Re: [PATCH v3] kprobes: unpoison stack in jprobe_return() for KASAN
On Fri, Oct 14, 2016 at 1:25 PM, Will Deacon wrote: > On Fri, Oct 14, 2016 at 12:53:56PM +0200, Dmitry Vyukov wrote: >> KASAN stack instrumentation poisons stack redzones on function entry >> and unpoisons them on function exit. If a function exits abnormally >> (e.g. with a longjmp like jprobe_return()), stack redzones are left >> poisoned. Later this leads to random KASAN false reports. >> >> Unpoison stack redzones in the frames we are going to jump over >> before doing actual longjmp in jprobe_return(). >> >> Signed-off-by: Dmitry Vyukov >> Cc: Mark Rutland >> Cc: Catalin Marinas >> Cc: Andrey Ryabinin >> Cc: Lorenzo Pieralisi >> Cc: Alexander Potapenko >> Cc: Will Deacon >> Cc: Ingo Molnar >> Cc: Andrew Morton >> Cc: Thomas Gleixner >> Cc: "H. Peter Anvin" >> Cc: Ananth N Mavinakayanahalli >> Cc: Anil S Keshavamurthy >> Cc: "David S. Miller" >> Cc: Masami Hiramatsu >> Cc: x...@kernel.org >> Cc: kasan-...@googlegroups.com >> >> -- >> >> Changes since v1: >> - leave kasan_unpoison_remaining_stack() intact >> - instead add kasan_unpoison_stack_above_sp_to() >> - rename kasan_unpoison_remaining_stack() to >> kasan_unpoison_task_stack_below() >> >> Changes since v2: >> - fix build by adding return type to kasan_unpoison_stack_above_sp_to >>(tested v2 with it, but forgot to git add) > > I get build warnings with this patch applied and KASAN enabled: > > mm/kasan/kasan.c: In function ‘kasan_unpoison_task_stack_below’: > mm/kasan/kasan.c:82:34: warning: passing argument 2 of > ‘__kasan_unpoison_stack’ discards ‘const’ qualifier from pointer target type > [-Wdiscarded-qualifiers] > __kasan_unpoison_stack(current, watermark); > ^ > mm/kasan/kasan.c:65:13: note: expected ‘void *’ but argument is of type > ‘const void *’ > static void __kasan_unpoison_stack(struct task_struct *task, void *sp) > ^~ > mm/kasan/kasan.c: In function ‘kasan_unpoison_stack_above_sp_to’: > mm/kasan/kasan.c:92:27: error: called object ‘current_stack_pointer’ is not a > function or function pointer > const void *sp = (void *)current_stack_pointer(); >^ Mailed v4. Thanks
Re: [PATCH v3] kprobes: unpoison stack in jprobe_return() for KASAN
On Fri, Oct 14, 2016 at 12:53:56PM +0200, Dmitry Vyukov wrote:
> KASAN stack instrumentation poisons stack redzones on function entry
> and unpoisons them on function exit. If a function exits abnormally
> (e.g. with a longjmp like jprobe_return()), stack redzones are left
> poisoned. Later this leads to random KASAN false reports.
>
> Unpoison stack redzones in the frames we are going to jump over
> before doing actual longjmp in jprobe_return().
>
> Signed-off-by: Dmitry Vyukov
> Cc: Mark Rutland
> Cc: Catalin Marinas
> Cc: Andrey Ryabinin
> Cc: Lorenzo Pieralisi
> Cc: Alexander Potapenko
> Cc: Will Deacon
> Cc: Ingo Molnar
> Cc: Andrew Morton
> Cc: Thomas Gleixner
> Cc: "H. Peter Anvin"
> Cc: Ananth N Mavinakayanahalli
> Cc: Anil S Keshavamurthy
> Cc: "David S. Miller"
> Cc: Masami Hiramatsu
> Cc: x...@kernel.org
> Cc: kasan-...@googlegroups.com
>
> --
>
> Changes since v1:
> - leave kasan_unpoison_remaining_stack() intact
> - instead add kasan_unpoison_stack_above_sp_to()
> - rename kasan_unpoison_remaining_stack() to
> kasan_unpoison_task_stack_below()
>
> Changes since v2:
> - fix build by adding return type to kasan_unpoison_stack_above_sp_to
>(tested v2 with it, but forgot to git add)
I get build warnings with this patch applied and KASAN enabled:
mm/kasan/kasan.c: In function ‘kasan_unpoison_task_stack_below’:
mm/kasan/kasan.c:82:34: warning: passing argument 2 of ‘__kasan_unpoison_stack’
discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
__kasan_unpoison_stack(current, watermark);
^
mm/kasan/kasan.c:65:13: note: expected ‘void *’ but argument is of type ‘const
void *’
static void __kasan_unpoison_stack(struct task_struct *task, void *sp)
^~
mm/kasan/kasan.c: In function ‘kasan_unpoison_stack_above_sp_to’:
mm/kasan/kasan.c:92:27: error: called object ‘current_stack_pointer’ is not a
function or function pointer
const void *sp = (void *)current_stack_pointer();
^
In file included from ./include/linux/thread_info.h:54:0,
from ./include/asm-generic/preempt.h:4,
from ./arch/arm64/include/generated/asm/preempt.h:1,
from ./include/linux/preempt.h:59,
from ./include/linux/interrupt.h:8,
from mm/kasan/kasan.c:20:
./arch/arm64/include/asm/thread_info.h:69:24: note: declared here
register unsigned long current_stack_pointer asm ("sp");
Will
Re: [PATCH v3] kprobes: unpoison stack in jprobe_return() for KASAN
On Fri, Oct 14, 2016 at 12:53:56PM +0200, Dmitry Vyukov wrote:
> KASAN stack instrumentation poisons stack redzones on function entry
> and unpoisons them on function exit. If a function exits abnormally
> (e.g. with a longjmp like jprobe_return()), stack redzones are left
> poisoned. Later this leads to random KASAN false reports.
>
> Unpoison stack redzones in the frames we are going to jump over
> before doing actual longjmp in jprobe_return().
>
> Signed-off-by: Dmitry Vyukov
> Cc: Mark Rutland
> Cc: Catalin Marinas
> Cc: Andrey Ryabinin
> Cc: Lorenzo Pieralisi
> Cc: Alexander Potapenko
> Cc: Will Deacon
> Cc: Ingo Molnar
> Cc: Andrew Morton
> Cc: Thomas Gleixner
> Cc: "H. Peter Anvin"
> Cc: Ananth N Mavinakayanahalli
> Cc: Anil S Keshavamurthy
> Cc: "David S. Miller"
> Cc: Masami Hiramatsu
> Cc: x...@kernel.org
> Cc: kasan-...@googlegroups.com
Both the core and arm64 parts look right to me, so FWIW:
Reviewed-by: Mark Rutland
Catalin, Will, are you happy to ack the arm64 part? A core function got
renamed, and we have to update the call site in sleep.S, but there
should be no functional change. The rest of the patch adds some generic
infrastructure required by x86.
Thanks,
Mark.
> ---
> arch/arm64/kernel/sleep.S | 2 +-
> arch/x86/kernel/kprobes/core.c | 4
> include/linux/kasan.h | 2 ++
> mm/kasan/kasan.c | 19 +--
> 4 files changed, 24 insertions(+), 3 deletions(-)
>
> diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
> index b8799e7..1bec41b 100644
> --- a/arch/arm64/kernel/sleep.S
> +++ b/arch/arm64/kernel/sleep.S
> @@ -135,7 +135,7 @@ ENTRY(_cpu_resume)
>
> #ifdef CONFIG_KASAN
> mov x0, sp
> - bl kasan_unpoison_remaining_stack
> + bl kasan_unpoison_task_stack_below
> #endif
>
> ldp x19, x20, [x29, #16]
> diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
> index 28cee01..22a462a 100644
> --- a/arch/x86/kernel/kprobes/core.c
> +++ b/arch/x86/kernel/kprobes/core.c
> @@ -50,6 +50,7 @@
> #include
> #include
> #include
> +#include
>
> #include
> #include
> @@ -1080,6 +1081,9 @@ void jprobe_return(void)
> {
> struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
>
> + /* Unpoison stack redzones in the frames we are going to jump over. */
> + kasan_unpoison_stack_above_sp_to(kcb->jprobe_saved_sp);
> +
> asm volatile (
> #ifdef CONFIG_X86_64
> " xchg %%rbx,%%rsp \n"
> diff --git a/include/linux/kasan.h b/include/linux/kasan.h
> index d600303..820c0ad 100644
> --- a/include/linux/kasan.h
> +++ b/include/linux/kasan.h
> @@ -44,6 +44,7 @@ static inline void kasan_disable_current(void)
> void kasan_unpoison_shadow(const void *address, size_t size);
>
> void kasan_unpoison_task_stack(struct task_struct *task);
> +void kasan_unpoison_stack_above_sp_to(const void *watermark);
>
> void kasan_alloc_pages(struct page *page, unsigned int order);
> void kasan_free_pages(struct page *page, unsigned int order);
> @@ -85,6 +86,7 @@ size_t kasan_metadata_size(struct kmem_cache *cache);
> static inline void kasan_unpoison_shadow(const void *address, size_t size) {}
>
> static inline void kasan_unpoison_task_stack(struct task_struct *task) {}
> +static inline void kasan_unpoison_stack_above_sp_to(const void *watermark) {}
>
> static inline void kasan_enable_current(void) {}
> static inline void kasan_disable_current(void) {}
> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
> index 88af13c..52d7ff1 100644
> --- a/mm/kasan/kasan.c
> +++ b/mm/kasan/kasan.c
> @@ -77,9 +77,24 @@ void kasan_unpoison_task_stack(struct task_struct *task)
> }
>
> /* Unpoison the stack for the current task beyond a watermark sp value. */
> -asmlinkage void kasan_unpoison_remaining_stack(void *sp)
> +asmlinkage void kasan_unpoison_task_stack_below(const void *watermark)
> {
> - __kasan_unpoison_stack(current, sp);
> + __kasan_unpoison_stack(current, watermark);
> +}
> +
> +/*
> + * Clear all poison for the region between the current SP and a provided
> + * watermark value, as is sometimes required prior to hand-crafted asm
> function
> + * returns in the middle of functions.
> + */
> +void kasan_unpoison_stack_above_sp_to(const void *watermark)
> +{
> + const void *sp = (void *)current_stack_pointer();
> + size_t size = watermark - sp;
> +
> + if (WARN_ON(sp > watermark))
> + return;
> + kasan_unpoison_shadow(sp, size);
> }
>
> /*
> --
> 2.8.0.rc3.226.g39d4020
>
