Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3343279pxf; Mon, 15 Mar 2021 07:34:36 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyLsx+3Our5wTcOMkl84UlkGaq0q9zzIkWuMpwaSQHQG/X5LLZGI1BfucHSBAHoR21vrNAi X-Received: by 2002:a17:906:18aa:: with SMTP id c10mr23952228ejf.248.1615818876590; Mon, 15 Mar 2021 07:34:36 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615818876; cv=none; d=google.com; s=arc-20160816; b=K29yaKqX7xF2MUTLDkB+Oveqb8MI01gEGhrTnTjDs+ofTkYCFExce91tGYxgjnAy+d u2yX73J4E5oVYr0cqcDpoBHlYKrohP2hN78DgMFizd84ARSkwKzIuYwMRVludwYOTN8D kgpAsoefMTyl3kbw8WJmy1UeXIgggzzoHvbMYQ/31fvDDCcEU8ZHm1pfR1K2uEtj8rIm /Ok9Z2tD2VMLf17j2xewSW2zgWnJsKOZveyAIY9Dih2UPnS6un9DahfanaFOte7KlZR0 ElCyPJU0V+mZsEnBvyWXuc9PrMEVKGVDIFAHutHACPhpjr9b238OoPoQnpLa/BJs3o9+ iMgQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=lQEo/zG2Mo1OUi2G5h37SRXovnqhidpIcFbYr4j96Kg=; b=gNtiNnpBH5jJNKVnGNFShqEjE38f5rxsVTbmIc9enuoAMYvD86NwXcKef1NHjAzRx9 haJoH+6bEwA1Yx9Y1i++kTycMrkB5egYgmIoIoAxRww1puY+RTlDsiXoijGqeocVaF1q Qbmy8oyVwLg1z3hqU+u2+8b6nofayP+Gg/jtoMf/A4U2XyoymKj9GWekpESYlq2+Lzyi LQ+PJ6rC9wpm5lsgaBlfsh2xQmu0NUyC57b19wZcfK3quzmb3WofYArmVFxJvEIUTZuZ 37mgEQbmX13A1Hz5Qp7ZOkHMeXSuH7FiI+7jCUebISq42qU3LpA4E7b4B/oCoEj1Mi+G wNyw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=VybOM9p8; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id m3si11325208ejl.510.2021.03.15.07.34.14; Mon, 15 Mar 2021 07:34:36 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=VybOM9p8; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239407AbhCOOcW (ORCPT + 99 others); Mon, 15 Mar 2021 10:32:22 -0400 Received: from mail.kernel.org ([198.145.29.99]:35446 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233221AbhCOOBL (ORCPT ); Mon, 15 Mar 2021 10:01:11 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 5406A64F09; Mon, 15 Mar 2021 14:00:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816841; bh=jkUcoZXhHr0dEP2cyq5ThXRptqnM24/Ia9ZPOvyKiuw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VybOM9p8BHrM4kLV+3kwegexSn5QQs1t3N+0rT8TsAECvIa42XL/Jg/R5UgbLN9Us dhuqHPe3K/Z2/eRN1a3z6rf9FUZGfOQAAgIbgIUDfcxLNVNIWnleI0TYTFzkSLU3pW p/oFYz5gAp+0Tnu4spfDIhe4JZGVvJT0emODJxQ8= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrey Konovalov , Marco Elver , Alexander Potapenko , Andrey Ryabinin , Branislav Rankov , Catalin Marinas , Dmitry Vyukov , Evgenii Stepanov , Kevin Brodsky , Peter Collingbourne , Vincenzo Frascino , Will Deacon , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH 5.11 156/306] kasan: fix memory corruption in kasan_bitops_tags test Date: Mon, 15 Mar 2021 14:53:39 +0100 Message-Id: <20210315135512.906322942@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135507.611436477@linuxfoundation.org> References: <20210315135507.611436477@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Andrey Konovalov [ Upstream commit e66e1799a76621003e5b04c9c057826a2152e103 ] Since the hardware tag-based KASAN mode might not have a redzone that comes after an allocated object (when kasan.mode=prod is enabled), the kasan_bitops_tags() test ends up corrupting the next object in memory. Change the test so it always accesses the redzone that lies within the allocated object's boundaries. Link: https://linux-review.googlesource.com/id/I67f51d1ee48f0a8d0fe2658c2a39e4879fe0832a Link: https://lkml.kernel.org/r/7d452ce4ae35bb1988d2c9244dfea56cf2cc9315.1610733117.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Reviewed-by: Alexander Potapenko Cc: Andrey Ryabinin Cc: Branislav Rankov Cc: Catalin Marinas Cc: Dmitry Vyukov Cc: Evgenii Stepanov Cc: Kevin Brodsky Cc: Peter Collingbourne Cc: Vincenzo Frascino Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- lib/test_kasan.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 2947274cc2d3..5a2f104ca13f 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -737,13 +737,13 @@ static void kasan_bitops_tags(struct kunit *test) return; } - /* Allocation size will be rounded to up granule size, which is 16. */ - bits = kzalloc(sizeof(*bits), GFP_KERNEL); + /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ + bits = kzalloc(48, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); - /* Do the accesses past the 16 allocated bytes. */ - kasan_bitops_modify(test, BITS_PER_LONG, &bits[1]); - kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, &bits[1]); + /* Do the accesses past the 48 allocated bytes, but within the redone. */ + kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48); + kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48); kfree(bits); } -- 2.30.1