Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1220446 > unrolled thread
| Started by | Xishi Qiu <qiuxishi@huawei.com> |
|---|---|
| First post | 2015-09-08 03:50 +0200 |
| Last post | 2015-09-08 12:10 +0200 |
| Articles | 5 — 2 participants |
Back to article view | Back to linux.kernel
[PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Xishi Qiu <qiuxishi@huawei.com> - 2015-09-08 03:50 +0200
Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-09-08 11:40 +0200
Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Xishi Qiu <qiuxishi@huawei.com> - 2015-09-08 12:00 +0200
Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Xishi Qiu <qiuxishi@huawei.com> - 2015-09-08 12:00 +0200
Re: [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() Andrey Ryabinin <ryabinin.a.a@gmail.com> - 2015-09-08 12:10 +0200
| From | Xishi Qiu <qiuxishi@huawei.com> |
|---|---|
| Date | 2015-09-08 03:50 +0200 |
| Subject | [PATCH] kasan: fix last shadow judgement in memory_is_poisoned_16() |
| Message-ID | <q6gcN-6wG-5@gated-at.bofh.it> |
The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
it calculates wrong, so fix it.
Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
---
mm/kasan/kasan.c | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
index 7b28e9c..8da2114 100644
--- a/mm/kasan/kasan.c
+++ b/mm/kasan/kasan.c
@@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
if (unlikely(*shadow_addr)) {
u16 shadow_first_bytes = *(u16 *)shadow_addr;
- s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
if (unlikely(shadow_first_bytes))
return true;
- if (likely(!last_byte))
+ if (likely(IS_ALIGNED(addr, 8)))
return false;
return memory_is_poisoned_1(addr + 15);
--
1.7.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [next] | [standalone]
| From | Andrey Ryabinin <ryabinin.a.a@gmail.com> |
|---|---|
| Date | 2015-09-08 11:40 +0200 |
| Message-ID | <q6nxD-ij-3@gated-at.bofh.it> |
| In reply to | #1220446 |
2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>:
> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
> it calculates wrong, so fix it.
>
Please, be more specific. Describe what is wrong with the current code and why,
what's the effect of this bug and how you fixed it.
> Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
> ---
> mm/kasan/kasan.c | 3 +--
> 1 files changed, 1 insertions(+), 2 deletions(-)
>
> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
> index 7b28e9c..8da2114 100644
> --- a/mm/kasan/kasan.c
> +++ b/mm/kasan/kasan.c
> @@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
>
> if (unlikely(*shadow_addr)) {
> u16 shadow_first_bytes = *(u16 *)shadow_addr;
> - s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
>
> if (unlikely(shadow_first_bytes))
> return true;
>
> - if (likely(!last_byte))
> + if (likely(IS_ALIGNED(addr, 8)))
> return false;
>
> return memory_is_poisoned_1(addr + 15);
> --
> 1.7.1
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Xishi Qiu <qiuxishi@huawei.com> |
|---|---|
| Date | 2015-09-08 12:00 +0200 |
| Message-ID | <q6nR0-Fh-19@gated-at.bofh.it> |
| In reply to | #1220639 |
On 2015/9/8 17:36, Andrey Ryabinin wrote:
> 2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>:
>> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
>> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
>> it calculates wrong, so fix it.
>>
>
> Please, be more specific. Describe what is wrong with the current code and why,
> what's the effect of this bug and how you fixed it.
>
>
If the 16 bytes memory is aligned on 8, then the shadow takes only 2 bytes.
So we check "shadow_first_bytes" is enough, and need not to call "memory_is_poisoned_1(addr + 15);".
The code "if (likely(IS_ALIGNED(addr, 8)))" is wrong judgement.
e.g. addr=0, so last_byte = 15 & KASAN_SHADOW_MASK = 7, then the code will
continue to call "return memory_is_poisoned_1(addr + 15);"
Thanks,
Xishi Qiu
>> Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
>> ---
>> mm/kasan/kasan.c | 3 +--
>> 1 files changed, 1 insertions(+), 2 deletions(-)
>>
>> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
>> index 7b28e9c..8da2114 100644
>> --- a/mm/kasan/kasan.c
>> +++ b/mm/kasan/kasan.c
>> @@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
>>
>> if (unlikely(*shadow_addr)) {
>> u16 shadow_first_bytes = *(u16 *)shadow_addr;
>> - s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
>>
>> if (unlikely(shadow_first_bytes))
>> return true;
>>
>> - if (likely(!last_byte))
>> + if (likely(IS_ALIGNED(addr, 8)))
>> return false;
>>
>> return memory_is_poisoned_1(addr + 15);
>> --
>> 1.7.1
>>
>>
>
> .
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Xishi Qiu <qiuxishi@huawei.com> |
|---|---|
| Date | 2015-09-08 12:00 +0200 |
| Message-ID | <q6nR1-Fh-35@gated-at.bofh.it> |
| In reply to | #1220664 |
On 2015/9/8 17:49, Xishi Qiu wrote:
> On 2015/9/8 17:36, Andrey Ryabinin wrote:
>
>> 2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>:
>>> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow
>>> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but
>>> it calculates wrong, so fix it.
>>>
>>
>> Please, be more specific. Describe what is wrong with the current code and why,
>> what's the effect of this bug and how you fixed it.
>>
>>
>
> If the 16 bytes memory is aligned on 8, then the shadow takes only 2 bytes.
> So we check "shadow_first_bytes" is enough, and need not to call "memory_is_poisoned_1(addr + 15);".
> The code "if (likely(IS_ALIGNED(addr, 8)))" is wrong judgement.
Sorry, a mistake, The code "if (likely(!last_byte))" is wrong judgement.
> e.g. addr=0, so last_byte = 15 & KASAN_SHADOW_MASK = 7, then the code will
> continue to call "return memory_is_poisoned_1(addr + 15);"
>
> Thanks,
> Xishi Qiu
>
>>> Signed-off-by: Xishi Qiu <qiuxishi@huawei.com>
>>> ---
>>> mm/kasan/kasan.c | 3 +--
>>> 1 files changed, 1 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c
>>> index 7b28e9c..8da2114 100644
>>> --- a/mm/kasan/kasan.c
>>> +++ b/mm/kasan/kasan.c
>>> @@ -135,12 +135,11 @@ static __always_inline bool memory_is_poisoned_16(unsigned long addr)
>>>
>>> if (unlikely(*shadow_addr)) {
>>> u16 shadow_first_bytes = *(u16 *)shadow_addr;
>>> - s8 last_byte = (addr + 15) & KASAN_SHADOW_MASK;
>>>
>>> if (unlikely(shadow_first_bytes))
>>> return true;
>>>
>>> - if (likely(!last_byte))
>>> + if (likely(IS_ALIGNED(addr, 8)))
>>> return false;
>>>
>>> return memory_is_poisoned_1(addr + 15);
>>> --
>>> 1.7.1
>>>
>>>
>>
>> .
>>
>
>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [next] | [standalone]
| From | Andrey Ryabinin <ryabinin.a.a@gmail.com> |
|---|---|
| Date | 2015-09-08 12:10 +0200 |
| Message-ID | <q6o0G-15W-35@gated-at.bofh.it> |
| In reply to | #1220672 |
2015-09-08 12:52 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>: > On 2015/9/8 17:49, Xishi Qiu wrote: > >> On 2015/9/8 17:36, Andrey Ryabinin wrote: >> >>> 2015-09-08 4:42 GMT+03:00 Xishi Qiu <qiuxishi@huawei.com>: >>>> The shadow which correspond 16 bytes may span 2 or 3 bytes. If shadow >>>> only take 2 bytes, we can return in "if (likely(!last_byte)) ...", but >>>> it calculates wrong, so fix it. >>>> >>> >>> Please, be more specific. Describe what is wrong with the current code and why, >>> what's the effect of this bug and how you fixed it. >>> >>> >> >> If the 16 bytes memory is aligned on 8, then the shadow takes only 2 bytes. >> So we check "shadow_first_bytes" is enough, and need not to call "memory_is_poisoned_1(addr + 15);". >> The code "if (likely(IS_ALIGNED(addr, 8)))" is wrong judgement. > > Sorry, a mistake, The code "if (likely(!last_byte))" is wrong judgement. > >> e.g. addr=0, so last_byte = 15 & KASAN_SHADOW_MASK = 7, then the code will >> continue to call "return memory_is_poisoned_1(addr + 15);" >> Right, put this into changelog please. >> Thanks, >> Xishi Qiu >> -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web