It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
false positive reports, because __no_sanitize_or_inline enforced inlining.
Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
so that it does not inline the annotated function.
Reported-by: [email protected]
Signed-off-by: Alexander Potapenko <[email protected]>
---
include/linux/compiler_types.h | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index 0caf354cb94b5..a6a28952836cb 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -278,6 +278,17 @@ struct ftrace_likely_data {
# define __no_kcsan
#endif
+#ifdef __SANITIZE_MEMORY__
+/*
+ * Similarly to KASAN and KCSAN, KMSAN loses function attributes of inlined
+ * functions, therefore disabling KMSAN checks also requires disabling inlining.
+ *
+ * __no_sanitize_or_inline effectively prevents KMSAN from reporting errors
+ * within the function and marks all its outputs as initialized.
+ */
+# define __no_sanitize_or_inline __no_kmsan_checks notrace __maybe_unused
+#endif
+
#ifndef __no_sanitize_or_inline
#define __no_sanitize_or_inline __always_inline
#endif
--
2.44.0.769.g3c40516874-goog
On Thu, 25 Apr 2024 at 11:29, Alexander Potapenko <[email protected]> wrote:
>
> It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
> false positive reports, because __no_sanitize_or_inline enforced inlining.
>
> Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
> so that it does not inline the annotated function.
Maybe worth noting that this is only a problem for __always_inline,
since that is inlining-by-force, and from the compiler's point of view
WAI.
> Reported-by: [email protected]
> Signed-off-by: Alexander Potapenko <[email protected]>
Reviewed-by: Marco Elver <[email protected]>
> ---
> include/linux/compiler_types.h | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
> index 0caf354cb94b5..a6a28952836cb 100644
> --- a/include/linux/compiler_types.h
> +++ b/include/linux/compiler_types.h
> @@ -278,6 +278,17 @@ struct ftrace_likely_data {
> # define __no_kcsan
> #endif
>
> +#ifdef __SANITIZE_MEMORY__
> +/*
> + * Similarly to KASAN and KCSAN, KMSAN loses function attributes of inlined
> + * functions, therefore disabling KMSAN checks also requires disabling inlining.
> + *
> + * __no_sanitize_or_inline effectively prevents KMSAN from reporting errors
> + * within the function and marks all its outputs as initialized.
> + */
> +# define __no_sanitize_or_inline __no_kmsan_checks notrace __maybe_unused
> +#endif
> +
> #ifndef __no_sanitize_or_inline
> #define __no_sanitize_or_inline __always_inline
> #endif
> --
> 2.44.0.769.g3c40516874-goog
>
On Thu, 25 Apr 2024 11:28:59 +0200 Alexander Potapenko <[email protected]> wrote:
> It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
> false positive reports, because __no_sanitize_or_inline enforced inlining.
>
> Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
> so that it does not inline the annotated function.
>
> Reported-by: [email protected]
I'll add
Link: https://lkml.kernel.org/r/[email protected]
And I think a cc:stable is justifiable. A Fixes: target would be nice?
On Thu, Apr 25, 2024 at 10:31 PM Andrew Morton
<[email protected]> wrote:
>
> On Thu, 25 Apr 2024 11:28:59 +0200 Alexander Potapenko <[email protected]> wrote:
>
> > It turned out that KMSAN instruments READ_ONCE_NOCHECK(), resulting in
> > false positive reports, because __no_sanitize_or_inline enforced inlining.
> >
> > Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
> > so that it does not inline the annotated function.
As Marco noted above, we may want to rephrase it as:
Properly declare __no_sanitize_or_inline under __SANITIZE_MEMORY__,
so that it does not __always_inline the annotated function.
Let me know if I need to send a v2.
> > Reported-by: [email protected]
>
> I'll add
>
> Link: https://lkml.kernel.org/r/[email protected]
>
> And I think a cc:stable is justifiable.
Agreed.
> A Fixes: target would be nice?
Hmm, the introduction of READ_ONCE_NOCHECK predates KMSAN.
We could do:
Fixes: 5de0ce85f5a4d ("kmsan: mark noinstr as __no_sanitize_memory")
, because that commit should have introduced __no_sanitize_or_inline for KMSAN.