{"action":"closed","issue":{"url":"https://api.github.com/repos/google/kasan/issues/28","labels_url":"https://api.github.com/repos/google/kasan/issues/28/labels{/name}","comments_url":"https://api.github.com/repos/google/kasan/issues/28/comments","events_url":"https://api.github.com/repos/google/kasan/issues/28/events","html_url":"https://github.com/google/kasan/issues/28","id":55482613,"number":28,"title":"Bogus reports about wild memory accesses.","user":{"login":"aryabinin","id":1099158,"avatar_url":"https://avatars.githubusercontent.com/u/1099158?v=3","gravatar_id":"","url":"https://api.github.com/users/aryabinin","html_url":"https://github.com/aryabinin","followers_url":"https://api.github.com/users/aryabinin/followers","following_url":"https://api.github.com/users/aryabinin/following{/other_user}","gists_url":"https://api.github.com/users/aryabinin/gists{/gist_id}","starred_url":"https://api.github.com/users/aryabinin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aryabinin/subscriptions","organizations_url":"https://api.github.com/users/aryabinin/orgs","repos_url":"https://api.github.com/users/aryabinin/repos","events_url":"https://api.github.com/users/aryabinin/events{/privacy}","received_events_url":"https://api.github.com/users/aryabinin/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-26T13:35:24Z","updated_at":"2015-09-01T11:35:39Z","closed_at":"2015-09-01T11:35:39Z","body":"We poison shadow memory to catch accesses to shadow outside of kasan code.\r\nBut with globals instrumentation there is possibility of valid accesses to shadow memory in non-kasan code. The code in question is vfree(). \r\nWe call vfree() from kasan_module_free() to free shadow memory backing module's memory.\r\nIf module_free() was executed in interrupt context than vfree() could access freeing memory. So it's shadow memory in our case:\r\n\r\nvoid vfree(const void *addr)\r\n{\r\n.....\r\n\tif (unlikely(in_interrupt())) {\r\n\t\tstruct vfree_deferred *p = this_cpu_ptr(&vfree_deferred);\r\n\t\tif (llist_add((struct llist_node *)addr, &p->list))        <---- access to shadow memory\r\n\t\t\tschedule_work(&p->wq);\r\n.....\r\n}\r\n\r\nThis causes report like this:\r\n\r\n[   20.476443] ==================================================================\r\n[   20.476465] BUG: AddressSanitizer: wild memory access in llist_add_batch+0xa7/0xe0 at addr fffffbfff40dc000\r\n[   20.476467] Write of size 8 by task modprobe/658\r\n[   20.476474] CPU: 0 PID: 658 Comm: modprobe Not tainted 3.19.0-rc5+ #164\r\n[   20.476477] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014\r\n[   20.476482]  fffffbfff40dc000 ffff88006d007c58 ffffffff82101040 0000000000000024\r\n[   20.476486]  0000000000000001 ffff88006d007cf8 ffffffff8154012c ffff88006d01a6b0\r\n[   20.476488]  ffff88006d01ea00 ffff88006d01a698 0000000000000296 ffff88006d007ca8\r\n[   20.476490] Call Trace:\r\n[   20.476491]  <IRQ>  [<ffffffff82101040>] dump_stack+0x45/0x57\r\n[   20.476507]  [<ffffffff8154012c>] kasan_report_error+0x63c/0x9c0\r\n[   20.476516]  [<ffffffff811dc309>] ? wake_up_process+0x49/0x80\r\n[   20.476521]  [<ffffffff811795c4>] ? insert_work+0x2d4/0x540\r\n[   20.476524]  [<ffffffff81540911>] __asan_report_store8_noabort+0x61/0x80\r\n[   20.476527]  [<ffffffff818abf07>] ? llist_add_batch+0xa7/0xe0\r\n[   20.476529]  [<ffffffff818abf07>] llist_add_batch+0xa7/0xe0\r\n[   20.476535]  [<ffffffff814fac8a>] vfree+0x6a/0xc0\r\n[   20.476537]  [<ffffffff814facc1>] ? vfree+0xa1/0xc0\r\n[   20.476539]  [<ffffffff8153faea>] kasan_module_free+0x1a/0x20\r\n[   20.476545]  [<ffffffff812d4afe>] module_memfree+0x1e/0x30\r\n[   20.476547]  [<ffffffff812d4b50>] do_free_init+0x40/0x80\r\n[   20.476554]  [<ffffffff81275ed9>] rcu_process_callbacks+0x5e9/0x2250\r\n[   20.476560]  [<ffffffff81131228>] __do_softirq+0x178/0x890\r\n[   20.476564]  [<ffffffff81131add>] irq_exit+0x8d/0xc0\r\n\r\n.....\r\n[   20.476759] Memory state around the buggy address:\r\n[   20.476766]  fffffbfff40dbf00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.476768]  fffffbfff40dbf80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.476771] >fffffbfff40dc000: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.476773]                    ^\r\n[   20.476775]  fffffbfff40dc080: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.476778]  fffffbfff40dc100: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.476779] ==================================================================\r\n\r\nAnd latter, this one:\r\n\r\n[   20.477198] ==================================================================\r\n[   20.477203] BUG: AddressSanitizer: wild memory access in free_work+0x84/0x90 at addr fffffbfff40dc000\r\n[   20.477204] Read of size 8 by task kworker/0:1/36\r\n[   20.477207] CPU: 0 PID: 36 Comm: kworker/0:1 Not tainted 3.19.0-rc5+ #164\r\n[   20.477208] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014\r\n[   20.477211] Workqueue: events free_work\r\n[   20.477213]  dffffc0000000000 ffff88006c0ffbe8 ffffffff82101040 0000000000000025\r\n[   20.477215]  0000000000000000 ffff88006c0ffc88 ffffffff8154012c ffffffff8400d758\r\n[   20.477217]  0000000000000092 ffff88006c0ffcf8 0000000000000296 000000007c1e7048\r\n[   20.477220] Call Trace:\r\n[   20.477225]  [<ffffffff82101040>] dump_stack+0x45/0x57\r\n[   20.477229]  [<ffffffff8154012c>] kasan_report_error+0x63c/0x9c0\r\n[   20.477240]  [<ffffffff818c3410>] ? __debug_check_no_obj_freed+0xe90/0xe90\r\n[   20.477244]  [<ffffffff81540691>] __asan_report_load8_noabort+0x61/0x80\r\n[   20.477248]  [<ffffffff814fac14>] ? free_work+0x84/0x90\r\n[   20.477252]  [<ffffffff814fac14>] free_work+0x84/0x90\r\n[   20.477256]  [<ffffffff81186352>] process_one_work+0x9e2/0x1fd0\r\n[   20.477261]  [<ffffffff81187f85>] worker_thread+0x645/0x2090\r\n[   20.477265]  [<ffffffff81187940>] ? process_one_work+0x1fd0/0x1fd0\r\n[   20.477269]  [<ffffffff8119ebdd>] kthread+0x22d/0x380\r\n[   20.477273]  [<ffffffff8119e9b0>] ? kthread_worker_fn+0x6f0/0x6f0\r\n[   20.477278]  [<ffffffff811d45eb>] ? schedule_tail+0x1b/0x3e0\r\n[   20.477282]  [<ffffffff8119e9b0>] ? kthread_worker_fn+0x6f0/0x6f0\r\n[   20.477286]  [<ffffffff82113afc>] ret_from_fork+0x7c/0xb0\r\n[   20.477290]  [<ffffffff8119e9b0>] ? kthread_worker_fn+0x6f0/0x6f0\r\n[   20.477292] Memory state around the buggy address:\r\n[   20.477299]  fffffbfff40dbf00: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.477302]  fffffbfff40dbf80: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.477305] >fffffbfff40dc000: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.477306]                    ^\r\n[   20.477309]  fffffbfff40dc080: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.477311]  fffffbfff40dc100: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9\r\n[   20.477313] ==================================================================\r\n\r\nI see couple ways to fix this:\r\n1) Just unpoison shadow memory\r\n2) Poison shadow memory but unpoison shadow memory for modules\r\n3) Shut up kasan  with kasan_disable_local()/kasan_enable_local() in kasan_module_free() and free_work()\r\n\r\nI think that the first option is the best.\r\nIt's the most simple solution. Also we could use kasan_poisoned_page as zero page, so we could get rid of kasan_zero_pte/pmd/pud, so this will save us 12K.  \r\n\r\nI don't like 2) because this will bring more complexity into arch/x86/mm/kasan_init_64.c code.\r\n\r\nI'm strongly against 3), because it looks ugly.\r\n\r\nThoughts, suggestions?\r\n\r\n\r\n"}}