[PATCH] kasan:fix access invalid shadow address when input is illegal

[Andrey Konovalov]

On Thu, Sep 14, 2023 at 10:08 AM 'Haibo Li' via kasan-dev
<kasan-dev at googlegroups.com> wrote:
>
> when the input address is illegal,the corresponding shadow address
> from kasan_mem_to_shadow may have no mapping in mmu table.
> Access such shadow address causes kernel oops.
> Here is a sample about oops on arm64(VA 39bit) with KASAN_SW_TAGS on:
>
> [ffffffb80aaaaaaa] pgd=000000005d3ce003, p4d=000000005d3ce003,
>     pud=000000005d3ce003, pmd=0000000000000000
> Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP
> Modules linked in:
> CPU: 3 PID: 100 Comm: sh Not tainted 6.6.0-rc1-dirty #43
> Hardware name: linux,dummy-virt (DT)
> pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : __hwasan_load8_noabort+0x5c/0x90
> lr : do_ib_ob+0xf4/0x110
> ffffffb80aaaaaaa is the shadow address for efffff80aaaaaaaa.
> The problem is reading invalid shadow in kasan_check_range.
>
> The generic kasan also has similar oops.
>
> To fix it,check shadow address by reading it with no fault.
>
> After this patch,KASAN is able to report invalid memory access
> for this case.

Hi Haibo,

I thought this should be covered by the kasan_non_canonical_hook
handler, which prints some additional information about how the GPF
could be caused by accessing shadow memory.

Does it not work in your case? It might be that we need to add
kasan_non_canonical_hook to some other arm64 internal fault handler
functions then.

Thanks!