Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <CAJNi4rPKTarta5rfhNWSsLqa+Z6qo=FGFygfmT7kuZi11sr3VQ@mail.gmail.com>
 <20200823045559.GA25758@1wt.eu>
In-Reply-To: <20200823045559.GA25758@1wt.eu>
From:   richard clark <richard.xnu.clark@gmail.com>
Date:   Mon, 24 Aug 2020 14:29:55 +0800
Message-ID: <CAJNi4rN=BdR25o2W6u_RZPY55_3vBq0srHM1j4rQ8u_UnwPh3A@mail.gmail.com>
Subject: Re: Why KASAN doesn't detect this stack oob fault?
To:     Willy Tarreau <w@1wt.eu>
Cc:     linux-kernel@vger.kernel.org,
        Andrey Konovalov <andreyknvl@google.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Willy Tarreau <w@1wt.eu> =E4=BA=8E2020=E5=B9=B48=E6=9C=8823=E6=97=A5=E5=91=
=A8=E6=97=A5 =E4=B8=8B=E5=8D=8812:56=E5=86=99=E9=81=93=EF=BC=9A
>
> On Sun, Aug 23, 2020 at 11:04:34AM +0800, richard clark wrote:
> > Hi guys,
> >
> > I ins a kmod with below code in a KASAN enabled kernel (
> > 5.7.0,
> > CONFIG_KASAN=3Dy
> > CONFIG_KASAN_GENERIC=3Dy
> > CONFIG_KASAN_OUTLINE=3Dy):
> >
> > static int kmod_init(void)
> > {
> >     int i;
> >     int arr[4];
> >
> >     for (i =3D 0; i < 20; i++) {
> >         arr[i] =3D i;
> >         printk("arr[%d] =3D %d\n", i, arr[i]);
> >     }
> >     return 0;
> > }
> >
> > The output is after insmod:
> >
> > [ 1511.800683] arr[0] =3D 0
> > [ 1511.800685] arr[1] =3D 1
> > [ 1511.800686] arr[2] =3D 2
> > [ 1511.800687] arr[3] =3D 3
> > [ 1511.800688] arr[4] =3D 4
> > [ 1511.800690] arr[5] =3D 5
> > [ 1511.800691] arr[6] =3D 6
> > [ 1511.800692] arr[7] =3D 7
> > [ 1511.800693] arr[8] =3D 8
> > [ 1511.800694] arr[9] =3D 9
> > [ 1511.800695] arr[10] =3D 10
> > [ 1511.800696] arr[11] =3D 11
> > [ 1511.800697] arr[12] =3D 12
> > [ 1511.800699] arr[13] =3D 13
> > [ 1511.800700] arr[14] =3D 14
> > [ 1511.800701] arr[15] =3D 15
> > [ 1511.800702] arr[16] =3D 16
> > [ 1511.800704] arr[17] =3D 17
> > [ 1511.800705] arr[18] =3D 18
> > [ 1511.800706] arr[19] =3D 19
> >
> > The kernel is not tainted and the gcc version is 7.5 used to build the =
kernel.
> > The question is:
> > 1. Why the stack out-of-bound can work?
> > 2. Why the KASAN doesn't detect this?
>
> Have you verified in the output code that the compiler didn't optimize
> the stack access away since it doesn't need it ?
>
yes, the compiler did optimize the stack access away with this code piece..=
.
> Just to make sure, do it in two distinct loops so that there are more
> chances for the stack to be really used:
>
Right, the KASAN stack oob will be triggered when I update the code to
a memory access with the stack address
>
>  static int kmod_init(void)
>  {
>      int i;
>      int arr[4];
>
>      for (i =3D 0; i < 20; i++)
>          arr[i] =3D i;
>
>      for (i =3D 0; i < 20; i++)
>          printk("arr[%d] =3D %d\n", i, arr[i]);
>
>      return 0;
>  }
>
> Willy