From patchwork Wed Jun 14 09:51:16 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Marco Elver X-Patchwork-Id: 13279783 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DEC38EB64D9 for ; Wed, 14 Jun 2023 09:52:21 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3504A6B0074; Wed, 14 Jun 2023 05:52:21 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 2D9E68E0002; Wed, 14 Jun 2023 05:52:21 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 17A776B0078; Wed, 14 Jun 2023 05:52:21 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 02E6D6B0074 for ; Wed, 14 Jun 2023 05:52:21 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id C7E29C08FD for ; Wed, 14 Jun 2023 09:52:20 +0000 (UTC) X-FDA: 80900888040.22.7FFA6DD Received: from mail-ed1-f73.google.com (mail-ed1-f73.google.com [209.85.208.73]) by imf07.hostedemail.com (Postfix) with ESMTP id 0248440019 for ; Wed, 14 Jun 2023 09:52:18 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=geOqKiSn; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf07.hostedemail.com: domain of 30Y2JZAUKCD4jq0jwlttlqj.htrqnsz2-rrp0fhp.twl@flex--elver.bounces.google.com designates 209.85.208.73 as permitted sender) smtp.mailfrom=30Y2JZAUKCD4jq0jwlttlqj.htrqnsz2-rrp0fhp.twl@flex--elver.bounces.google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1686736339; a=rsa-sha256; cv=none; b=VKr5sQEyTYRXL7/8bosTHETp9uhh6vbtniieev6QUcR4ON2FXwt2zpdh4vxDLb/udF/u3M Uhig4HzsffZYfxS7RU6ohJaI7GLU1wTTNa5hhslzeisbGMfFVl7ppaP0BXNP/FzdD8w0Rk 6pDw/HE2DQO9Pxn+TyxE/9hej8SpanU= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=geOqKiSn; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf07.hostedemail.com: domain of 30Y2JZAUKCD4jq0jwlttlqj.htrqnsz2-rrp0fhp.twl@flex--elver.bounces.google.com designates 209.85.208.73 as permitted sender) smtp.mailfrom=30Y2JZAUKCD4jq0jwlttlqj.htrqnsz2-rrp0fhp.twl@flex--elver.bounces.google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1686736339; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=FmWeC77NBNaRdAHWwSRuR6SPcKNZqe53/vQrn9mW/UE=; b=SxYl6EbznLkJ9Ugd1xeJFaytsBxSkDnrHcT9Phtixb9Aj0OczAbZ6rPerb3aMBHE6/kedZ hks4/jsZfEJEFwyk4JGw3KARJkVSUD2oj80EnaHV8tc6e4IBmOmFcZGm2rol0n/VLD95Y7 Wa1ct5lCivliKTKVPMU/HskAQjlbngI= Received: by mail-ed1-f73.google.com with SMTP id 4fb4d7f45d1cf-51495d51e0fso4996838a12.2 for ; Wed, 14 Jun 2023 02:52:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1686736337; x=1689328337; h=cc:to:from:subject:message-id:mime-version:date:from:to:cc:subject :date:message-id:reply-to; bh=FmWeC77NBNaRdAHWwSRuR6SPcKNZqe53/vQrn9mW/UE=; b=geOqKiSnU2NC0ybUfNA7m6HcaY8z+CzuIrG8t9/O+xFTu0P49YRHGL54o4tXVSYalr TZfBm1rW0NBOQa2YZ/w35f3gF3DqEFEbEqo/jRINhTMeg/1sHJQpcEmQ2PAOzPdRuja0 voBDCMwcjB96U11GODbwmFzdMyoY5LN0xzs4Cwmpj5fCkpByAcSu/Ptid/c3MbfVNqMu +QdZFKQjk7KLRPaTA56ypDcJa/7o2Yf33qkEG2Wa3lG+SRqiA/wBOfG0+QzJ+gn56AC4 L1n8wv7S62yi38Fggzgz5FXfdBsJyhJRe4DioZFaB/hJl1dBp8XTP9SF4Y22iceud3c1 gzjw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1686736337; x=1689328337; h=cc:to:from:subject:message-id:mime-version:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=FmWeC77NBNaRdAHWwSRuR6SPcKNZqe53/vQrn9mW/UE=; b=XnQ5cka6z7nqqoRl4wVoqGEugN3A9mH+ROMka1k4FT8OEDRqfcqmsbTAVS65KmF/Hj F2d6MwKjxizlLFSDPKH4muDxHdS/v1EAtipEcaTVVqqUANyM5M+//MbIF1Max6/sUhPh CThl12DmPVmyHEdzkaNz4Mls6vOd5M6OGBhZJ9LKzDoboYB2VRQDyLNb33lyoMdO2Pp6 lmU+yAEVsnEzlLroPIGrFleWWzabhETN13ElhXKhQIohPBxAGM30CUMZ3JDFw8AtpYg7 r1poEYuE2n3LXietrYZukHc4w7K2A3pDnLLckb2aeKKScBnlU0wVUV32C8OkVss+pHEs 1WnA== X-Gm-Message-State: AC+VfDyB/ZoJn6X/ostJti6Z4HwGC8huIYlJPuRtxGeUWHKsj+wWcZRv hx2Wo2Tr/mfyhBK1WRIU8PP2LXQAuQ== X-Google-Smtp-Source: ACHHUZ63fN5ppS9ZmKhf6hNJ+08lZlGdBHOVI1GV/1i4KQ/LJIOWWBYBQGkc0H3hTE4SWMuUlGOqe11YMQ== X-Received: from elver.muc.corp.google.com ([2a00:79e0:9c:201:980:a2e1:a81a:5ba8]) (user=elver job=sendgmr) by 2002:a17:907:2e01:b0:974:5eb6:74f2 with SMTP id ig1-20020a1709072e0100b009745eb674f2mr4428432ejc.14.1686736337234; Wed, 14 Jun 2023 02:52:17 -0700 (PDT) Date: Wed, 14 Jun 2023 11:51:16 +0200 Mime-Version: 1.0 X-Mailer: git-send-email 2.41.0.162.gfafddb0af9-goog Message-ID: <20230614095158.1133673-1-elver@google.com> Subject: [PATCH] kasan: add support for kasan.fault=panic_on_write From: Marco Elver To: elver@google.com, Andrew Morton Cc: Alexander Potapenko , Dmitry Vyukov , Taras Madan , Aleksandr Nogikh , Andrey Ryabinin , Andrey Konovalov , Vincenzo Frascino , Jonathan Corbet , kasan-dev@googlegroups.com, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org X-Rspam-User: X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 0248440019 X-Stat-Signature: tnd6wqqk1c75731a1z68p91yt9mc9wea X-HE-Tag: 1686736338-867318 X-HE-Meta: U2FsdGVkX1/6kq9yFCYPVPr7wAlrj2e7GHoau35fYV+ITF0QJ6kWldiRIBNkK11v2l2fMtvKx5F0PY1khh6sfvSyBDbFfQABvCTRJARJHHOAkanHDKUhGizy9uWXTJHCZqtec4zmGA27eYsQ/fDIkDAbewXLf4GyRHiLGJc7ItCxs02oJ5H1is+mlp95x60RvGjovS+XbsHe6AQ57wbp5RsXSsfXve8tF8+7cBNTC1QpDi3sVFZxRq/E+HPpu2+tFRU4erwKupiM5vcxBUYWYmYz/l55HGydGrctfgmzMRd+Ved1hEvso7v7B/4vIQK9o0UbVn1kh1r4g9tEWKNJF907yQ5UY6svQacd3dgqvGKQtUjAL8mSiuT0TC6aV7Fh2yucmGdEKWdmjoxnicdMG/vkXq3W3pfN4kvsF8Ucm1diQhh+1dV2/NhabhLMmFksjQ14CQfdAcf71jdsYtmo+Au94fGKBresXpIlEk87vExRRUHYbK5weik5693kzdYFaidoUcUk2vhe+Y9wehut9uIp2eFEQNW6lZIk6oKyG53I96N1det1uKQ5mdLOIcjHw3wSmr1UWzX8l5Moozz1GgJfnyqSb4OaQmwcQqbe86mND9edVUATXGeymiMKRXR2ABHqoXGzjVCvSLv/cI5+SFvZ9HF8gy77GzeelZf4UP40b3XWoR6O06AfRviNy0mmULS4sJI06AwtRniw9ZfD+G0V/7+Ku9pMov8RdZqA4GXpiRx6IaKcTp17z0aLwxeJH9vbfGWYgDup6qZ1xYNfhe48LptHkvbWbytmV7OQSYUmkULJxVNtAg5cu4MWDHz+sQ1EqTbx6xFwVWlevthvFxgWN1riNAaROjvkeXmyZGFHhqB00Spkls3VrBKyXoNTxskqJdu1uz7SQTUOSBaeh09E5xj4OkhYN8M05ot21XcdyURHSdlpd5U9weSj7bLQKQEqVLI/tRtmseDpHY0 XNixDwk4 VHg7sF6v7xboON+WnXMJmzcHIR4pO7c/xlBOgBhuPIoOSH/aRbxGPKkWNsIfSWHqmQC4aEcTQsI/jBe7tvBhLu8FPLcuqOhttnjX8AMTmUsYDUryEZXzRgYi/m815YPn3fsEmh6KOx+7p/rB+tfHeVHAq6N7YhgRxp+d724Ono/wiO49VsgO+b8OkPHqLW8it3XjvM4DQj7GOKAexUqsOfdSnJ+Ggdhdwyxvy3bzo4wkqzy+J8LAJ3CjvGZY6ZMeYkyy8cnUZkno2zsfWqjVU5QYEsv+OYcUDkyyWRt4LQpXMCK9jh8+Ji3Rvj/ob3VBDgFt4f0iEsc4iLL0CCT8tfGRowThmevwV8tGCBDOL9fKqFhAqQpaGDFNx7pLhDxUzjjHAcn3gAcE7VFEMKsofuUf4dxY9GGpBk5VDmap/pzGWuf8B78d9CaVFHpZ1i3x4gMBcf3GKAJjRb1RN4usgEhnjAgQavqMWLqiVbsxtB6cCbX+1BV5C4i2jstyWKUtq5r88IaWvDTdzeL0j123+sWfq5zDz+4AfZUGZZtnleAugCEaBCSWf91hjnit76mTPUIh4/TCyYJq4um1ivWntujzYB+U/BOUK+0zzwFBFJUY0B+L4DveCLmGNJhROR03Rw3S+tMeTtVtDRlPel3ujN7vbgf4XAiquaDCNHn4QfA2YKdLODd4fDlrtiG7h+T3m/32BIYLJ3rmTgM9uX+l0qttHJeoIt39K6j4Jq4eeEarYUJ+k0jo3rFDN6w== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: KASAN's boot time kernel parameter 'kasan.fault=' currently supports 'report' and 'panic', which results in either only reporting bugs or also panicking on reports. However, some users may wish to have more control over when KASAN reports result in a kernel panic: in particular, KASAN reported invalid _writes_ are of special interest, because they have greater potential to corrupt random kernel memory or be more easily exploited. To panic on invalid writes only, introduce 'kasan.fault=panic_on_write', which allows users to choose to continue running on invalid reads, but panic only on invalid writes. Signed-off-by: Marco Elver Reviewed-by: Alexander Potapenko --- Documentation/dev-tools/kasan.rst | 7 ++++--- mm/kasan/report.c | 31 ++++++++++++++++++++++++++----- 2 files changed, 30 insertions(+), 8 deletions(-) diff --git a/Documentation/dev-tools/kasan.rst b/Documentation/dev-tools/kasan.rst index e66916a483cd..7f37a46af574 100644 --- a/Documentation/dev-tools/kasan.rst +++ b/Documentation/dev-tools/kasan.rst @@ -107,9 +107,10 @@ effectively disables ``panic_on_warn`` for KASAN reports. Alternatively, independent of ``panic_on_warn``, the ``kasan.fault=`` boot parameter can be used to control panic and reporting behaviour: -- ``kasan.fault=report`` or ``=panic`` controls whether to only print a KASAN - report or also panic the kernel (default: ``report``). The panic happens even - if ``kasan_multi_shot`` is enabled. +- ``kasan.fault=report``, ``=panic``, or ``=panic_on_write`` controls whether + to only print a KASAN report, panic the kernel, or panic the kernel on + invalid writes only (default: ``report``). The panic happens even if + ``kasan_multi_shot`` is enabled. Software and Hardware Tag-Based KASAN modes (see the section about various modes below) support altering stack trace collection behavior: diff --git a/mm/kasan/report.c b/mm/kasan/report.c index 892a9dc9d4d3..f8ac4d0c9848 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -43,6 +43,7 @@ enum kasan_arg_fault { KASAN_ARG_FAULT_DEFAULT, KASAN_ARG_FAULT_REPORT, KASAN_ARG_FAULT_PANIC, + KASAN_ARG_FAULT_PANIC_ON_WRITE, }; static enum kasan_arg_fault kasan_arg_fault __ro_after_init = KASAN_ARG_FAULT_DEFAULT; @@ -57,6 +58,8 @@ static int __init early_kasan_fault(char *arg) kasan_arg_fault = KASAN_ARG_FAULT_REPORT; else if (!strcmp(arg, "panic")) kasan_arg_fault = KASAN_ARG_FAULT_PANIC; + else if (!strcmp(arg, "panic_on_write")) + kasan_arg_fault = KASAN_ARG_FAULT_PANIC_ON_WRITE; else return -EINVAL; @@ -211,7 +214,7 @@ static void start_report(unsigned long *flags, bool sync) pr_err("==================================================================\n"); } -static void end_report(unsigned long *flags, void *addr) +static void end_report(unsigned long *flags, void *addr, bool is_write) { if (addr) trace_error_report_end(ERROR_DETECTOR_KASAN, @@ -220,8 +223,18 @@ static void end_report(unsigned long *flags, void *addr) spin_unlock_irqrestore(&report_lock, *flags); if (!test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) check_panic_on_warn("KASAN"); - if (kasan_arg_fault == KASAN_ARG_FAULT_PANIC) + switch (kasan_arg_fault) { + case KASAN_ARG_FAULT_DEFAULT: + case KASAN_ARG_FAULT_REPORT: + break; + case KASAN_ARG_FAULT_PANIC: panic("kasan.fault=panic set ...\n"); + break; + case KASAN_ARG_FAULT_PANIC_ON_WRITE: + if (is_write) + panic("kasan.fault=panic_on_write set ...\n"); + break; + } add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); lockdep_on(); report_suppress_stop(); @@ -536,7 +549,11 @@ void kasan_report_invalid_free(void *ptr, unsigned long ip, enum kasan_report_ty print_report(&info); - end_report(&flags, ptr); + /* + * Invalid free is considered a "write" since the allocator's metadata + * updates involves writes. + */ + end_report(&flags, ptr, true); } /* @@ -571,7 +588,7 @@ bool kasan_report(unsigned long addr, size_t size, bool is_write, print_report(&info); - end_report(&irq_flags, ptr); + end_report(&irq_flags, ptr, is_write); out: user_access_restore(ua_flags); @@ -597,7 +614,11 @@ void kasan_report_async(void) pr_err("Asynchronous fault: no details available\n"); pr_err("\n"); dump_stack_lvl(KERN_ERR); - end_report(&flags, NULL); + /* + * Conservatively set is_write=true, because no details are available. + * In this mode, kasan.fault=panic_on_write is like kasan.fault=panic. + */ + end_report(&flags, NULL, true); } #endif /* CONFIG_KASAN_HW_TAGS */