From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id ED64BC433F5 for ; Mon, 29 Nov 2021 12:57:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:Subject:Message-ID:Date:From: In-Reply-To:References:MIME-Version:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=UNsWHKua5vW6PbvLQxsu/hYlbQG3SlIK67lmsEux4Ks=; b=AMdntmTe84uqwn OhdbL+SfaBr4G69Kg+0FEqTpjbvcvZx49mBJfLkXsO+dmn5+MD/bgFYACxDdLdMVD6D4IsJJIfqPQ +sXNOudcFz7ijnnEQu/rhApkbu5lnc1TxJbrYlteqRlji7dBFNLrm3+VbDX3xo08JBXaxGz65pMYF w8Lb/wVlz5C0VkX2+lUo3NVjD8XEKpOwVH/Cr9ybEqr8vKXpnswkP8NJzhtfOSt42AdA+EEZw05NR RJn49qhGfzYYYzK3aVBpYDYi2V3mH/9MQf5Oo46bJcDFv3dSg+Y8ek2MyoOv/rIefgtOuuyY6VZJv y6YYYWzSITR/W6WrKnSw==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mrgD2-000lVy-Ga; Mon, 29 Nov 2021 12:56:40 +0000 Received: from mail-io1-xd34.google.com ([2607:f8b0:4864:20::d34]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mrgCz-000lVK-0b for linux-arm-kernel@lists.infradead.org; Mon, 29 Nov 2021 12:56:38 +0000 Received: by mail-io1-xd34.google.com with SMTP id z26so21261693iod.10 for ; Mon, 29 Nov 2021 04:56:36 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=CKtqbicwgTdzcfDDVJ9s3/qtMRbUgp3KQEuBry1DrH0=; b=BPmA997oheI0tE7nHCG5PwmGspFGrUsXVCpyn8D8CtPKr+F5e9+xwlnaqLvM0rJU4f Ckk8pnztz7hPZSgGcQhBpbjtFlcmH0pNWGeFh+zZatoqU6AnWPh/ghPD1bE6EGM3O2C4 FnH2KyEEJvZn4hC0kc6NVhQuuNU0iPZPFPVnwl4l7V+Msk3wCPxsp3LleKtGX22RR8c1 PprsBE3zfb0Z+hFX0y/CIvUXORIrpSzA7EiJyBUzsOUtpJEVf62Do9aW4INNOncJDGx5 ePypANBqmKdP4N849jIBJoiIezlK90la72j2mbFaT1oxE5veAGnZcI+Hz136x9WtVio7 bdIw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=CKtqbicwgTdzcfDDVJ9s3/qtMRbUgp3KQEuBry1DrH0=; b=7fLUhg003h4hRX4TrmM5H+fjpzMNf6TQxem/O4+NblgXfH4mcxUlcSB7mhWLuhu72w VW/Uv4NuPv5Ar5Y00wkusb9tNBWnUFW+WdD47+/vxLpm6h0NWr/vpDQB7FvraPZrhVAE pb0fIDrHwzgD/V94y25xPymWAQasyhtP7LzM6FAiTX0regqU+pGnWkk8WkM6mZSD+za1 ZrgrCVX650TWASSzcZJYVaZqpP41U9lsXCEVn63kwFlC47jbsTuV3LlKJ9yjdWNaIi3A WCEm1HitjW3EidHMY5Aqrn2VZGOXF1ctwC6EZtBgUrjZc50VDvBim6AwfdtBzZdsIBOT TMBA== X-Gm-Message-State: AOAM533no97iXkpvQ5wOJsco19ueyOx/sHXqfcooqawe5R3jLAH08poh Yt/fk8uJhHU3L3PKEPb+hXjbPILG2lnJgJG6wrqHHguPGnY= X-Google-Smtp-Source: ABdhPJz7yZAFjWS5SVbcrm3cGqLW78HumxClnBHVEWpGf9HWaajytm8B78/wqo9qOBZcQKb+qHQjV2oYVaHMpPgRqC0= X-Received: by 2002:a5e:9b0e:: with SMTP id j14mr59665497iok.127.1638190595204; Mon, 29 Nov 2021 04:56:35 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Andrey Konovalov Date: Mon, 29 Nov 2021 13:56:24 +0100 Message-ID: Subject: Re: KASAN Arm: global-out-of-bounds in load_module To: Miguel Ojeda Cc: Linux ARM , kasan-dev , linux-kernel , Linus Walleij , Ard Biesheuvel , Florian Fainelli , Ahmad Fatoum , Dmitry Vyukov X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211129_045637_084644_2FEB5109 X-CRM114-Status: GOOD ( 17.07 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Nov 29, 2021 at 7:37 AM 'Dmitry Vyukov' via kasan-dev wrote: > > On Sun, 28 Nov 2021 at 01:43, Miguel Ojeda > wrote: > > > > Hi KASAN / Arm folks, > > > > I noticed in our CI that inserting and removing a module, and then > > inserting it again, e.g.: > > > > insmod bcm2835_thermal.ko > > rmmod bcm2835_thermal.ko > > insmod bcm2835_thermal.ko > > > > deterministically triggers the report below in v5.16-rc2. I also tried > > it on v5.12 to see if it was a recent thing, but same story. > > > > I could find this other report from May, which may be related: > > https://lore.kernel.org/lkml/20210510202653.gjvqsxacw3hcxfvr@pengutronix.de/ > > > > Cheers, > > Miguel > > HI Miguel, > > 0xf9 is redzone for global variables: > #define KASAN_GLOBAL_REDZONE 0xF9 /* redzone for global variable */ > > I would assume this is caused by not clearing shadow of unloaded > modules, so that the next module loaded hits these leftover redzones. Hi Miguel, Adding to what Dmitry mentioned: The code that's responsible for allocating&clearing/freeing shadow for modules is at the very end of mm/kasan/shadow.c. It's only required when CONFIG_KASAN_VMALLOC is not supported/enabled. As 32-bit arm doesn't select HAVE_ARCH_KASAN_VMALLOC, perhaps it needs something along the lines of what kasan_module_alloc() does with regards to clearing shadow? I assume arm doesn't call that function directly due to a different shadow allocation scheme. Just a guess. Thanks! _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel