From patchwork Tue Jul 4 00:52:05 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 115533 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:9f45:0:b0:3ea:f831:8777 with SMTP id v5csp894085vqx; Mon, 3 Jul 2023 18:11:14 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ4esWGA54Z8DJIdZNXsYTisHXKCncYD1hWfbVd2gvx0uP48ZLIgcHdUkQpEtVbOngHupYr4 X-Received: by 2002:a05:6a20:5499:b0:127:3c6e:fc83 with SMTP id i25-20020a056a20549900b001273c6efc83mr17036652pzk.42.1688433073702; Mon, 03 Jul 2023 18:11:13 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1688433073; cv=none; d=google.com; s=arc-20160816; b=mYRS6yg7BcdQRWC9uJ0dJQH6/1Br8/bLXOe62UwmzEAFNpch3ZZv8A8pNkJ+IKOQke RVJc87ea0ef68DWeMMZUwU3vpiNIKJt81tdNq/CImS0GmsupxCklZvH4KpzKG0TLOsBe 7LuxRZkeQitaX8xih+/Guyg61+H6DqFfHO+3XFMWXg6fX+N6siYBin22lVU75SOBu4R1 iu2md8HyXOZtXYKqLzcsWFn8FlqASBTteirUPzxcNwTrGs5tKtZIWp/zKjhTkuR0Pn8b YK+CRLZbGf432lkxQdOBKD7KOBus1gmPcBBfOpeOrmF7CsW/+0SGRb00OyrbmFjtKmbK FekQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=9PvMF+hM/tczQlWv3CZcoKeqGsQQ6VNHOk9FPhNfzNc=; fh=tDHA86gZ9oTHBveGBBRxAm8hjiFFPfD6zeX1tbGJ9Qw=; b=FftXymq6a7ysy82F8yviHqDRf/1VPny024dbASBBLwchpN9QZSN8PsURfcmIumd9pW ujgvBsc5bCi9fb6zNVHnQ8/RkCwyIoZ+kXOAZ0j5UWv9i/LSxS+eW1dIiZCCxTtEi+1P AtYxHC4dL8mvqMZWJ2LtA4fo/j1pXgkBUgJ7xpSXznuHG/BoYZh4AKhANBHDZdlmdGGD UwMkgy28wmG7FXPqIjBFrvAhscIXhK+UHCVzh8Uj7DSvuc+AqYnhg6abI2Y0CL5nlvnf dpewxDjzGI+oOvdpHVwE256/RmTF5uZZ5hHA2UkwD5IKa9cFqosW8PfkHT24n8HqRpCS t2Tw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.dev header.s=key1 header.b=QYXS2UfB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.dev Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id cg17-20020a056a00291100b006687ed7b4a5si9238606pfb.140.2023.07.03.18.10.58; Mon, 03 Jul 2023 18:11:13 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.dev header.s=key1 header.b=QYXS2UfB; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.dev Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230377AbjGDA5f (ORCPT + 99 others); Mon, 3 Jul 2023 20:57:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41878 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229622AbjGDA5d (ORCPT ); Mon, 3 Jul 2023 20:57:33 -0400 X-Greylist: delayed 320 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Mon, 03 Jul 2023 17:57:32 PDT Received: from out-8.mta1.migadu.com (out-8.mta1.migadu.com [95.215.58.8]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 80956137 for ; Mon, 3 Jul 2023 17:57:32 -0700 (PDT) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1688431928; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=9PvMF+hM/tczQlWv3CZcoKeqGsQQ6VNHOk9FPhNfzNc=; b=QYXS2UfB9fTOuQpIwrkK8of/jfOc1fLqLKs6PHdxgbFg8nLcpk3/ConRj1BiU7j0WCo28n daS2Mm1suhkZfCV9ZqOjFCpyOONbNFubKyg6htLLwJBilt9OjYbjTlOpmT57JWEevu0M2T nWPQm6VALEzldSnhheqDa/Q0KUbBky0= From: andrey.konovalov@linux.dev To: Marco Elver Cc: Andrey Konovalov , Alexander Potapenko , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, Andrew Morton , linux-mm@kvack.org, Arnd Bergmann , stable@vger.kernel.org, linux-kernel@vger.kernel.org, Andrey Konovalov Subject: [PATCH] kasan: fix type cast in memory_is_poisoned_n Date: Tue, 4 Jul 2023 02:52:05 +0200 Message-Id: <8c9e0251c2b8b81016255709d4ec42942dcaf018.1688431866.git.andreyknvl@google.com> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1770450399118974665?= X-GMAIL-MSGID: =?utf-8?q?1770450399118974665?= From: Andrey Konovalov Commit bb6e04a173f0 ("kasan: use internal prototypes matching gcc-13 builtins") introduced a bug into the memory_is_poisoned_n implementation: it effectively removed the cast to a signed integer type after applying KASAN_GRANULE_MASK. As a result, KASAN started failing to properly check memset, memcpy, and other similar functions. Fix the bug by adding the cast back (through an additional signed integer variable to make the code more readable). Fixes: bb6e04a173f0 ("kasan: use internal prototypes matching gcc-13 builtins") Cc: Signed-off-by: Andrey Konovalov --- mm/kasan/generic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/kasan/generic.c b/mm/kasan/generic.c index 5b4c97baa656..4d837ab83f08 100644 --- a/mm/kasan/generic.c +++ b/mm/kasan/generic.c @@ -130,9 +130,10 @@ static __always_inline bool memory_is_poisoned_n(const void *addr, size_t size) if (unlikely(ret)) { const void *last_byte = addr + size - 1; s8 *last_shadow = (s8 *)kasan_mem_to_shadow(last_byte); + s8 last_accessible_byte = (unsigned long)last_byte & KASAN_GRANULE_MASK; if (unlikely(ret != (unsigned long)last_shadow || - (((long)last_byte & KASAN_GRANULE_MASK) >= *last_shadow))) + last_accessible_byte >= *last_shadow)) return true; } return false;