[PATCH 3/3] asm-generic: add KASAN instrumentation to atomic operations

From: Dmitry Vyukov
Date: Tue Mar 14 2017 - 15:25:20 EST

KASAN uses compiler instrumentation to intercept all memory accesses.
But it does not see memory accesses done in assembly code.
One notable user of assembly code is atomic operations. Frequently,
for example, an atomic reference decrement is the last access to an
object and a good candidate for a racy use-after-free.

Add manual KASAN checks to atomic operations.

Signed-off-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Mark Rutland <mark.rutland@xxxxxxx>
Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: Will Deacon <will.deacon@xxxxxxx>,
Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>,
Cc: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx>,
Cc: Ingo Molnar <mingo@xxxxxxxxxx>,
Cc: kasan-dev@xxxxxxxxxxxxxxxx
Cc: linux-mm@xxxxxxxxx
Cc: linux-kernel@xxxxxxxxxxxxxxx
Cc: x86@xxxxxxxxxx
---
include/asm-generic/atomic-instrumented.h | 36 +++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)

diff --git a/include/asm-generic/atomic-instrumented.h b/include/asm-generic/atomic-instrumented.h
index 41e5e6ffdfc8..951bcd083925 100644
--- a/include/asm-generic/atomic-instrumented.h
+++ b/include/asm-generic/atomic-instrumented.h
@@ -1,50 +1,72 @@
+/*
+ * This file provides wrappers with KASAN instrumentation for atomic operations.
+ * To use this functionality an arch's atomic.h file needs to define all
+ * atomic operations with arch_ prefix (e.g. arch_atomic_read()) and include
+ * this file at the end. This file provides atomic_read() that forwards to
+ * arch_atomic_read() for actual atomic operation.
+ * Note: if an arch atomic operation is implemented by means of other atomic
+ * operations (e.g. atomic_read()/atomic_cmpxchg() loop), then it needs to use
+ * arch_ variants (i.e. arch_atomic_read()/arch_atomic_cmpxchg()) to avoid
+ * double instrumentation.
+ */
#ifndef _LINUX_ATOMIC_INSTRUMENTED_H
#define _LINUX_ATOMIC_INSTRUMENTED_H

+#include <linux/kasan-checks.h>
+
static __always_inline int atomic_read(const atomic_t *v)
{
+ kasan_check_read(v, sizeof(*v));
return arch_atomic_read(v);
}

static __always_inline long long atomic64_read(const atomic64_t *v)
{
+ kasan_check_read(v, sizeof(*v));
return arch_atomic64_read(v);
}


static __always_inline void atomic_set(atomic_t *v, int i)
{
+ kasan_check_write(v, sizeof(*v));
arch_atomic_set(v, i);
}

static __always_inline void atomic64_set(atomic64_t *v, long long i)
{
+ kasan_check_write(v, sizeof(*v));
arch_atomic64_set(v, i);
}

static __always_inline int atomic_xchg(atomic_t *v, int i)
{
+ kasan_check_write(v, sizeof(*v));
return arch_atomic_xchg(v, i);
}

static __always_inline long long atomic64_xchg(atomic64_t *v, long long i)
{
+ kasan_check_write(v, sizeof(*v));
return arch_atomic64_xchg(v, i);
}

static __always_inline int atomic_cmpxchg(atomic_t *v, int old, int new)
{
+ kasan_check_write(v, sizeof(*v));
return arch_atomic_cmpxchg(v, old, new);
}

static __always_inline long long atomic64_cmpxchg(atomic64_t *v, long long old,
long long new)
{
+ kasan_check_write(v, sizeof(*v));
return arch_atomic64_cmpxchg(v, old, new);
}

static __always_inline int __atomic_add_unless(atomic_t *v, int a, int u)
{
+ kasan_check_write(v, sizeof(*v));
return __arch_atomic_add_unless(v, a, u);
}

@@ -52,17 +74,20 @@ static __always_inline int __atomic_add_unless(atomic_t *v, int a, int u)
static __always_inline bool atomic64_add_unless(atomic64_t *v, long long a,
long long u)
{
+ kasan_check_write(v, sizeof(*v));
return arch_atomic64_add_unless(v, a, u);
}

static __always_inline short int atomic_inc_short(short int *v)
{
+ kasan_check_write(v, sizeof(*v));
return arch_atomic_inc_short(v);
}

#define __INSTR_VOID1(op, sz) \
static __always_inline void atomic##sz##_##op(atomic##sz##_t *v) \
{ \
+ kasan_check_write(v, sizeof(*v)); \
arch_atomic##sz##_##op(v); \
}

@@ -79,6 +104,7 @@ INSTR_VOID1(dec);
#define __INSTR_VOID2(op, sz, type) \
static __always_inline void atomic##sz##_##op(type i, atomic##sz##_t *v)\
{ \
+ kasan_check_write(v, sizeof(*v)); \
arch_atomic##sz##_##op(i, v); \
}

@@ -98,6 +124,7 @@ INSTR_VOID2(xor);
#define __INSTR_RET1(op, sz, type, rtype) \
static __always_inline rtype atomic##sz##_##op(atomic##sz##_t *v) \
{ \
+ kasan_check_write(v, sizeof(*v)); \
return arch_atomic##sz##_##op(v); \
}

@@ -124,6 +151,7 @@ INSTR_RET_BOOL1(inc_and_test);
#define __INSTR_RET2(op, sz, type, rtype) \
static __always_inline rtype atomic##sz##_##op(type i, atomic##sz##_t *v) \
{ \
+ kasan_check_write(v, sizeof(*v)); \
return arch_atomic##sz##_##op(i, v); \
}

@@ -162,48 +190,56 @@ INSTR_RET_BOOL2(add_negative);
#define xchg(ptr, v) \
({ \
__typeof__(ptr) ____ptr = (ptr); \
+ kasan_check_write(____ptr, sizeof(*____ptr)); \
arch_xchg(____ptr, (v)); \
})

#define cmpxchg(ptr, old, new) \
({ \
__typeof__(ptr) ___ptr = (ptr); \
+ kasan_check_write(___ptr, sizeof(*___ptr)); \
arch_cmpxchg(___ptr, (old), (new)); \
})

#define sync_cmpxchg(ptr, old, new) \
({ \
__typeof__(ptr) ___ptr = (ptr); \
+ kasan_check_write(___ptr, sizeof(*___ptr)); \
arch_sync_cmpxchg(___ptr, (old), (new)); \
})

#define cmpxchg_local(ptr, old, new) \
({ \
__typeof__(ptr) ____ptr = (ptr); \
+ kasan_check_write(____ptr, sizeof(*____ptr)); \
arch_cmpxchg_local(____ptr, (old), (new)); \
})

#define cmpxchg64(ptr, old, new) \
({ \
__typeof__(ptr) ____ptr = (ptr); \
+ kasan_check_write(____ptr, sizeof(*____ptr)); \
arch_cmpxchg64(____ptr, (old), (new)); \
})

#define cmpxchg64_local(ptr, old, new) \
({ \
__typeof__(ptr) ____ptr = (ptr); \
+ kasan_check_write(____ptr, sizeof(*____ptr)); \
arch_cmpxchg64_local(____ptr, (old), (new)); \
})

#define cmpxchg_double(p1, p2, o1, o2, n1, n2) \
({ \
__typeof__(p1) ____p1 = (p1); \
+ kasan_check_write(____p1, 2 * sizeof(*____p1)); \
arch_cmpxchg_double(____p1, (p2), (o1), (o2), (n1), (n2)); \
})

#define cmpxchg_double_local(p1, p2, o1, o2, n1, n2) \
({ \
__typeof__(p1) ____p1 = (p1); \
+ kasan_check_write(____p1, 2 * sizeof(*____p1)); \
arch_cmpxchg_double_local(____p1, (p2), (o1), (o2), (n1), (n2));\
})

--
2.12.0.367.g23dc2f6d3c-goog