Page MenuHomeFreeBSD

KASAN: Disable the sanitizer in stack_capture()
ClosedPublic

Authored by markj on May 5 2021, 2:44 PM.
Tags
None
Referenced Files
Unknown Object (File)
Sep 26 2024, 9:05 PM
Unknown Object (File)
Sep 26 2024, 3:17 PM
Unknown Object (File)
Sep 24 2024, 4:43 AM
Unknown Object (File)
Sep 24 2024, 4:27 AM
Unknown Object (File)
Sep 20 2024, 8:03 AM
Unknown Object (File)
Sep 13 2024, 4:55 AM
Unknown Object (File)
Sep 2 2024, 11:52 PM
Unknown Object (File)
Sep 2 2024, 6:08 AM
Subscribers

Details

Summary

When unwinding the stack we may descend into a poisoned region of the
kernel stack. I don't see a good way to handle this except to disable
the sanitizer entirely.

Define __nosanitizeaddress depending on whether we're in the kernel or
not, since KASAN and ASAN require different attributes. Add
__nosanitizememory while I'm here.

A further complication is that clang raises an error if
no_sanitize("kernel-address") is applied to a global variable rather
than a function:

error: 'no_sanitize' attribute only applies to functions and methods

So, modify linker_set.h to apply the attribute only if we're not in the
kernel.

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj requested review of this revision.May 5 2021, 2:44 PM
sys/x86/x86/stack_machdep.c
73 ↗(On Diff #88683)

I have no idea what is going on there, but don't all called functions require the same handling, e.g. stack_zero? Is it happen to work because struct stack itself is 'not poisoned'?

sys/x86/x86/stack_machdep.c
73 ↗(On Diff #88683)

stack_zero() is fine, it's the inline dereference of the frame pointer that potentially causes problems.

Mostly on principle "I do not see anything wrong"

This revision is now accepted and ready to land.May 5 2021, 8:02 PM