From patchwork Wed Nov 17 13:07:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Elver X-Patchwork-Id: 12624521 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7DB30C433EF for ; Wed, 17 Nov 2021 13:07:41 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 1C09C61B7D for ; Wed, 17 Nov 2021 13:07:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 1C09C61B7D Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id AB1706B0072; Wed, 17 Nov 2021 08:07:30 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id A61236B0073; Wed, 17 Nov 2021 08:07:30 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 9295B6B0074; Wed, 17 Nov 2021 08:07:30 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0243.hostedemail.com [216.40.44.243]) by kanga.kvack.org (Postfix) with ESMTP id 853906B0072 for ; Wed, 17 Nov 2021 08:07:30 -0500 (EST) Received: from smtpin08.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 3FAD9183BA071 for ; Wed, 17 Nov 2021 13:07:20 +0000 (UTC) X-FDA: 78818448240.08.2510B42 Received: from mail-ed1-f73.google.com (mail-ed1-f73.google.com [209.85.208.73]) by imf29.hostedemail.com (Postfix) with ESMTP id E20A59000277 for ; Wed, 17 Nov 2021 13:07:18 +0000 (UTC) Received: by mail-ed1-f73.google.com with SMTP id l15-20020a056402124f00b003e57269ab87so2078469edw.6 for ; Wed, 17 Nov 2021 05:07:19 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:message-id:mime-version:subject:from:to:cc; bh=tN9I+pAFJlbUYxyB1icCBjOYc97BjdaVLmTiDNjOPV8=; b=ndheOzfsOhhGUnLhlVmbUSUNSnEs7pnEZJdypfUNkwG1z1XiwKopap42PBQY8Y3qZX KqiGXPpRY2dvL1oOkjvSv9D+HFZ7gltYL0VmQUBSap8yBIs6oZspP/CZlWFQBmr2f6lB LELRE1sINCB5DtaNdyDHW1yoxO9Acr5JYRBtBsNgMHDBE4tdVGzcrk/y+QbZ3coz735N AccInz+RZp2i3Az5kGaJkFnTf+tBj6+5E9hnxQTMNYmUHhPxhNuVO8Hl0yC8mn9en/MA y7+SJ5Cliab2QztOZbPHHKVbuJYZXcga44wfTJbnaWsdPHdldky5O6Me6RyLaTtYnoxe UwcA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=tN9I+pAFJlbUYxyB1icCBjOYc97BjdaVLmTiDNjOPV8=; b=kyj77Gib3btODtVqpY2bq2S3ehmt+d7guW0XP1+e28M0bkc+o8z9eAQ4IdUbUFydPz Qc70SFhL4PDngjuagTXdghgJ8sFajGwPYdqbhqzAC/i2O0wWFSxgkbr1aVX7wuMDGYbU h8H9zIQYNM2Zig823Ev1SNPoM2g3yGXw+6PgToRNLHzkdogE2v8MbEonNe6yedHroAHa mycAM1hkVE9pdIdTcdzxVicNg8ys5gSS5/eX/LoGGakUeiAL2RlEbJ0xhTYjc4thCl7g RrE1NBKNqAdflrbhZ/VZl0nqz9e/pPRc8lOsIbTGMKyuCDxP9Xg9PqHFIpEN8MJ44Pml Liiw== X-Gm-Message-State: AOAM531g9KSJ2ChUvAjnO695YSb7FoyVvv3KhJbLLunhHPN/B6JbILfo d4h8Yj3IsB+gRbOv5swIoTaekOkr2w== X-Google-Smtp-Source: ABdhPJyTKq/cx1Q/EX6DBKd8VJ5ppuqmM+IryDyYf0h9dWQbd+9nBOngWc6+zwYj5U64Z00pAfTCRkBcLQ== X-Received: from elver.muc.corp.google.com ([2a00:79e0:15:13:80aa:59e4:a6a7:e11e]) (user=elver job=sendgmr) by 2002:a17:907:1c97:: with SMTP id nb23mr21669634ejc.488.1637154438173; Wed, 17 Nov 2021 05:07:18 -0800 (PST) Date: Wed, 17 Nov 2021 14:07:14 +0100 Message-Id: <20211117130714.135656-1-elver@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.34.0.rc2.393.gf8c9666880-goog Subject: [PATCH v2] kasan: test: add globals left-out-of-bounds test From: Marco Elver To: elver@google.com, Andrew Morton Cc: Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Kaiwan N Billimoria X-Stat-Signature: zo84w1u5dckaxojffu9nmgogqy36kzj7 X-Rspamd-Queue-Id: E20A59000277 X-Rspamd-Server: rspam07 Authentication-Results: imf29.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=ndheOzfs; spf=pass (imf29.hostedemail.com: domain of 3hv6UYQUKCOkPWgPcRZZRWP.NZXWTYfi-XXVgLNV.ZcR@flex--elver.bounces.google.com designates 209.85.208.73 as permitted sender) smtp.mailfrom=3hv6UYQUKCOkPWgPcRZZRWP.NZXWTYfi-XXVgLNV.ZcR@flex--elver.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com X-HE-Tag: 1637154438-666433 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Add a test checking that KASAN generic can also detect out-of-bounds accesses to the left of globals. Unfortunately it seems that GCC doesn't catch this (tested GCC 10, 11). The main difference between GCC's globals redzoning and Clang's is that GCC relies on using increased alignment to producing padding, where Clang's redzoning implementation actually adds real data after the global and doesn't rely on alignment to produce padding. I believe this is the main reason why GCC can't reliably catch globals out-of-bounds in this case. Given this is now a known issue, to avoid failing the whole test suite, skip this test case with GCC. Reported-by: Kaiwan N Billimoria Signed-off-by: Marco Elver Reviewed-by: Andrey Konovalov --- v2: * Add bugzilla link. --- lib/test_kasan.c | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 67ed689a0b1b..40f7274297c1 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -700,7 +700,7 @@ static void kmem_cache_bulk(struct kunit *test) static char global_array[10]; -static void kasan_global_oob(struct kunit *test) +static void kasan_global_oob_right(struct kunit *test) { /* * Deliberate out-of-bounds access. To prevent CONFIG_UBSAN_LOCAL_BOUNDS @@ -723,6 +723,20 @@ static void kasan_global_oob(struct kunit *test) KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); } +static void kasan_global_oob_left(struct kunit *test) +{ + char *volatile array = global_array; + char *p = array - 3; + + /* + * GCC is known to fail this test, skip it. + * See https://bugzilla.kernel.org/show_bug.cgi?id=215051. + */ + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_CC_IS_CLANG); + KASAN_TEST_NEEDS_CONFIG_ON(test, CONFIG_KASAN_GENERIC); + KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p); +} + /* Check that ksize() makes the whole object accessible. */ static void ksize_unpoisons_memory(struct kunit *test) { @@ -1160,7 +1174,8 @@ static struct kunit_case kasan_kunit_test_cases[] = { KUNIT_CASE(kmem_cache_oob), KUNIT_CASE(kmem_cache_accounted), KUNIT_CASE(kmem_cache_bulk), - KUNIT_CASE(kasan_global_oob), + KUNIT_CASE(kasan_global_oob_right), + KUNIT_CASE(kasan_global_oob_left), KUNIT_CASE(kasan_stack_oob), KUNIT_CASE(kasan_alloca_oob_left), KUNIT_CASE(kasan_alloca_oob_right),