Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1574988
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION |
| Date | 2017-02-06 18:00 +0100 |
| Message-ID | <t7UNY-7sP-5@gated-at.bofh.it> (permalink) |
| References | <t6VsJ-7S-3@gated-at.bofh.it> <t6VsK-7S-17@gated-at.bofh.it> <t7xeG-KE-15@gated-at.bofh.it> <t7Ezv-5tx-9@gated-at.bofh.it> <t7Njt-2A1-35@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Mon, Feb 6, 2017 at 12:57 AM, Peter Zijlstra <peterz@infradead.org> wrote:
> On Sun, Feb 05, 2017 at 03:33:36PM -0800, Kees Cook wrote:
>> On Sun, Feb 5, 2017 at 7:40 AM, Peter Zijlstra <peterz@infradead.org> wrote:
>> > On Fri, Feb 03, 2017 at 03:26:52PM -0800, Kees Cook wrote:
>> >> This converts from WARN_ON() to CHECK_DATA_CORRUPTION() in the
>> >> CONFIG_DEBUG_REFCOUNT case. Additionally moves refcount_t sanity check
>> >> conditionals into regular function flow. Since CHECK_DATA_CORRUPTION()
>> >> is marked __much_check, we override few cases where the failure has
>> >> already been handled but we want to explicitly report it.
>> >>
>> >> Signed-off-by: Kees Cook <keescook@chromium.org>
>> >> ---
>> >> include/linux/refcount.h | 35 ++++++++++++++++++++++-------------
>> >> lib/Kconfig.debug | 2 ++
>> >> 2 files changed, 24 insertions(+), 13 deletions(-)
>> >>
>> >> diff --git a/include/linux/refcount.h b/include/linux/refcount.h
>> >> index 5b89cad62237..ef32910c7dd8 100644
>> >> --- a/include/linux/refcount.h
>> >> +++ b/include/linux/refcount.h
>> >> @@ -43,10 +43,10 @@
>> >> #include <linux/spinlock.h>
>> >>
>> >> #if CONFIG_DEBUG_REFCOUNT
>> >> -#define REFCOUNT_WARN(cond, str) WARN_ON(cond)
>> >> +#define REFCOUNT_CHECK(cond, str) CHECK_DATA_CORRUPTION(cond, str)
>> >
>> > OK, so that goes back to a full WARN() which will make the generated
>> > code gigantic due to the whole printk() trainwreck :/
>>
>> Hrm, perhaps we need three levels? WARN_ON, WARN, and BUG?
>
> Did consider that, didn't really know if that made sense.
>
> Like I wrote, ideally we'd end up using something like the x86 exception
> table with a custom handler. Just no idea how to pull that off without
> doing a full blown arch specific implementation, so I didn't go there
> quite yet.
I haven't spent much time looking at the extable stuff. (Though
coincidentally, I was poking at it for x86's test_nx stuff...) I
thought there was a way to build arch-agnostic extables already?
kernel/extable.c is unconditionally built-in, for example.
> That way refcount_inc() would end up being inlined to something like:
>
> mov 0x148(%rdi),%eax
> jmp 2f
> 1: lock cmpxchg %edx,0x148(%rdi)
> je 4f
> 2: lea -0x1(%rax),%ecx
> lea 0x1(%rax),%edx
> cmp $0xfffffffd,%ecx
> jbe 1b
> 3: ud2
> 4:
>
> _ASM_EXTABLE_HANDLE(3b, 4b, ex_handler_refcount_inc)
>
>
> where:
>
> bool ex_handler_refcount_inc(const struct exception_table_entry *fixup,
> struct pt_regs *regs, int trapnr)
> {
> regs->ip = ex_fixup_addr(fixup);
>
> if (!regs->ax)
> WARN(1, "refcount_t: increment on 0; use-after-free.\n");
> else
> WARN(1, "refcount_t: saturated; leaking memory.\n");
>
> return true;
> }
>
> and the handler is shared between all instances and can be as big and
> fancy as we'd like.
I'll dig a bit to see what I can build. Can you add the lkdtm tests to
the series, though? That should be fine as-is.
Thanks!
-Kees
--
Kees Cook
Pixel Security
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 0/4] refcount_t followups... Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
[PATCH 2/4] lkdtm: convert to refcount_t testing Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
[tip:locking/core] lkdtm: Convert to refcount_t testing tip-bot for Kees Cook <tipbot@zytor.com> - 2017-02-10 09:50 +0100
[PATCH 3/4] bug: Switch data corruption check to __must_check Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
[PATCH 1/4] refcount_t: fix Kconfig help Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
[PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-04 00:30 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-05 16:50 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-06 00:40 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-06 10:00 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-06 18:00 +0100
Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-07 09:40 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-07 12:20 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-07 13:40 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-07 15:00 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-07 16:10 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-07 17:10 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-07 18:40 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-07 19:00 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-08 10:20 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-08 10:50 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Mark Rutland <mark.rutland@arm.com> - 2017-02-08 16:00 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-08 22:30 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Peter Zijlstra <peterz@infradead.org> - 2017-02-09 11:30 +0100
Re: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION Kees Cook <keescook@chromium.org> - 2017-02-11 00:40 +0100
csiph-web