASE(kasan_alloca_oob_left), KUNIT_CASE(kasan_alloca_oob_right),