From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oi0-f43.google.com (mail-oi0-f43.google.com [209.85.218.43]) by kanga.kvack.org (Postfix) with ESMTP id 0B22F6B0038 for ; Thu, 15 Oct 2015 03:05:13 -0400 (EDT) Received: by oihr205 with SMTP id r205so41153147oih.3 for ; Thu, 15 Oct 2015 00:05:12 -0700 (PDT) Received: from szxga03-in.huawei.com (szxga03-in.huawei.com. [119.145.14.66]) by mx.google.com with ESMTPS id dh7si6701288oec.16.2015.10.15.00.04.50 for (version=TLSv1 cipher=RC4-SHA bits=128/128); Thu, 15 Oct 2015 00:05:12 -0700 (PDT) Message-ID: <561F4EEA.60203@huawei.com> Date: Thu, 15 Oct 2015 14:59:54 +0800 From: zhong jiang MIME-Version: 1.0 Subject: some problems about kasan Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Sender: owner-linux-mm@kvack.org List-ID: To: akpm@linux-foundation.org, adech.fo@gmail.com, ryabinin.a.a@gmail.com Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, qiuxishi@huawei.com, guohanjun@huawei.com, zhangdianfang@huawei.com 1a?? I feel confused about one of the cases when testing the cases kasan can solve . the function come from the kernel in the /lib/test_kasan.c. static noinline void __init kmalloc_uaf2(void) { char *ptr1, *ptr2; size_t size = 43; pr_info("use-after-free after another kmalloc\n"); ptr1 = kmalloc(size, GFP_KERNEL); if (!ptr1) { pr_err("Allocation failed\n"); return; } kfree(ptr1); ptr2 = kmalloc(size, GFP_KERNEL); if (!ptr2) { pr_err("Allocation failed\n"); return; } ptr1[40] = 'x'; kfree(ptr2); } In the above function, the point ptr1 are probably the same as the ptr2 . so the error not certain to occur. 2a??Is the stack local variable out of bound access set by the GCC ? I don't see any operate in the kernel 3a??I want to know that the global variable size include redzone is allocated by the module_alloc(). -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wi0-f169.google.com (mail-wi0-f169.google.com [209.85.212.169]) by kanga.kvack.org (Postfix) with ESMTP id AE7286B0038 for ; Thu, 15 Oct 2015 03:49:37 -0400 (EDT) Received: by wijp11 with SMTP id p11so16060863wij.0 for ; Thu, 15 Oct 2015 00:49:37 -0700 (PDT) Received: from mail-wi0-x22e.google.com (mail-wi0-x22e.google.com. [2a00:1450:400c:c05::22e]) by mx.google.com with ESMTPS id y10si15907464wjx.70.2015.10.15.00.49.36 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 15 Oct 2015 00:49:36 -0700 (PDT) Received: by wicgb1 with SMTP id gb1so260359127wic.1 for ; Thu, 15 Oct 2015 00:49:36 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <561F4EEA.60203@huawei.com> References: <561F4EEA.60203@huawei.com> From: Dmitry Vyukov Date: Thu, 15 Oct 2015 09:49:16 +0200 Message-ID: Subject: Re: some problems about kasan Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Sender: owner-linux-mm@kvack.org List-ID: To: zhong jiang Cc: Andrew Morton , Andrey Konovalov , Andrey Ryabinin , "linux-mm@kvack.org" , LKML , kasan-dev , Xishi Qiu , guohanjun@huawei.com, zhangdianfang@huawei.com On Thu, Oct 15, 2015 at 8:59 AM, zhong jiang wrote: > 1=E3=80=81 I feel confused about one of the cases when testing the cases= kasan can solve . the function come from the kernel in the /lib/test_kasa= n.c. > > static noinline void __init kmalloc_uaf2(void) > { > char *ptr1, *ptr2; > size_t size =3D 43; > > pr_info("use-after-free after another kmalloc\n"); > ptr1 =3D kmalloc(size, GFP_KERNEL); > if (!ptr1) { > pr_err("Allocation failed\n"); > return; > } > > kfree(ptr1); > ptr2 =3D kmalloc(size, GFP_KERNEL); > if (!ptr2) { > pr_err("Allocation failed\n"); > return; > } > > ptr1[40] =3D 'x'; > kfree(ptr2); > } > > In the above function, the point ptr1 are probably the same as the ptr2 = . so the error not certain to occur. Hi Zhong, You are right that ptr1 and ptr2 are most likely will be equal. To detect such bugs KASAN it meant to use "quarantine" and delay reuse of heap objects. We have quarantine implementation in the following branch: https://github.com/google/kasan/blob/dmitryc-patches-original/mm/kasan/quar= antine.c It is not committed upstream yet. > 2=E3=80=81Is the stack local variable out of bound access set by the GCC = ? I don't see any operate in the kernel Yes, stack redzones and code to poison/unpoison them is emitted by compiler= . You can use objdump to look at generated machine code, you should see instructions that poison/unpoison stack redzones. > 3=E3=80=81I want to know that the global variable size include redzone is= allocated by the module_alloc(). I don't understand the question. Please re-phrase it. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754095AbbJOHAZ (ORCPT ); Thu, 15 Oct 2015 03:00:25 -0400 Received: from szxga03-in.huawei.com ([119.145.14.66]:39678 "EHLO szxga03-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753384AbbJOHAY (ORCPT ); Thu, 15 Oct 2015 03:00:24 -0400 Message-ID: <561F4EEA.60203@huawei.com> Date: Thu, 15 Oct 2015 14:59:54 +0800 From: zhong jiang User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: , , CC: , , , , , Subject: some problems about kasan Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-Originating-IP: [10.177.29.68] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A020204.561F4EF6.006B,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2013-05-26 15:14:31, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: a4b2900bc238ee9caa65e17612ba9829 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 1、 I feel confused about one of the cases when testing the cases kasan can solve . the function come from the kernel in the /lib/test_kasan.c. static noinline void __init kmalloc_uaf2(void) { char *ptr1, *ptr2; size_t size = 43; pr_info("use-after-free after another kmalloc\n"); ptr1 = kmalloc(size, GFP_KERNEL); if (!ptr1) { pr_err("Allocation failed\n"); return; } kfree(ptr1); ptr2 = kmalloc(size, GFP_KERNEL); if (!ptr2) { pr_err("Allocation failed\n"); return; } ptr1[40] = 'x'; kfree(ptr2); } In the above function, the point ptr1 are probably the same as the ptr2 . so the error not certain to occur. 2、Is the stack local variable out of bound access set by the GCC ? I don't see any operate in the kernel 3、I want to know that the global variable size include redzone is allocated by the module_alloc(). From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752530AbbJOHtj (ORCPT ); Thu, 15 Oct 2015 03:49:39 -0400 Received: from mail-wi0-f172.google.com ([209.85.212.172]:33594 "EHLO mail-wi0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751630AbbJOHth convert rfc822-to-8bit (ORCPT ); Thu, 15 Oct 2015 03:49:37 -0400 MIME-Version: 1.0 In-Reply-To: <561F4EEA.60203@huawei.com> References: <561F4EEA.60203@huawei.com> From: Dmitry Vyukov Date: Thu, 15 Oct 2015 09:49:16 +0200 Message-ID: Subject: Re: some problems about kasan To: zhong jiang Cc: Andrew Morton , Andrey Konovalov , Andrey Ryabinin , "linux-mm@kvack.org" , LKML , kasan-dev , Xishi Qiu , guohanjun@huawei.com, zhangdianfang@huawei.com Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8BIT Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Oct 15, 2015 at 8:59 AM, zhong jiang wrote: > 1、 I feel confused about one of the cases when testing the cases kasan can solve . the function come from the kernel in the /lib/test_kasan.c. > > static noinline void __init kmalloc_uaf2(void) > { > char *ptr1, *ptr2; > size_t size = 43; > > pr_info("use-after-free after another kmalloc\n"); > ptr1 = kmalloc(size, GFP_KERNEL); > if (!ptr1) { > pr_err("Allocation failed\n"); > return; > } > > kfree(ptr1); > ptr2 = kmalloc(size, GFP_KERNEL); > if (!ptr2) { > pr_err("Allocation failed\n"); > return; > } > > ptr1[40] = 'x'; > kfree(ptr2); > } > > In the above function, the point ptr1 are probably the same as the ptr2 . so the error not certain to occur. Hi Zhong, You are right that ptr1 and ptr2 are most likely will be equal. To detect such bugs KASAN it meant to use "quarantine" and delay reuse of heap objects. We have quarantine implementation in the following branch: https://github.com/google/kasan/blob/dmitryc-patches-original/mm/kasan/quarantine.c It is not committed upstream yet. > 2、Is the stack local variable out of bound access set by the GCC ? I don't see any operate in the kernel Yes, stack redzones and code to poison/unpoison them is emitted by compiler. You can use objdump to look at generated machine code, you should see instructions that poison/unpoison stack redzones. > 3、I want to know that the global variable size include redzone is allocated by the module_alloc(). I don't understand the question. Please re-phrase it.