Received: by 2002:a05:6a10:9848:0:0:0:0 with SMTP id x8csp3346875pxf; Mon, 15 Mar 2021 07:39:34 -0700 (PDT) X-Google-Smtp-Source: ABdhPJy4RbeAtgHJy83hdq4TBbvQfzc6v8WuGSnnr3nqvebAc2bX7nP8KssvUGeTwmV08ZJB3LCk X-Received: by 2002:aa7:c4d1:: with SMTP id p17mr30573721edr.387.1615819174718; Mon, 15 Mar 2021 07:39:34 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1615819174; cv=none; d=google.com; s=arc-20160816; b=lmbgMwaCRm7x47S+f/T1AhFSdoyx3lj28VjaRI8HuPtXHTT7hzOCVifY0F0I1eFpMH c3H15A4fP7+YuaqsTZEPT9uLTCQQLRc5/+sDwEvTX4ImrB1WvbkoqOqKWJIdV8IEcJRO jW2tInaSO2csDRp0sWxwxLDzg7UiV0Ce7XyVnA3n5utZiOakQmmUkRKbEsfnqSo7dXTz 2IBOOwLI1TCEDaHwqM7yYoPPElseQyAe2pg6TwK9fq7YnEplmarP0afV/tF9fR3NP13e ewNOJNAOMWM3ttRpC+CH/CvhfGxg0ZWvomw2LQPCxkvnoIZ9n0lQQOV/wS/1KdHG2aBg HKhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=tvYequE4GMkZxAi8wuAOahOWNj+1rS1MqdQobtuqU0E=; b=z69Cbu5sI9bwRknfg4Y2I3+8JOCbeKX3zPHmoKMdcb8F2mpu3k5g4rO1iQEkcXtuv8 KNhpsyH+0KPs6dt74TdFL8dcvUIlWnJwJtAyXbgP5Pi/UPpBh956ILYMWa6y/UkhBR3/ HL30C4g4vgtnxclt/2pSUmqGwBiSR2eFB/XvqUTIfBr0EvK/6TEJGX9zU7P+PSEDHBfw hudjEZ9aKpcK/LM4OTaoF1MzZkNFzH/wN/dcHuB86qsUcuJ9vKZyDV9IW1/8pzW+BCCr dHnhXUfQJFFklpIciJjY8hixieohE2ONSSaXria3Hh/FV2/qJX92PTQ96Tgd+bOBhCWb BpdA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2ckKbVdE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id q14si11218600edw.414.2021.03.15.07.39.11; Mon, 15 Mar 2021 07:39:34 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2ckKbVdE; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240206AbhCOOhW (ORCPT + 99 others); Mon, 15 Mar 2021 10:37:22 -0400 Received: from mail.kernel.org ([198.145.29.99]:37612 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233374AbhCOOBh (ORCPT ); Mon, 15 Mar 2021 10:01:37 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id C55A264F90; Mon, 15 Mar 2021 14:01:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615816866; bh=h9DrtrNVvXagdWmgwfSWCFFohJD6o0Zn+vEkJUwHi2g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2ckKbVdEAIr0jv3h0Rc8ScznscqhbYb348WWgftYe9M/sHwsmBMkYlOQcmRi4vZpj 9+Q3+P6rfSZ+2+21AdULjUAbNlOb4xRQSuRABLp7UBg1EHHWPxtyj8OLed0sdJgEUW rrD47Qgo1UWeu5ZG+pLX8MtlyqofbwZC7y9/M5eI= From: gregkh@linuxfoundation.org To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrey Konovalov , Marco Elver , Alexander Potapenko , Andrey Ryabinin , Branislav Rankov , Catalin Marinas , Dmitry Vyukov , Evgenii Stepanov , Kevin Brodsky , Peter Collingbourne , Vincenzo Frascino , Will Deacon , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH 5.10 159/290] kasan: fix memory corruption in kasan_bitops_tags test Date: Mon, 15 Mar 2021 14:54:12 +0100 Message-Id: <20210315135547.281025423@linuxfoundation.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210315135541.921894249@linuxfoundation.org> References: <20210315135541.921894249@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman From: Andrey Konovalov [ Upstream commit e66e1799a76621003e5b04c9c057826a2152e103 ] Since the hardware tag-based KASAN mode might not have a redzone that comes after an allocated object (when kasan.mode=prod is enabled), the kasan_bitops_tags() test ends up corrupting the next object in memory. Change the test so it always accesses the redzone that lies within the allocated object's boundaries. Link: https://linux-review.googlesource.com/id/I67f51d1ee48f0a8d0fe2658c2a39e4879fe0832a Link: https://lkml.kernel.org/r/7d452ce4ae35bb1988d2c9244dfea56cf2cc9315.1610733117.git.andreyknvl@google.com Signed-off-by: Andrey Konovalov Reviewed-by: Marco Elver Reviewed-by: Alexander Potapenko Cc: Andrey Ryabinin Cc: Branislav Rankov Cc: Catalin Marinas Cc: Dmitry Vyukov Cc: Evgenii Stepanov Cc: Kevin Brodsky Cc: Peter Collingbourne Cc: Vincenzo Frascino Cc: Will Deacon Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- lib/test_kasan.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/test_kasan.c b/lib/test_kasan.c index 662f862702fc..400507f1e5db 100644 --- a/lib/test_kasan.c +++ b/lib/test_kasan.c @@ -737,13 +737,13 @@ static void kasan_bitops_tags(struct kunit *test) return; } - /* Allocation size will be rounded to up granule size, which is 16. */ - bits = kzalloc(sizeof(*bits), GFP_KERNEL); + /* kmalloc-64 cache will be used and the last 16 bytes will be the redzone. */ + bits = kzalloc(48, GFP_KERNEL); KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits); - /* Do the accesses past the 16 allocated bytes. */ - kasan_bitops_modify(test, BITS_PER_LONG, &bits[1]); - kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, &bits[1]); + /* Do the accesses past the 48 allocated bytes, but within the redone. */ + kasan_bitops_modify(test, BITS_PER_LONG, (void *)bits + 48); + kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, (void *)bits + 48); kfree(bits); } -- 2.30.1