p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
linux_old1/arch/arm64/kernel
History
Dmitry Vyukov 9f7d416c36 kprobes: Unpoison stack in jprobe_return() for KASAN 
I observed false KSAN positives in the sctp code, when
sctp uses jprobe_return() in jsctp_sf_eat_sack().

The stray 0xf4 in shadow memory are stack redzones:

[     ] ==================================================================
[     ] BUG: KASAN: stack-out-of-bounds in memcmp+0xe9/0x150 at addr ffff88005e48f480
[     ] Read of size 1 by task syz-executor/18535
[     ] page:ffffea00017923c0 count:0 mapcount:0 mapping:          (null) index:0x0
[     ] flags: 0x1fffc0000000000()
[     ] page dumped because: kasan: bad access detected
[     ] CPU: 1 PID: 18535 Comm: syz-executor Not tainted 4.8.0+ #28
[     ] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[     ]  ffff88005e48f2d0 ffffffff82d2b849 ffffffff0bc91e90 fffffbfff10971e8
[     ]  ffffed000bc91e90 ffffed000bc91e90 0000000000000001 0000000000000000
[     ]  ffff88005e48f480 ffff88005e48f350 ffffffff817d3169 ffff88005e48f370
[     ] Call Trace:
[     ]  [<ffffffff82d2b849>] dump_stack+0x12e/0x185
[     ]  [<ffffffff817d3169>] kasan_report+0x489/0x4b0
[     ]  [<ffffffff817d31a9>] __asan_report_load1_noabort+0x19/0x20
[     ]  [<ffffffff82d49529>] memcmp+0xe9/0x150
[     ]  [<ffffffff82df7486>] depot_save_stack+0x176/0x5c0
[     ]  [<ffffffff817d2031>] save_stack+0xb1/0xd0
[     ]  [<ffffffff817d27f2>] kasan_slab_free+0x72/0xc0
[     ]  [<ffffffff817d05b8>] kfree+0xc8/0x2a0
[     ]  [<ffffffff85b03f19>] skb_free_head+0x79/0xb0
[     ]  [<ffffffff85b0900a>] skb_release_data+0x37a/0x420
[     ]  [<ffffffff85b090ff>] skb_release_all+0x4f/0x60
[     ]  [<ffffffff85b11348>] consume_skb+0x138/0x370
[     ]  [<ffffffff8676ad7b>] sctp_chunk_put+0xcb/0x180
[     ]  [<ffffffff8676ae88>] sctp_chunk_free+0x58/0x70
[     ]  [<ffffffff8677fa5f>] sctp_inq_pop+0x68f/0xef0
[     ]  [<ffffffff8675ee36>] sctp_assoc_bh_rcv+0xd6/0x4b0
[     ]  [<ffffffff8677f2c1>] sctp_inq_push+0x131/0x190
[     ]  [<ffffffff867bad69>] sctp_backlog_rcv+0xe9/0xa20
[ ... ]
[     ] Memory state around the buggy address:
[     ]  ffff88005e48f380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[     ]  ffff88005e48f400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[     ] >ffff88005e48f480: f4 f4 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[     ]                    ^
[     ]  ffff88005e48f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[     ]  ffff88005e48f580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[     ] ==================================================================

KASAN stack instrumentation poisons stack redzones on function entry
and unpoisons them on function exit. If a function exits abnormally
(e.g. with a longjmp like jprobe_return()), stack redzones are left
poisoned. Later this leads to random KASAN false reports.

Unpoison stack redzones in the frames we are going to jump over
before doing actual longjmp in jprobe_return().

Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Lorenzo Pieralisi <lorenzo.pieralisi@arm.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: kasan-dev@googlegroups.com
Cc: surovegin@google.com
Cc: rostedt@goodmis.org
Link: http://lkml.kernel.org/r/1476454043-101898-1-git-send-email-dvyukov@google.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
 		2016-10-16 11:02:31 +02:00
..
probes arm64: migrate exception table users off module.h and onto extable.h 2016-09-20 09:36:21 +01:00
vdso arm64: Add support for CLOCK_MONOTONIC_RAW in clock_gettime() vDSO 2016-07-12 16:06:32 +01:00
.gitignore
…
Makefile arm64: Set UTS_MACHINE in the Makefile 2016-08-31 12:31:38 +01:00
acpi.c ARM64: ACPI: enable ACPI_SPCR_TABLE 2016-09-28 17:46:57 +02:00
acpi_numa.c arm64/numa: avoid inconsistent information to be printed 2016-09-09 14:59:08 +01:00
acpi_parking_protocol.c arm64: kernel: acpi: fix ioremap in ACPI parking protocol cpu_postboot 2016-02-26 15:39:52 +00:00
alternative.c arm64: alternative: Add support for patching adrp instructions 2016-09-09 15:03:28 +01:00
arm64ksyms.c Merge branch 'for-next/kprobes' into for-next/core 2016-07-21 18:20:41 +01:00
armv8_deprecated.c Merge branch 'smp-hotplug-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2016-07-29 13:55:30 -07:00
asm-offsets.c arm64: Work around systems with mismatched cache line sizes 2016-09-09 15:03:29 +01:00
cacheinfo.c arm64: simplify sysreg manipulation 2016-09-09 11:43:50 +01:00
cpu-reset.S arm64: Add back cpu reset routines 2016-06-27 16:31:25 +01:00
cpu-reset.h arm64: Add back cpu reset routines 2016-06-27 16:31:25 +01:00
cpu_errata.c arm64: Work around systems with mismatched cache line sizes 2016-09-09 15:03:29 +01:00
cpu_ops.c arm64: apply __ro_after_init to some objects 2016-08-22 12:32:29 +01:00
cpufeature.c arm64: Rearrange CPU errata workaround checks 2016-09-09 15:03:28 +01:00
cpuidle.c arm64: add support for ACPI Low Power Idle(LPI) 2016-07-21 23:29:38 +02:00
cpuinfo.c arm64: Rearrange CPU errata workaround checks 2016-09-09 15:03:28 +01:00
debug-monitors.c arm64: simplify sysreg manipulation 2016-09-09 11:43:50 +01:00
efi-entry.S arm64: move early boot code to the .init segment 2016-04-14 18:11:30 +01:00
efi.c arm64: efi: avoid block mappings for unaligned UEFI memory regions 2016-07-01 11:56:26 +01:00
entry-fpsimd.S arm64: fpsimd: fix a typo in fpsimd_save_partial_state ENDPROC 2014-07-31 11:42:42 +01:00
entry-ftrace.S ftrace: Remove CONFIG_HAVE_FUNCTION_GRAPH_FP_TEST from config 2016-08-24 12:15:13 +02:00
entry.S arm64: use alternative auto-nop 2016-09-12 10:46:07 +01:00
entry32.S arm64: entry32: remove pointless register assignment 2015-07-10 16:47:13 +01:00
fpsimd.c arm64/FP/SIMD: Convert to hotplug state machine 2016-09-19 21:44:25 +02:00
ftrace.c ftrace: Add return address pointer to ftrace_ret_stack 2016-08-24 12:15:14 +02:00
head.S arm64: head.S: document the use of callee saved registers 2016-09-02 11:47:51 +01:00
hibernate-asm.S arm64: Introduce raw_{d,i}cache_line_size 2016-09-09 15:03:29 +01:00
hibernate.c Revert "arm64: hibernate: Refuse to hibernate if the boot cpu is offline" 2016-08-26 11:21:25 +01:00
hw_breakpoint.c arm64: hw_breakpoint: convert CPU hotplug notifier to new infrastructure 2016-09-01 13:45:51 +01:00
hyp-stub.S arm64: Add back cpu reset routines 2016-06-27 16:31:25 +01:00
image.h arm64 updates for 4.7: 2016-05-16 17:17:24 -07:00
insn.c arm64: insn: Add helpers for adrp offsets 2016-09-09 15:03:28 +01:00
io.c arm64: optimize memcpy_{from,to}io() and memset_io() 2014-11-06 17:25:27 +00:00
irq.c arm64: remove irq_count and do_softirq_own_stack() 2015-12-21 17:26:01 +00:00
jump_label.c jump_label: Rename JUMP_LABEL_{EN,DIS}ABLE to JUMP_LABEL_{JMP,NOP} 2015-08-03 11:34:12 +02:00
kaslr.c arm64: apply __ro_after_init to some objects 2016-08-22 12:32:29 +01:00
kgdb.c arm64: kgdb: handle read-only text / modules 2016-09-23 11:25:01 +01:00
kuser32.S arm64: Add __NR_* definitions for compat syscalls 2014-07-10 11:02:40 +01:00
machine_kexec.c arm64/kexec: Add pr_debug output 2016-06-27 16:31:26 +01:00
module-plts.c arm64: add support for module PLTs 2016-02-24 14:57:24 +00:00
module.c arm64: add support for kernel ASLR 2016-02-24 14:57:27 +00:00
module.lds arm64: add support for module PLTs 2016-02-24 14:57:24 +00:00
paravirt.c arm64: introduce CONFIG_PARAVIRT, PARAVIRT_TIME_ACCOUNTING and pv_time_ops 2015-12-21 14:40:54 +00:00
pci.c Merge branch 'pci/resource' into next 2016-08-01 12:23:44 -05:00
perf_callchain.c perf core: Add a 'nr' field to perf_event_callchain_context 2016-05-16 23:11:51 -03:00
perf_event.c arm64: pmu: Hoist pmu platform device name 2016-09-16 17:11:34 +01:00
perf_regs.c perf: Move task_pt_regs sampling into arch code 2015-01-09 11:12:28 +01:00
process.c arm64: use simpler API for random address requests 2016-10-11 15:06:32 -07:00
psci.c ARM: 8511/1: ARM64: kernel: PSCI: move PSCI idle management code to drivers/firmware 2016-02-11 15:33:38 +00:00
ptrace.c Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 2016-07-29 17:38:46 -07:00
relocate_kernel.S arm64: Introduce raw_{d,i}cache_line_size 2016-09-09 15:03:29 +01:00
return_address.c arm64: ftrace: fix a stack tracer's output under function graph tracer 2015-12-21 17:26:02 +00:00
setup.c arm64: Set UTS_MACHINE in the Makefile 2016-08-31 12:31:38 +01:00
signal.c arm64: factor work_pending state machine to C 2016-08-22 10:00:48 +01:00
signal32.c arm64: Fix misspellings in comments. 2016-03-04 18:19:17 +00:00
sleep.S kprobes: Unpoison stack in jprobe_return() for KASAN 2016-10-16 11:02:31 +02:00
smccc-call.S ARM: 8480/2: arm64: add implementation for arm-smccc 2016-01-04 16:24:45 +00:00
smp.c arm64 updates for 4.9: 2016-10-03 08:58:35 -07:00
smp_spin_table.c arm64: vmlinux.ld: Add mmuoff data sections and move mmuoff text into idmap 2016-08-25 18:00:30 +01:00
stacktrace.c arm64: fix dump_backtrace/unwind_frame with NULL tsk 2016-09-26 14:24:01 +01:00
suspend.c arm64: hw_breakpoint: convert CPU hotplug notifier to new infrastructure 2016-09-01 13:45:51 +01:00
sys.c arm64: compat: Check for AArch32 state 2016-04-20 12:22:42 +01:00
sys32.c arm64: fix implementation of mmap2 compat syscall 2015-03-19 10:43:51 +00:00
sys_compat.c arm64: simplify sysreg manipulation 2016-09-09 11:43:50 +01:00
time.c arm64: ftrace: fix a stack tracer's output under function graph tracer 2015-12-21 17:26:02 +00:00
topology.c arm64: kernel: remove non-legit DT warnings when booting using ACPI 2015-07-27 11:08:41 +01:00
trace-events-emulation.h arm64: Trace emulation of AArch32 legacy instructions 2014-11-20 16:35:02 +00:00
traps.c arm64: fix dump_backtrace/unwind_frame with NULL tsk 2016-09-26 14:24:01 +01:00
vdso.c arm/arm64: arch_timer: Use archdata to indicate vdso suitability 2016-09-23 17:19:25 +01:00
vmlinux.lds.S nmi_backtrace: generate one-line reports for idle cpus 2016-10-07 18:46:30 -07:00