Re: [PATCH v4 1/2] kasan: detect negative size in memory operation function
From: Andrey Ryabinin <hidden>
Date: 2019-11-21 12:27:18
Also in:
linux-mediatek, linux-mm, lkml
On 11/12/19 9:53 AM, Walter Wu wrote:
quoted hunk ↗ jump to hunk
diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 6814d6d6a023..4bfce0af881f 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c@@ -102,7 +102,8 @@ EXPORT_SYMBOL(__kasan_check_write); #undef memset void *memset(void *addr, int c, size_t len) { - check_memory_region((unsigned long)addr, len, true, _RET_IP_); + if (!check_memory_region((unsigned long)addr, len, true, _RET_IP_)) + return NULL; return __memset(addr, c, len); }@@ -110,8 +111,9 @@ void *memset(void *addr, int c, size_t len) #undef memmove void *memmove(void *dest, const void *src, size_t len) { - check_memory_region((unsigned long)src, len, false, _RET_IP_); - check_memory_region((unsigned long)dest, len, true, _RET_IP_); + if (!check_memory_region((unsigned long)src, len, false, _RET_IP_) || + !check_memory_region((unsigned long)dest, len, true, _RET_IP_)) + return NULL; return __memmove(dest, src, len); }@@ -119,8 +121,9 @@ void *memmove(void *dest, const void *src, size_t len) #undef memcpy void *memcpy(void *dest, const void *src, size_t len) { - check_memory_region((unsigned long)src, len, false, _RET_IP_); - check_memory_region((unsigned long)dest, len, true, _RET_IP_); + if (!check_memory_region((unsigned long)src, len, false, _RET_IP_) || + !check_memory_region((unsigned long)dest, len, true, _RET_IP_)) + return NULL;
I realized that we are going a wrong direction here. Entirely skipping mem*() operation on any poisoned shadow value might only make things worse. Some bugs just don't have any serious consequences, but skipping the mem*() ops entirely might introduce such consequences, which wouldn't happen otherwise. So let's keep this code as this, no need to check the result of check_memory_region(). _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel