Qiliang Yuan <[email protected]> writes: > load_unaligned_zeropad() reads a word that may run into an unmapped > page and recovers through an exception fixup. It does the word loads of > sized_strscpy() and of the name compare in dentry_string_cmp(), path > components in hash_name() and hashlen_string(), and the trailing bytes > in x86's csum_partial(). > > It is inline assembly on every architecture that implements it, so > KASAN and KCSAN never see these loads, while read_word_at_a_time() at > least checks the first byte of each word. A use-after-free or > out-of-bounds read of a name handed to path lookup goes unreported, and > so does strscpy() reading from a bad source, which the kasan_strings > KUnit case expects to be reported. On x86_64 with generic KASAN: > > KASAN and string KUnit suites failures > before after > CONFIG_FORTIFY_SOURCE=n 1 0 > CONFIG_FORTIFY_SOURCE=y 1 0 > > Check the first byte with instrument_read() at the start of > load_unaligned_zeropad() on every architecture, as read_word_at_a_time() > does. All callers only load a word whose first byte belongs to the > string or buffer they read, so the check does not flag their intended > reads past the end. Add a no-op instrument_read() for the powerpc > selftest that builds the header in user space. > > Suggested-by: Peter Collingbourne <[email protected]> > Signed-off-by: Qiliang Yuan <[email protected]> > Reviewed-by: Marco Elver <[email protected]> > ---
Reviewed-by: Andrey Ryabinin <[email protected]>
