Wed Aug 22 17:04:36 2018 UTC ()
Explicitly unpoison the stack when entering a softint.

Softints are the only place where we "discard" a part of the stack: we may
have left the thread without allowing the asan instrumentation to clear
the poison, and in this case, we can get false positives when we hit a
poisoned area of the stack while executing another handler within the same
softint thread.

(I was actually getting a rare false positive in ip6intr.)


(maxv)
diff -r1.3 -r1.4 src/sys/arch/amd64/amd64/asan.c
diff -r1.35 -r1.36 src/sys/arch/amd64/amd64/spl.S
cvs diff -r1.3 -r1.4 src/sys/arch/amd64/amd64/Attic/asan.c (expand / switch to unified diff)

--- src/sys/arch/amd64/amd64/Attic/asan.c 2018/08/22 12:07:42 1.3
+++ src/sys/arch/amd64/amd64/Attic/asan.c 2018/08/22 17:04:36 1.4
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: asan.c,v 1.3 2018/08/22 12:07:42 maxv Exp $ */ 1/* $NetBSD: asan.c,v 1.4 2018/08/22 17:04:36 maxv Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 2018 The NetBSD Foundation, Inc. 4 * Copyright (c) 2018 The NetBSD Foundation, Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * This code is derived from software contributed to The NetBSD Foundation 7 * This code is derived from software contributed to The NetBSD Foundation
8 * by Maxime Villard, and Siddharth Muralee. 8 * by Maxime Villard, and Siddharth Muralee.
9 * 9 *
10 * Redistribution and use in source and binary forms, with or without 10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions 11 * modification, are permitted provided that the following conditions
12 * are met: 12 * are met:
13 * 1. Redistributions of source code must retain the above copyright 13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer. 14 * notice, this list of conditions and the following disclaimer.
@@ -20,27 +20,27 @@ @@ -20,27 +20,27 @@
20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 20 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 21 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 22 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 23 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE. 29 * POSSIBILITY OF SUCH DAMAGE.
30 */ 30 */
31 31
32#include <sys/cdefs.h> 32#include <sys/cdefs.h>
33__KERNEL_RCSID(0, "$NetBSD: asan.c,v 1.3 2018/08/22 12:07:42 maxv Exp $"); 33__KERNEL_RCSID(0, "$NetBSD: asan.c,v 1.4 2018/08/22 17:04:36 maxv Exp $");
34 34
35#include <sys/param.h> 35#include <sys/param.h>
36#include <sys/device.h> 36#include <sys/device.h>
37#include <sys/kernel.h> 37#include <sys/kernel.h>
38#include <sys/module.h> 38#include <sys/module.h>
39#include <sys/param.h> 39#include <sys/param.h>
40#include <sys/conf.h> 40#include <sys/conf.h>
41#include <sys/systm.h> 41#include <sys/systm.h>
42#include <sys/types.h> 42#include <sys/types.h>
43#include <sys/asan.h> 43#include <sys/asan.h>
44 44
45#include <uvm/uvm.h> 45#include <uvm/uvm.h>
46#include <amd64/pmap.h> 46#include <amd64/pmap.h>
@@ -49,26 +49,27 @@ __KERNEL_RCSID(0, "$NetBSD: asan.c,v 1.3 @@ -49,26 +49,27 @@ __KERNEL_RCSID(0, "$NetBSD: asan.c,v 1.3
49#define VIRTUAL_SHIFT 47 /* 48bit address space, cut half */ 49#define VIRTUAL_SHIFT 47 /* 48bit address space, cut half */
50#define CANONICAL_BASE 0xFFFF800000000000 50#define CANONICAL_BASE 0xFFFF800000000000
51 51
52#define KASAN_SHADOW_SCALE_SHIFT 3 52#define KASAN_SHADOW_SCALE_SHIFT 3
53#define KASAN_SHADOW_SCALE_SIZE (1UL << KASAN_SHADOW_SCALE_SHIFT) 53#define KASAN_SHADOW_SCALE_SIZE (1UL << KASAN_SHADOW_SCALE_SHIFT)
54#define KASAN_SHADOW_MASK (KASAN_SHADOW_SCALE_SIZE - 1) 54#define KASAN_SHADOW_MASK (KASAN_SHADOW_SCALE_SIZE - 1)
55 55
56#define KASAN_SHADOW_SIZE (1ULL << (VIRTUAL_SHIFT - KASAN_SHADOW_SCALE_SHIFT)) 56#define KASAN_SHADOW_SIZE (1ULL << (VIRTUAL_SHIFT - KASAN_SHADOW_SCALE_SHIFT))
57#define KASAN_SHADOW_START (VA_SIGN_NEG((L4_SLOT_KASAN * NBPD_L4))) 57#define KASAN_SHADOW_START (VA_SIGN_NEG((L4_SLOT_KASAN * NBPD_L4)))
58#define KASAN_SHADOW_END (KASAN_SHADOW_START + KASAN_SHADOW_SIZE) 58#define KASAN_SHADOW_END (KASAN_SHADOW_START + KASAN_SHADOW_SIZE)
59 59
60#define __RET_ADDR (unsigned long)__builtin_return_address(0) 60#define __RET_ADDR (unsigned long)__builtin_return_address(0)
61 61
 62void kasan_softint(struct lwp *);
62void kasan_shadow_map(void *, size_t); 63void kasan_shadow_map(void *, size_t);
63void kasan_early_init(void); 64void kasan_early_init(void);
64void kasan_init(void); 65void kasan_init(void);
65 66
66static bool kasan_enabled __read_mostly = false; 67static bool kasan_enabled __read_mostly = false;
67 68
68static inline int8_t *kasan_addr_to_shad(const void *addr) 69static inline int8_t *kasan_addr_to_shad(const void *addr)
69{ 70{
70 vaddr_t va = (vaddr_t)addr; 71 vaddr_t va = (vaddr_t)addr;
71 return (int8_t *)(KASAN_SHADOW_START + 72 return (int8_t *)(KASAN_SHADOW_START +
72 ((va - CANONICAL_BASE) >> KASAN_SHADOW_SCALE_SHIFT)); 73 ((va - CANONICAL_BASE) >> KASAN_SHADOW_SCALE_SHIFT));
73} 74}
74 75
@@ -313,26 +314,34 @@ kasan_markmem(const void *addr, size_t s @@ -313,26 +314,34 @@ kasan_markmem(const void *addr, size_t s
313 KASSERT((vaddr_t)addr % KASAN_SHADOW_SCALE_SIZE == 0); 314 KASSERT((vaddr_t)addr % KASAN_SHADOW_SCALE_SIZE == 0);
314 315
315 if (valid) { 316 if (valid) {
316 for (i = 0; i < size; i++) { 317 for (i = 0; i < size; i++) {
317 kasan_shadow_1byte_markvalid((unsigned long)addr+i); 318 kasan_shadow_1byte_markvalid((unsigned long)addr+i);
318 } 319 }
319 } else { 320 } else {
320 KASSERT(size % KASAN_SHADOW_SCALE_SIZE == 0); 321 KASSERT(size % KASAN_SHADOW_SCALE_SIZE == 0);
321 kasan_shadow_fill(addr, size, KASAN_MEMORY_REDZONE); 322 kasan_shadow_fill(addr, size, KASAN_MEMORY_REDZONE);
322 } 323 }
323} 324}
324 325
325void 326void
 327kasan_softint(struct lwp *l)
 328{
 329 const void *stk = (const void *)uvm_lwp_getuarea(l);
 330
 331 kasan_shadow_fill(stk, USPACE, 0);
 332}
 333
 334void
326kasan_alloc(const void *addr, size_t size, size_t sz_with_redz) 335kasan_alloc(const void *addr, size_t size, size_t sz_with_redz)
327{ 336{
328 kasan_markmem(addr, sz_with_redz, false); 337 kasan_markmem(addr, sz_with_redz, false);
329 kasan_markmem(addr, size, true); 338 kasan_markmem(addr, size, true);
330} 339}
331 340
332void 341void
333kasan_free(const void *addr, size_t sz_with_redz) 342kasan_free(const void *addr, size_t sz_with_redz)
334{ 343{
335 kasan_markmem(addr, sz_with_redz, true); 344 kasan_markmem(addr, sz_with_redz, true);
336} 345}
337 346
338/* -------------------------------------------------------------------------- */ 347/* -------------------------------------------------------------------------- */
cvs diff -r1.35 -r1.36 src/sys/arch/amd64/amd64/spl.S (expand / switch to unified diff)

--- src/sys/arch/amd64/amd64/spl.S 2018/07/14 14:29:40 1.35
+++ src/sys/arch/amd64/amd64/spl.S 2018/08/22 17:04:36 1.36
@@ -1,14 +1,14 @@ @@ -1,14 +1,14 @@
1/* $NetBSD: spl.S,v 1.35 2018/07/14 14:29:40 maxv Exp $ */ 1/* $NetBSD: spl.S,v 1.36 2018/08/22 17:04:36 maxv Exp $ */
2 2
3/* 3/*
4 * Copyright (c) 2003 Wasabi Systems, Inc. 4 * Copyright (c) 2003 Wasabi Systems, Inc.
5 * All rights reserved. 5 * All rights reserved.
6 * 6 *
7 * Written by Frank van der Linden for Wasabi Systems, Inc. 7 * Written by Frank van der Linden for Wasabi Systems, Inc.
8 * 8 *
9 * Redistribution and use in source and binary forms, with or without 9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions 10 * modification, are permitted provided that the following conditions
11 * are met: 11 * are met:
12 * 1. Redistributions of source code must retain the above copyright 12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer. 13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright 14 * 2. Redistributions in binary form must reproduce the above copyright
@@ -55,26 +55,27 @@ @@ -55,26 +55,27 @@
55 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 55 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
57 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 57 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
58 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 58 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
59 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 59 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
60 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 60 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
61 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 61 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
62 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 62 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
63 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 63 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
64 * POSSIBILITY OF SUCH DAMAGE. 64 * POSSIBILITY OF SUCH DAMAGE.
65 */ 65 */
66 66
67#include "opt_ddb.h" 67#include "opt_ddb.h"
 68#include "opt_kasan.h"
68 69
69#define ALIGN_TEXT .align 16,0x90 70#define ALIGN_TEXT .align 16,0x90
70 71
71#include <machine/asm.h> 72#include <machine/asm.h>
72#include <machine/trap.h> 73#include <machine/trap.h>
73#include <machine/segments.h> 74#include <machine/segments.h>
74#include <machine/frameasm.h> 75#include <machine/frameasm.h>
75 76
76#include "assym.h" 77#include "assym.h"
77 78
78 .text 79 .text
79 80
80#ifndef XEN 81#ifndef XEN
@@ -95,26 +96,37 @@ IDTVEC(softintr) @@ -95,26 +96,37 @@ IDTVEC(softintr)
95 pushq %rbx 96 pushq %rbx
96 pushq %r12 97 pushq %r12
97 pushq %r13 98 pushq %r13
98 pushq %r14 99 pushq %r14
99 pushq %r15 100 pushq %r15
100 101
101 movl $IPL_HIGH,CPUVAR(ILEVEL) 102 movl $IPL_HIGH,CPUVAR(ILEVEL)
102 movq CPUVAR(CURLWP),%r15 103 movq CPUVAR(CURLWP),%r15
103 movq IS_LWP(%rax),%rdi /* switch to handler LWP */ 104 movq IS_LWP(%rax),%rdi /* switch to handler LWP */
104 movq L_PCB(%rdi),%rdx 105 movq L_PCB(%rdi),%rdx
105 movq L_PCB(%r15),%rcx 106 movq L_PCB(%r15),%rcx
106 movq %rdi,CPUVAR(CURLWP) 107 movq %rdi,CPUVAR(CURLWP)
107 108
 109#ifdef KASAN
 110 /* clear the new stack */
 111 pushq %rax
 112 pushq %rdx
 113 pushq %rcx
 114 callq _C_LABEL(kasan_softint)
 115 popq %rcx
 116 popq %rdx
 117 popq %rax
 118#endif
 119
108 /* save old context */ 120 /* save old context */
109 movq %rsp,PCB_RSP(%rcx) 121 movq %rsp,PCB_RSP(%rcx)
110 movq %rbp,PCB_RBP(%rcx) 122 movq %rbp,PCB_RBP(%rcx)
111 123
112 /* switch to the new stack */ 124 /* switch to the new stack */
113 movq PCB_RSP0(%rdx),%rsp 125 movq PCB_RSP0(%rdx),%rsp
114 126
115 /* dispatch */ 127 /* dispatch */
116 sti 128 sti
117 movq %r15,%rdi /* interrupted LWP */ 129 movq %r15,%rdi /* interrupted LWP */
118 movl IS_MAXLEVEL(%rax),%esi /* ipl to run at */ 130 movl IS_MAXLEVEL(%rax),%esi /* ipl to run at */
119 call _C_LABEL(softint_dispatch)/* run handlers */ 131 call _C_LABEL(softint_dispatch)/* run handlers */
120 cli 132 cli