Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1220446 > unrolled thread

[PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16()

Started byXishi Qiu <qiuxishi@huawei.com>
First post2015-09-08 03:50 +0200
Last post2015-09-08 12:10 +0200
Articles 5 — 2 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Xishi Qiu <qiuxishi@huawei.com> - 2015-09-08 03:50 +0200
    Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-09-08 11:40 +0200
      Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Xishi Qiu <qiuxishi@huawei.com> - 2015-09-08 12:00 +0200
        Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Xishi Qiu <qiuxishi@huawei.com> - 2015-09-08 12:00 +0200
          Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-09-08 12:10 +0200

#1220446 — [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16()

FromXishi Qiu <qiuxishi@huawei.com>
Date2015-09-08 03:50 +0200
Subject[PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16()
Message-ID<q6gcN-6wG-5@gated-at.bofh.it>
The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
it calculates wrong, so fix it.

Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
---
 mm/kasan/kasan.c |    3 +--
 1 files changed, 1 insertions(+), 2 deletions(-)

diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 7b28e9c..8da2114 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
 
 	if (unlikely(*shadow_addr)) {
 		u16 shadow_first_bytes = *(u16 *)shadow_addr;
-		s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
 
 		if (unlikely(shadow_first_bytes))
 			return true;
 
-		if (likely(!last_byte))
+		if (likely(IS_ALIGNED(addr, 8)))
 			return false;
 
 		return memory_is_poisoned_1(addr + 15);
-- 
1.7.1


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]


#1220639

FromAndrey Ryabinin <ryabinin.a.a@gmail.com>
Date2015-09-08 11:40 +0200
Message-ID<q6nxD-ij-3@gated-at.bofh.it>
In reply to#1220446
2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>:
> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
> it calculates wrong, so fix it.
>

Please, be more specific. Describe what is wrong with the current code and why,
what's the effect of this bug and how you fixed it.


> Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
> ---
>  mm/kasan/kasan.c |    3 +--
>  1 files changed, 1 insertions(+), 2 deletions(-)
>
> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
> index 7b28e9c..8da2114 100644
> --- a/mm/kasan/kasan.c
> +++ b/mm/kasan/kasan.c
> @@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
>
>         if (unlikely(*shadow_addr)) {
>                 u16 shadow_first_bytes = *(u16 *)shadow_addr;
> -               s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
>
>                 if (unlikely(shadow_first_bytes))
>                         return true;
>
> -               if (likely(!last_byte))
> +               if (likely(IS_ALIGNED(addr, 8)))
>                         return false;
>
>                 return memory_is_poisoned_1(addr + 15);
> --
> 1.7.1
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1220664

FromXishi Qiu <qiuxishi@huawei.com>
Date2015-09-08 12:00 +0200
Message-ID<q6nR0-Fh-19@gated-at.bofh.it>
In reply to#1220639
On 2015/9/8 17:36, Andrey Ryabinin wrote:

> 2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>:
>> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
>> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
>> it calculates wrong, so fix it.
>>
> 
> Please, be more specific. Describe what is wrong with the current code and why,
> what's the effect of this bug and how you fixed it.
> 
> 

If the 16 bytes memory is aligned on 8, then the shadow takes only 2 bytes.
So we check "shadow_first_bytes" is enough, and need not to call "memory_is_poisoned_1(addr + 15);".
The code "if (likely(IS_ALIGNED(addr, 8)))" is wrong judgement.

e.g. addr=0, so last_byte = 15 & KASAN_SHADOW_MASK = 7, then the code will
continue to call "return memory_is_poisoned_1(addr + 15);"

Thanks,
Xishi Qiu

>> Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
>> ---
>>  mm/kasan/kasan.c |    3 +--
>>  1 files changed, 1 insertions(+), 2 deletions(-)
>>
>> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
>> index 7b28e9c..8da2114 100644
>> --- a/mm/kasan/kasan.c
>> +++ b/mm/kasan/kasan.c
>> @@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
>>
>>         if (unlikely(*shadow_addr)) {
>>                 u16 shadow_first_bytes = *(u16 *)shadow_addr;
>> -               s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
>>
>>                 if (unlikely(shadow_first_bytes))
>>                         return true;
>>
>> -               if (likely(!last_byte))
>> +               if (likely(IS_ALIGNED(addr, 8)))
>>                         return false;
>>
>>                 return memory_is_poisoned_1(addr + 15);
>> --
>> 1.7.1
>>
>>
> 
> .
> 



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1220672

FromXishi Qiu <qiuxishi@huawei.com>
Date2015-09-08 12:00 +0200
Message-ID<q6nR1-Fh-35@gated-at.bofh.it>
In reply to#1220664
On 2015/9/8 17:49, Xishi Qiu wrote:

> On 2015/9/8 17:36, Andrey Ryabinin wrote:
> 
>> 2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>:
>>> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
>>> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
>>> it calculates wrong, so fix it.
>>>
>>
>> Please, be more specific. Describe what is wrong with the current code and why,
>> what's the effect of this bug and how you fixed it.
>>
>>
> 
> If the 16 bytes memory is aligned on 8, then the shadow takes only 2 bytes.
> So we check "shadow_first_bytes" is enough, and need not to call "memory_is_poisoned_1(addr + 15);".
> The code "if (likely(IS_ALIGNED(addr, 8)))" is wrong judgement.

Sorry, a mistake, The code "if (likely(!last_byte))" is wrong judgement.

> e.g. addr=0, so last_byte = 15 & KASAN_SHADOW_MASK = 7, then the code will
> continue to call "return memory_is_poisoned_1(addr + 15);"
> 
> Thanks,
> Xishi Qiu
> 
>>> Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
>>> ---
>>>  mm/kasan/kasan.c |    3 +--
>>>  1 files changed, 1 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
>>> index 7b28e9c..8da2114 100644
>>> --- a/mm/kasan/kasan.c
>>> +++ b/mm/kasan/kasan.c
>>> @@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
>>>
>>>         if (unlikely(*shadow_addr)) {
>>>                 u16 shadow_first_bytes = *(u16 *)shadow_addr;
>>> -               s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
>>>
>>>                 if (unlikely(shadow_first_bytes))
>>>                         return true;
>>>
>>> -               if (likely(!last_byte))
>>> +               if (likely(IS_ALIGNED(addr, 8)))
>>>                         return false;
>>>
>>>                 return memory_is_poisoned_1(addr + 15);
>>> --
>>> 1.7.1
>>>
>>>
>>
>> .
>>
> 
> 



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]


#1220676

FromAndrey Ryabinin <ryabinin.a.a@gmail.com>
Date2015-09-08 12:10 +0200
Message-ID<q6o0G-15W-35@gated-at.bofh.it>
In reply to#1220672
2015-09-08 12:52 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>:
> On 2015/9/8 17:49, Xishi Qiu wrote:
>
>> On 2015/9/8 17:36, Andrey Ryabinin wrote:
>>
>>> 2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>:
>>>> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
>>>> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
>>>> it calculates wrong, so fix it.
>>>>
>>>
>>> Please, be more specific. Describe what is wrong with the current code and why,
>>> what's the effect of this bug and how you fixed it.
>>>
>>>
>>
>> If the 16 bytes memory is aligned on 8, then the shadow takes only 2 bytes.
>> So we check "shadow_first_bytes" is enough, and need not to call "memory_is_poisoned_1(addr + 15);".
>> The code "if (likely(IS_ALIGNED(addr, 8)))" is wrong judgement.
>
> Sorry, a mistake, The code "if (likely(!last_byte))" is wrong judgement.
>
>> e.g. addr=0, so last_byte = 15 & KASAN_SHADOW_MASK = 7, then the code will
>> continue to call "return memory_is_poisoned_1(addr + 15);"
>>

Right, put this into changelog please.

>> Thanks,
>> Xishi Qiu
>>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web