From: Arnd Bergmann <arnd@kernel.org>
To: linux-hardening@vger.kernel.org, Kees Cook <keescook@chomium.org>,
Andrey Ryabinin <ryabinin.a.a@gmail.com>,
Alexander Potapenko <glider@google.com>,
Andrey Konovalov <andreyknvl@gmail.com>,
Dmitry Vyukov <dvyukov@google.com>,
kasan-dev@googlegroups.com
Cc: Arnd Bergmann <arnd@arndb.de>,
Andrew Morton <akpm@linux-foundation.org>,
Marco Elver <elver@google.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Peter Collingbourne <pcc@google.com>,
Patricia Alfonso <trishalfonso@google.com>,
Vincenzo Frascino <vincenzo.frascino@arm.com>,
linux-kernel@vger.kernel.org
Subject: [PATCH 1/2] kasan: test: use underlying string helpers
Date: Wed, 13 Oct 2021 17:00:05 +0200 [thread overview]
Message-ID: <20211013150025.2875883-1-arnd@kernel.org> (raw)
From: Arnd Bergmann <arnd@arndb.de>
Calling memcmp() and memchr() with an intentional buffer overflow
is now caught at compile time:
In function 'memcmp',
inlined from 'kasan_memcmp' at lib/test_kasan.c:897:2:
include/linux/fortify-string.h:263:25: error: call to '__read_overflow' declared with attribute error: detected read beyond size of object (1st parameter)
263 | __read_overflow();
| ^~~~~~~~~~~~~~~~~
In function 'memchr',
inlined from 'kasan_memchr' at lib/test_kasan.c:872:2:
include/linux/fortify-string.h:277:17: error: call to '__read_overflow' declared with attribute error: detected read beyond size of object (1st parameter)
277 | __read_overflow();
| ^~~~~~~~~~~~~~~~~
Change the kasan tests to wrap those inside of a noinline function
to prevent the compiler from noticing the bug and let kasan find
it at runtime.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
lib/test_kasan.c | 19 +++++++++++++++++--
1 file changed, 17 insertions(+), 2 deletions(-)
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index 67ed689a0b1b..903215e944f1 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -852,6 +852,21 @@ static void kmem_cache_invalid_free(struct kunit *test)
kmem_cache_destroy(cache);
}
+/*
+ * noinline wrappers to prevent the compiler from noticing the overflow
+ * at compile time rather than having kasan catch it.
+ * */
+static noinline void *__kasan_memchr(const void *s, int c, size_t n)
+{
+ return memchr(s, c, n);
+}
+
+static noinline int __kasan_memcmp(const void *s1, const void *s2, size_t n)
+{
+ return memcmp(s1, s2, n);
+}
+
+
static void kasan_memchr(struct kunit *test)
{
char *ptr;
@@ -870,7 +885,7 @@ static void kasan_memchr(struct kunit *test)
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
KUNIT_EXPECT_KASAN_FAIL(test,
- kasan_ptr_result = memchr(ptr, '1', size + 1));
+ kasan_ptr_result = __kasan_memchr(ptr, '1', size + 1));
kfree(ptr);
}
@@ -895,7 +910,7 @@ static void kasan_memcmp(struct kunit *test)
memset(arr, 0, sizeof(arr));
KUNIT_EXPECT_KASAN_FAIL(test,
- kasan_int_result = memcmp(ptr, arr, size+1));
+ kasan_int_result = __kasan_memcmp(ptr, arr, size+1));
kfree(ptr);
}
--
2.29.2
next reply other threads:[~2021-10-13 15:00 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-13 15:00 Arnd Bergmann [this message]
2021-10-13 15:00 ` [PATCH 2/2] kasan: use fortified strings for hwaddress sanitizer Arnd Bergmann
2021-10-18 19:57 ` Kees Cook
2021-10-18 20:09 ` Arnd Bergmann
2021-10-14 8:12 ` [PATCH 1/2] kasan: test: use underlying string helpers Vincenzo Frascino
2021-10-15 2:40 ` Kees Cook
2021-10-28 20:15 ` Andrew Morton
2021-10-28 20:42 ` Kees Cook
2021-10-18 19:47 ` Kees Cook
2021-10-18 19:55 ` Arnd Bergmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20211013150025.2875883-1-arnd@kernel.org \
--to=arnd@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@gmail.com \
--cc=arnd@arndb.de \
--cc=catalin.marinas@arm.com \
--cc=dvyukov@google.com \
--cc=elver@google.com \
--cc=glider@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=keescook@chomium.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pcc@google.com \
--cc=ryabinin.a.a@gmail.com \
--cc=trishalfonso@google.com \
--cc=vincenzo.frascino@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.