As noticed by Brian, KMSAN should not be zeroing the origin when
unpoisoning parts of a four-byte uninitialized value, e.g.:
char a[4];
kmsan_unpoison_memory(a, 1);
This led to false negatives, as certain poisoned values could receive zero
origins, preventing those values from being reported.
To fix the problem, check that kmsan_internal_set_shadow_origin() writes
zero origins only to slots which have zero shadow.
Reported-by: Brian Johannesmeyer <[email protected]>
Link: https://lore.kernel.org/lkml/[email protected]/T/
Fixes: f80be4571b19 ("kmsan: add KMSAN runtime core")
Signed-off-by: Alexander Potapenko <[email protected]>
---
mm/kmsan/core.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/mm/kmsan/core.c b/mm/kmsan/core.c
index cf2d70e9c9a5f..95f859e38c533 100644
--- a/mm/kmsan/core.c
+++ b/mm/kmsan/core.c
@@ -196,8 +196,7 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
u32 origin, bool checked)
{
u64 address = (u64)addr;
- void *shadow_start;
- u32 *origin_start;
+ u32 *shadow_start, *origin_start;
size_t pad = 0;
KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size));
@@ -225,8 +224,16 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
origin_start =
(u32 *)kmsan_get_metadata((void *)address, KMSAN_META_ORIGIN);
- for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++)
- origin_start[i] = origin;
+ /*
+ * If the new origin is non-zero, assume that the shadow byte is also non-zero,
+ * and unconditionally overwrite the old origin slot.
+ * If the new origin is zero, overwrite the old origin slot iff the
+ * corresponding shadow slot is zero.
+ */
+ for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) {
+ if (origin || !shadow_start[i])
+ origin_start[i] = origin;
+ }
}
struct page *kmsan_vmalloc_to_page_or_null(void *vaddr)
--
2.45.1.288.g0e0cd299f1-goog
From: Brian Johannesmeyer <[email protected]>
Add a regression test to ensure that kmsan_unpoison_memory() works the same
as an unpoisoning operation added by the instrumentation.
The test has two subtests: one that checks the instrumentation, and one
that checks kmsan_unpoison_memory(). Each subtest initializes the first
byte of a 4-byte buffer, then checks that the other 3 bytes are
uninitialized.
Signed-off-by: Brian Johannesmeyer <[email protected]>
Link: https://lore.kernel.org/lkml/[email protected]/T/
[[email protected]: change description, remove comment about failing test case]
Signed-off-by: Alexander Potapenko <[email protected]>
---
mm/kmsan/kmsan_test.c | 27 +++++++++++++++++++++++++++
1 file changed, 27 insertions(+)
diff --git a/mm/kmsan/kmsan_test.c b/mm/kmsan/kmsan_test.c
index 07d3a3a5a9c52..018069aba92be 100644
--- a/mm/kmsan/kmsan_test.c
+++ b/mm/kmsan/kmsan_test.c
@@ -614,6 +614,32 @@ static void test_stackdepot_roundtrip(struct kunit *test)
KUNIT_EXPECT_TRUE(test, report_matches(&expect));
}
+/*
+ * Test case: ensure that kmsan_unpoison_memory() and the instrumentation work
+ * the same.
+ */
+static void test_unpoison_memory(struct kunit *test)
+{
+ EXPECTATION_UNINIT_VALUE_FN(expect, "test_unpoison_memory");
+ volatile char a[4], b[4];
+
+ kunit_info(
+ test,
+ "unpoisoning via the instrumentation vs. kmsan_unpoison_memory() (2 UMR reports)\n");
+
+ /* Initialize a[0] and check a[1]--a[3]. */
+ a[0] = 0;
+ kmsan_check_memory((char *)&a[1], 3);
+ KUNIT_EXPECT_TRUE(test, report_matches(&expect));
+
+ report_reset();
+
+ /* Initialize b[0] and check b[1]--b[3]. */
+ kmsan_unpoison_memory((char *)&b[0], 1);
+ kmsan_check_memory((char *)&b[1], 3);
+ KUNIT_EXPECT_TRUE(test, report_matches(&expect));
+}
+
static struct kunit_case kmsan_test_cases[] = {
KUNIT_CASE(test_uninit_kmalloc),
KUNIT_CASE(test_init_kmalloc),
@@ -637,6 +663,7 @@ static struct kunit_case kmsan_test_cases[] = {
KUNIT_CASE(test_memset64),
KUNIT_CASE(test_long_origin_chain),
KUNIT_CASE(test_stackdepot_roundtrip),
+ KUNIT_CASE(test_unpoison_memory),
{},
};
--
2.45.1.288.g0e0cd299f1-goog
On Tue, 28 May 2024 at 12:48, Alexander Potapenko <[email protected]> wrote:
>
> As noticed by Brian, KMSAN should not be zeroing the origin when
> unpoisoning parts of a four-byte uninitialized value, e.g.:
>
> char a[4];
> kmsan_unpoison_memory(a, 1);
>
> This led to false negatives, as certain poisoned values could receive zero
> origins, preventing those values from being reported.
>
> To fix the problem, check that kmsan_internal_set_shadow_origin() writes
> zero origins only to slots which have zero shadow.
>
> Reported-by: Brian Johannesmeyer <[email protected]>
> Link: https://lore.kernel.org/lkml/[email protected]/T/
> Fixes: f80be4571b19 ("kmsan: add KMSAN runtime core")
> Signed-off-by: Alexander Potapenko <[email protected]>
> ---
> mm/kmsan/core.c | 15 +++++++++++----
> 1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/mm/kmsan/core.c b/mm/kmsan/core.c
> index cf2d70e9c9a5f..95f859e38c533 100644
> --- a/mm/kmsan/core.c
> +++ b/mm/kmsan/core.c
> @@ -196,8 +196,7 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
> u32 origin, bool checked)
> {
> u64 address = (u64)addr;
> - void *shadow_start;
> - u32 *origin_start;
> + u32 *shadow_start, *origin_start;
> size_t pad = 0;
>
> KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size));
> @@ -225,8 +224,16 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
> origin_start =
> (u32 *)kmsan_get_metadata((void *)address, KMSAN_META_ORIGIN);
>
> - for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++)
> - origin_start[i] = origin;
> + /*
> + * If the new origin is non-zero, assume that the shadow byte is also non-zero,
> + * and unconditionally overwrite the old origin slot.
> + * If the new origin is zero, overwrite the old origin slot iff the
> + * corresponding shadow slot is zero.
> + */
> + for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) {
> + if (origin || !shadow_start[i])
> + origin_start[i] = origin;
> + }
Reviewed-by: Marco Elver <[email protected]>
On Tue, May 28, 2024 at 12:48:06PM +0200, Alexander Potapenko wrote:
> As noticed by Brian, KMSAN should not be zeroing the origin when
> unpoisoning parts of a four-byte uninitialized value, e.g.:
>
> char a[4];
> kmsan_unpoison_memory(a, 1);
>
> This led to false negatives, as certain poisoned values could receive zero
> origins, preventing those values from being reported.
>
> To fix the problem, check that kmsan_internal_set_shadow_origin() writes
> zero origins only to slots which have zero shadow.
>
> Reported-by: Brian Johannesmeyer <[email protected]>
> Link: https://lore.kernel.org/lkml/[email protected]/T/
> Fixes: f80be4571b19 ("kmsan: add KMSAN runtime core")
> Signed-off-by: Alexander Potapenko <[email protected]>
> ---
> mm/kmsan/core.c | 15 +++++++++++----
> 1 file changed, 11 insertions(+), 4 deletions(-)
>
> diff --git a/mm/kmsan/core.c b/mm/kmsan/core.c
> index cf2d70e9c9a5f..95f859e38c533 100644
> --- a/mm/kmsan/core.c
> +++ b/mm/kmsan/core.c
> @@ -196,8 +196,7 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
> u32 origin, bool checked)
> {
> u64 address = (u64)addr;
> - void *shadow_start;
> - u32 *origin_start;
> + u32 *shadow_start, *origin_start;
> size_t pad = 0;
>
> KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(addr, size));
> @@ -225,8 +224,16 @@ void kmsan_internal_set_shadow_origin(void *addr, size_t size, int b,
> origin_start =
> (u32 *)kmsan_get_metadata((void *)address, KMSAN_META_ORIGIN);
>
> - for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++)
> - origin_start[i] = origin;
> + /*
> + * If the new origin is non-zero, assume that the shadow byte is also non-zero,
> + * and unconditionally overwrite the old origin slot.
> + * If the new origin is zero, overwrite the old origin slot iff the
> + * corresponding shadow slot is zero.
> + */
> + for (int i = 0; i < size / KMSAN_ORIGIN_SIZE; i++) {
> + if (origin || !shadow_start[i])
> + origin_start[i] = origin;
> + }
> }
>
> struct page *kmsan_vmalloc_to_page_or_null(void *vaddr)
> --
> 2.45.1.288.g0e0cd299f1-goog
>
Tested-by: Brian Johannesmeyer <[email protected]>