lkml.org 
[lkml]   [2019]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH v3] kasan: add memory corruption identification for software tag-based mode
    From
    Date
    On Mon, 2019-06-17 at 13:57 +0200, Dmitry Vyukov wrote:
    > On Mon, Jun 17, 2019 at 6:00 AM Walter Wu <walter-zh.wu@mediatek.com> wrote:
    > >
    > > On Fri, 2019-06-14 at 10:32 +0800, Walter Wu wrote:
    > > > On Fri, 2019-06-14 at 01:46 +0800, Walter Wu wrote:
    > > > > On Thu, 2019-06-13 at 15:27 +0300, Andrey Ryabinin wrote:
    > > > > >
    > > > > > On 6/13/19 11:13 AM, Walter Wu wrote:
    > > > > > > This patch adds memory corruption identification at bug report for
    > > > > > > software tag-based mode, the report show whether it is "use-after-free"
    > > > > > > or "out-of-bound" error instead of "invalid-access" error.This will make
    > > > > > > it easier for programmers to see the memory corruption problem.
    > > > > > >
    > > > > > > Now we extend the quarantine to support both generic and tag-based kasan.
    > > > > > > For tag-based kasan, the quarantine stores only freed object information
    > > > > > > to check if an object is freed recently. When tag-based kasan reports an
    > > > > > > error, we can check if the tagged addr is in the quarantine and make a
    > > > > > > good guess if the object is more like "use-after-free" or "out-of-bound".
    > > > > > >
    > > > > >
    > > > > >
    > > > > > We already have all the information and don't need the quarantine to make such guess.
    > > > > > Basically if shadow of the first byte of object has the same tag as tag in pointer than it's out-of-bounds,
    > > > > > otherwise it's use-after-free.
    > > > > >
    > > > > > In pseudo-code it's something like this:
    > > > > >
    > > > > > u8 object_tag = *(u8 *)kasan_mem_to_shadow(nearest_object(cacche, page, access_addr));
    > > > > >
    > > > > > if (access_addr_tag == object_tag && object_tag != KASAN_TAG_INVALID)
    > > > > > // out-of-bounds
    > > > > > else
    > > > > > // use-after-free
    > > > >
    > > > > Thanks your explanation.
    > > > > I see, we can use it to decide corruption type.
    > > > > But some use-after-free issues, it may not have accurate free-backtrace.
    > > > > Unfortunately in that situation, free-backtrace is the most important.
    > > > > please see below example
    > > > >
    > > > > In generic KASAN, it gets accurate free-backrace(ptr1).
    > > > > In tag-based KASAN, it gets wrong free-backtrace(ptr2). It will make
    > > > > programmer misjudge, so they may not believe tag-based KASAN.
    > > > > So We provide this patch, we hope tag-based KASAN bug report is the same
    > > > > accurate with generic KASAN.
    > > > >
    > > > > ---
    > > > > ptr1 = kmalloc(size, GFP_KERNEL);
    > > > > ptr1_free(ptr1);
    > > > >
    > > > > ptr2 = kmalloc(size, GFP_KERNEL);
    > > > > ptr2_free(ptr2);
    > > > >
    > > > > ptr1[size] = 'x'; //corruption here
    > > > >
    > > > >
    > > > > static noinline void ptr1_free(char* ptr)
    > > > > {
    > > > > kfree(ptr);
    > > > > }
    > > > > static noinline void ptr2_free(char* ptr)
    > > > > {
    > > > > kfree(ptr);
    > > > > }
    > > > > ---
    > > > >
    > > > We think of another question about deciding by that shadow of the first
    > > > byte.
    > > > In tag-based KASAN, it is immediately released after calling kfree(), so
    > > > the slub is easy to be used by another pointer, then it will change
    > > > shadow memory to the tag of new pointer, it will not be the
    > > > KASAN_TAG_INVALID, so there are many false negative cases, especially in
    > > > small size allocation.
    > > >
    > > > Our patch is to solve those problems. so please consider it, thanks.
    > > >
    > > Hi, Andrey and Dmitry,
    > >
    > > I am sorry to bother you.
    > > Would you tell me what you think about this patch?
    > > We want to use tag-based KASAN, so we hope its bug report is clear and
    > > correct as generic KASAN.
    > >
    > > Thanks your review.
    > > Walter
    >
    > Hi Walter,
    >
    > I will probably be busy till the next week. Sorry for delays.

    It's ok. Thanks your kindly help.
    I hope I can contribute to tag-based KASAN. It is a very important tool
    for us.

    \
     
     \ /
      Last update: 2019-06-17 14:33    [W:4.278 / U:0.144 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site