Commit ed95f95c authored Feb 05, 2020 by Marco Elver Committed by Ingo Molnar Mar 21, 2020

kcsan: Fix 0-sized checks



Instrumentation of arbitrary memory-copy functions, such as user-copies,
may be called with size of 0, which could lead to false positives.

To avoid this, add a comparison in check_access() for size==0, which
will be optimized out for constant sized instrumentation
(__tsan_{read,write}N), and therefore not affect the common-case
fast-path.

Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Ingo Molnar <mingo@kernel.org>

parent 8cfbb04f

kernel/kcsan/core.c

+7 −0

Original line number	Diff line number	Diff line
		@@ -455,6 +455,13 @@ static __always_inline void check_access(const volatile void *ptr, size_t size,
		atomic_long_t *watchpoint;
		long encoded_watchpoint;

		/*
		* Do nothing for 0 sized check; this comparison will be optimized out
		* for constant sized instrumentation (__tsan_{read,write}N).
		*/
		if (unlikely(size == 0))
		return;

		/*
		* Avoid user_access_save in fast-path: find_watchpoint is safe without
		* user_access_save, as the address that ptr points to is only used to

kernel/kcsan/test.c

+10 −0

Original line number	Diff line number	Diff line
		@@ -92,6 +92,16 @@ static bool test_matching_access(void)
		return false;
		if (WARN_ON(matching_access(9, 1, 10, 1)))
		return false;

		/*
		* An access of size 0 could match another access, as demonstrated here.
		* Rather than add more comparisons to 'matching_access()', which would
		* end up in the fast-path for all checks, check_access() simply
		* returns for all accesses of size 0.
		*/
		if (WARN_ON(!matching_access(8, 8, 12, 0)))
		return false;

		return true;
		}