linux-next/mm/kasan
Sabyrzhan Tasbolatov e4137f0881 mm, kasan, kmsan: instrument copy_from/to_kernel_nofault
Instrument copy_from_kernel_nofault() with KMSAN for uninitialized kernel
memory check and copy_to_kernel_nofault() with KASAN, KCSAN to detect the
memory corruption.

syzbot reported that bpf_probe_read_kernel() kernel helper triggered KASAN
report via kasan_check_range() which is not the expected behaviour as
copy_from_kernel_nofault() is meant to be a non-faulting helper.

Solution is, suggested by Marco Elver, to replace KASAN, KCSAN check in
copy_from_kernel_nofault() with KMSAN detection of copying uninitilaized
kernel memory.  In copy_to_kernel_nofault() we can retain
instrument_write() explicitly for the memory corruption instrumentation.

copy_to_kernel_nofault() is tested on x86_64 and arm64 with
CONFIG_KASAN_SW_TAGS.  On arm64 with CONFIG_KASAN_HW_TAGS, kunit test
currently fails.  Need more clarification on it.

[akpm@linux-foundation.org: fix comment layout, per checkpatch
Link: https://lore.kernel.org/linux-mm/CANpmjNMAVFzqnCZhEity9cjiqQ9CVN1X7qeeeAp_6yKjwKo8iw@mail.gmail.com/
Link: https://lkml.kernel.org/r/20241011035310.2982017-1-snovitoll@gmail.com
Signed-off-by: Sabyrzhan Tasbolatov <snovitoll@gmail.com>
Reviewed-by: Marco Elver <elver@google.com>
Reported-by: syzbot+61123a5daeb9f7454599@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=61123a5daeb9f7454599
Reported-by: Andrey Konovalov <andreyknvl@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=210505
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>	[KASAN]
Tested-by: Andrey Konovalov <andreyknvl@gmail.com>	[KASAN]
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2024-11-06 20:11:14 -08:00
..
common.c slub: Introduce CONFIG_SLUB_RCU_DEBUG 2024-08-27 14:12:51 +02:00
generic.c slab changes for 6.9 2024-03-12 20:14:54 -07:00
hw_tags.c fix missing vmalloc.h includes 2024-04-25 20:55:49 -07:00
init.c LoongArch: Set initial pte entry with PAGE_GLOBAL for kernel space 2024-10-21 22:11:19 +08:00
kasan_test_c.c mm, kasan, kmsan: instrument copy_from/to_kernel_nofault 2024-11-06 20:11:14 -08:00
kasan_test_module.c kasan: rename test_kasan_module_init to kasan_test_module_init 2024-02-22 10:24:53 -08:00
kasan_test_rust.rs kasan: rust: Add KASAN smoke test via UAF 2024-09-16 18:04:37 +02:00
kasan.h kasan: rust: Add KASAN smoke test via UAF 2024-09-16 18:04:37 +02:00
Makefile kasan: rust: Add KASAN smoke test via UAF 2024-09-16 18:04:37 +02:00
quarantine.c kasan: revert eviction of stack traces in generic mode 2024-02-23 17:27:12 -08:00
report_generic.c kasan: stop leaking stack trace handles 2024-01-05 10:17:45 -08:00
report_hw_tags.c kasan: use internal prototypes matching gcc-13 builtins 2023-06-09 16:25:19 -07:00
report_sw_tags.c kasan: use internal prototypes matching gcc-13 builtins 2023-06-09 16:25:19 -07:00
report_tags.c kasan: simplify kasan_complete_mode_report_info for tag-based modes 2023-12-29 11:58:47 -08:00
report.c kasan: increase the number of bits to shift when recording extra timestamps 2024-02-22 15:27:20 -08:00
shadow.c mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation 2024-11-05 16:56:21 -08:00
sw_tags.c kasan: use internal prototypes matching gcc-13 builtins 2023-06-09 16:25:19 -07:00
tags.c kasan: simplify saving extra info into tracks 2023-12-29 11:58:46 -08:00