https://github.com/google/kmsan

sort by:
Revision Author Date Message Commit Date
2dca2cb kmsan: fix build warnings with CONFIG_KMSAN=n 28 August 2018, 14:33:29 UTC
f66a112 kmsan: mention CONFIG_DRM_AMD_DC in README.md 28 August 2018, 14:25:08 UTC
206ace4 net-UPSTREAM: bpf: fix build error with clang Building the newly introduced BPF_PROG_TYPE_SK_REUSEPORT leads to a compile time error when building with clang: net/core/filter.o: In function `sk_reuseport_convert_ctx_access': ../net/core/filter.c:7284: undefined reference to `__compiletime_assert_7284' It seems that clang has issues resolving hweight_long at compile time. Since SK_FL_PROTO_MASK is a constant, we can use the interface for known constant arguments which works fine with clang. Fixes: 2dbb9b9e6df6 ("bpf: Introduce BPF_PROG_TYPE_SK_REUSEPORT") Signed-off-by: Stefan Agner <stefan@agner.ch> 28 August 2018, 11:56:43 UTC
2cb969a kmsan: don't use |pc| passed to __msan_poison_alloca() It should be simpler to just get the necessary number of alloca stack frames in __msan_poison_alloca(). Right now we store only the return address of __msan_poison_alloca() and the caller, for which we need kmsan_internal_return_address(). 28 August 2018, 11:10:12 UTC
0a28b4d kmsan: fix put_user() instrumentation 28 August 2018, 11:10:12 UTC
649ea75 kmsan: instrument get_user() and put_user() properly 28 August 2018, 11:10:12 UTC
7590a91 kmsan: update LLVM/Clang patches to r339138 28 August 2018, 11:10:12 UTC
93ec5c5 kmsan: update LLVM/Clang patches to r337583. 28 August 2018, 11:10:11 UTC
7c00d72 kmsan: fix CONFIG_KMSAN=n build 28 August 2018, 11:10:11 UTC
f3448d7 kmsan: drop unused functions that copy shadow and origins around 28 August 2018, 11:10:11 UTC
3190bbd kmsan: rename __msan_warning_32() to __msan_warning() Keep the old name around till the compiler updates. 28 August 2018, 11:10:11 UTC
ec17d5e kmsan: unpoison the buffer in snd_pcm_oss_change_params_locked() 28 August 2018, 11:10:11 UTC
1478894 kmsan: speculatively unpoison output buffer in snd_pcm_plugin_alloc() Doing so to avoid false positive reports. A better solution would be to find the actual place where the data is copied from the sound card to the buffer. 28 August 2018, 11:10:11 UTC
943d0aa kmsan: implement kmsan_memmove_shadow() and kmsan_memmove_origins() We've seen false report being caused by memmove() copying the metadata incorrectly for overlapping regions. 28 August 2018, 11:10:11 UTC
040badd kmsan: disable asm-goto This is a temporary workaround for e501ce957a78 ("x86: Force asm-goto") Reverting all the patches corresponding to asm-goto is getting more and more painful. 28 August 2018, 11:10:11 UTC
ae26eeb kmsan: disable strscpy() optimization under KMSAN 28 August 2018, 11:10:11 UTC
68b9b89 kmsan: delete some dead code 28 August 2018, 11:10:11 UTC
a5e966d kmsan: split KMSAN hooks into a separate file Also drop several unused functions. 28 August 2018, 11:10:11 UTC
b6717c6 kmsan: move entry hooks to kmsan_entry.c 28 August 2018, 11:10:11 UTC
1af9bc9 kmsan: remove kmsan_threads_ready This anyway was equivalent to kmsan_ready 28 August 2018, 11:10:11 UTC
c799b2a kmsan: nuke unused variables in kmsan.c 28 August 2018, 11:10:11 UTC
3502e37 kmsan: nuke the stats 28 August 2018, 11:10:11 UTC
01f7f9a kmsan: cleanup kmsan_init.c, NFC 28 August 2018, 11:10:10 UTC
468d1a2 kmsan: undo accidental unroll of DECLARE_METADATA_PTR_GETTER(4) 28 August 2018, 11:10:10 UTC
1fd6601 kmsan: drop kmsan_dummy_state to avoid races This is another attempt to fix the long-standing false positives on local vars. We've noticed some uninit reports originating from flags@_raw_spin_lock_irqsave came from calls to _raw_spin_lock_irqsave() from do_task_dead(). Turned out the task was already shut down, so KMSAN was using the global kmsan_dummy_state struct to pass the metadata for arguments and return values. In the case many tasks died at the same time race conditions were possible. We switch to using a per-CPU dummy state instead of a global one. 28 August 2018, 11:10:10 UTC
e62916b kmsan: check the ESI!=RSI hypothesis 28 August 2018, 11:10:10 UTC
3812fc0 kmsan: try nesting the contexts instead of switching to them Context switches related to various interrupts in the kernel can be nested, with certain interrupt types being able to occur within the interrupts of the same type. Instead of trying to map the KMSAN contexts to different interrupt types, just keep a stack of them. 28 August 2018, 11:10:10 UTC
26474d7 kmsan: support cpu_entry_area For the repro below: perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{}]}, 0x10) the kernel used to crash while attempting to run on the stack belonging to the cpu_entry_area. There are no struct pages for cpu_entry_area, therefore we can't allocate metadata pages for it. Instead we create two per-CPU arrays, cpu_entry_area_shadow and cpu_entry_area_origin, which will serve as shadow/origin storage for the stacks in the cpu_entry_area. Also handle switches to the IST stacks by calling the kmsan_ist_enter() and kmsan_ist_exit() hooks in entry_64.S. Looks like this only happens for DEBUG_STACK at the moment. 28 August 2018, 11:10:10 UTC
7eeb73f kmsan: fix kmsan.h 28 August 2018, 11:10:10 UTC
0f9e54a kmsan: setup_percpu.c: remove unused declaration 28 August 2018, 11:10:10 UTC
9c15821 kmsan: fix assertions in IRQ entry/exit hooks. 28 August 2018, 11:10:10 UTC
a45878f kmsan: handle mappings of size other than 2^n in kmsan_acpi_map() If |size| isn't an exact power of 2, order_from_size() rounds it up to the nearest power of 2. Because only |size| bytes of the original memory are accessible, we must be careful not to set shadow/origin pointers for more than ALIGN(size, PAGE_SIZE) >> PAGE_OFFSET pages. 28 August 2018, 11:10:10 UTC
e15f0a6 kmsan: debug printing in order_from_size() 28 August 2018, 11:10:10 UTC
5c538ed kmsan: add empty stubs for kmsan_syscall_enter()/kmsan_syscall_exit() 28 August 2018, 11:10:10 UTC
b77ece3 kmsan: better IRQ handling Only rely on explicitly set per-CPU flags to detect in which context we are. Set those flags in arch/x86/entry/entry_64.S. 28 August 2018, 11:10:10 UTC
a4eb573 kmsan: several changes to page handling - replace page.is_kmsan_untracked_page with page.is_kmsan_tracked_page, so that pages are untracked by default; - fix kmsan_init.c, where this logic inversion caused new crashes - handle clear_page() 28 August 2018, 11:10:10 UTC
3b0f9fd kmsan: preliminary support for virtual memory For vmalloc() and vmap() addresses (but unfortunately not those returned by ioremap) we use vmalloc_to_page() to get the corresponding physical pages. For vmap() we create additional vmaps for shadow and origin pages in order to make accesses to virtual addresses initialize real shadow/origin pages, and vice versa. 28 August 2018, 11:10:10 UTC
2c5358d kmsan: add a test for vmap() 28 August 2018, 11:10:09 UTC
e4c51e8 stackdepot: don't ignore the __GFP_NO_KMSAN_SHADOW flag 28 August 2018, 11:10:09 UTC
92daf66 kmsan: introduce kmsan_interrupt_enter()/kmsan_interrupt_exit() preempt_count() and the percpu |irq_count| var can't be used to reliably tell whether we're in the interrupt context. For example, __do_softirq() is entered with in_task()==true, despite we soon switch to the interrupt stack. To simplify tracking IRQ entry/exit, we add calls to KMSAN runtime around do_IRQ() in entry64.S A similar approach is taken in https://github.com/google/ktsan/commit/f213f1b741c9468f6a692b012d40bdcd8d8dffca 28 August 2018, 11:10:09 UTC
2364904 kmsan: add a newline before "Uninit was created at:" fixes https://github.com/google/kmsan/issues/22 28 August 2018, 11:10:09 UTC
7a70633 kmsan: page range may be non-contiguous in get_user_pages_fast() 28 August 2018, 11:10:09 UTC
2e44d6c kmsan: fix off-by-one error in map_pages() fixes 0064ced63c1b76338697a193299e0f4496f4fb7c ("kmsan: don't track pages used for memory compaction") 28 August 2018, 11:10:09 UTC
ca69ffd kmsan: don't track pages used for memory compaction TODO(glider): track them 28 August 2018, 11:10:09 UTC
a98e040 kmsan: unpoison virtio input buffers when adding them to to virtqueue It's hard (and too late already) to figure out the memory range to be unpoisoned when we receive something via virtio. Instead, we unpoison the input buffer before putting it into the virtqueue. 28 August 2018, 11:10:09 UTC
3da0b4c kmsan: fix the CONFIG_KMSAN=n build 28 August 2018, 11:10:09 UTC
566dead kmsan: copy metadata for pages in copy_user_highpage()/copy_highpage() 28 August 2018, 11:10:09 UTC
a79132c kmsan: copy shadow/origins for COWed pages Fixes the following case: process_vm_readv(0xfd2, 0x20000440, 0x1, 0x200006c0, 0x1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) = 0x2800 clone(child_stack=0x20fbf000, flags=CLONE_FS) = 4052 gettid() = 4050 process_vm_readv(0xfd2, 0x20000440, 0x1, 0x200006c0, 0x1, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0) = 0x2800 28 August 2018, 11:10:09 UTC
8600deb kmsan: added .config.extended 28 August 2018, 11:10:08 UTC
b18a9c7 kmsan: report copy_to_user() bugs as "kernel-infoleak" 28 August 2018, 11:10:08 UTC
9650030 kmsan: unpoison data in pdu_read() This removes a bunch of reports in 9P, but for some reason the 9P-enabled kernel still doesn't boot with KMSAN. 28 August 2018, 11:10:08 UTC
36d5702 kmsan: update .config.example 28 August 2018, 11:10:08 UTC
112ed18 kmsan: remove dead code to trigger syzbot build 28 August 2018, 11:10:08 UTC
cb35360 Revert "x86: Remove FAST_FEATURE_TESTS" This reverts commit d0266046ad54e0c964941364cd82a0d0478ce286. 28 August 2018, 11:10:08 UTC
4d859ad Revert "x86/cpufeature: Guard asm_volatile_goto usage for BPF compilation" This reverts commit b1ae32dbab50ed19cfc16d225b0fb0114fb13025. 28 August 2018, 11:10:08 UTC
e4342f0 kmsan: drop some dead code 28 August 2018, 10:31:24 UTC
0175583 kmsan: updated LLVM/Clang patches to r334104 Fixed incorrect handling of va_args Added __msan_unpoison_alloca() calls 28 August 2018, 10:31:24 UTC
a421356 kmsan: instrument kernel/module.c Skipping this file causes false positives when unloading modules. 28 August 2018, 10:31:24 UTC
d717e98 kmsan: implement __msan_unpoison_alloca() 28 August 2018, 10:31:24 UTC
d8f3745 kmsan: unpoison regs in arch_uprobe_exception_notify() 28 August 2018, 10:31:24 UTC
c16b61c kmsan: bump LLVM/Clang patches to r332596 28 August 2018, 10:31:24 UTC
57cc1d9 kmsan: disable some dead code 28 August 2018, 10:31:24 UTC
3633cb0 kmsan: print addresses in reports when possible This is currently only possible for kmsan_check_memory() 28 August 2018, 10:31:24 UTC
e26dbc4 kmsan: replace memcpy with __memcpy in non-instrumented files 28 August 2018, 10:31:23 UTC
89bc046 kmsan: update .config.example to v4.17-rc5 28 August 2018, 10:29:17 UTC
1d4f3ee kmsan: unpoison only the created pages in get_user_pages_fast() gup_pgd_range() may return less pages than requested. In that case we must unpoison only the created pages. 28 August 2018, 10:29:17 UTC
e85c8bb kmsan: fixup for 1c54bfda4c94209b183b6ac9dae22d98a7e4e76f Encryption and decryption functions must both check the inputs and unpoison the outputs. 28 August 2018, 10:29:17 UTC
12be96f kmsan: handle crypto_cipher_encrypt_one()/crypto_cipher_decrypt_one() These functions touch memory one block at a time. Because they're often implemented in assembly, we just unpoison the output blocks and check the inputs. 28 August 2018, 10:29:17 UTC
2a08666 kmsan: introduce kmsan_clear_user_page() Use it to unpoison pages in clear_user_highpage(). This should fix a number of false positives. It's not clear yet, whether shadow and origin pages can be in high memory, probably no. 28 August 2018, 10:29:17 UTC
e30ea2c kmsan: don't panic if copy_to_user() succeeded only partially Let the caller care about this. 28 August 2018, 10:29:16 UTC
575b4c2 kmsan: fix false positives in do_error_trap() Unpoison |regs| in do_error_trap(). 28 August 2018, 10:29:16 UTC
9a900b6 kmsan: don't instrument code unwinding the stack 28 August 2018, 10:29:16 UTC
3cab6e8 kmsan: bump .config.example to v4.17-rc3 28 August 2018, 10:29:16 UTC
83bb4e5 kmsan: add initialization for shmem pages Maybe we need to instrument clear_highpage/clear_page instead. But for now this fixes the most common source of false positives. 28 August 2018, 10:29:16 UTC
3c860af kmsan: fix NULL deref bh can still be NULL. Top crasher with syzkaller. 28 August 2018, 10:29:16 UTC
b770f9e kmsan: disable assembly checksums Checksum functions implemented in assembly produce large number of false positives. There are generic functions available that do not use assembly. Switch to them under KMSAN. 28 August 2018, 10:29:16 UTC
d4f2395 kmsan: disable reporting in stack unwinding Stack unwinding produces lots of false positives. 28 August 2018, 10:29:16 UTC
4400670 kmsan: disable memcpy-param-overlap check There are known false positives. 28 August 2018, 10:29:16 UTC
4dd7f79 mm/kmsan: fix origin calculation in kmsan_internal_check_memory 28 August 2018, 10:29:16 UTC
be4ee2e readme typo 28 August 2018, 10:29:16 UTC
3990aa1 kmsan: temporarily disable visitAsmInstruction() to help syzbot 28 August 2018, 10:29:16 UTC
84458e0 kmsan: suppress false positives in assembly routines TODO(glider): handle the assembly in the compiler properly instead 28 August 2018, 10:29:16 UTC
3eb4d63 kmsan: suppress false positives in RNG functions 28 August 2018, 10:29:15 UTC
86aa950 kmsan: suppress a false positive in __down_write_trylock() 28 August 2018, 10:29:15 UTC
8a8fe2a kmsan: suppress false positives in cmpxchg and percpu operations 28 August 2018, 10:29:15 UTC
62c9792 kmsan: drop log2_next() 28 August 2018, 10:29:15 UTC
a3a5d43 kmsan: don't instrument kernel/module.c 28 August 2018, 10:29:15 UTC
c13d9a1 kmsan: bump patches to LLVM r329391, ignore big asm() accesses Don't unpoison memory locations greater than 16 bytes in visitAsmInstruction() 28 August 2018, 10:29:15 UTC
89ef946 kmsan: LLVM: don't unpoison memory locations >4096 bytes in asm 28 August 2018, 10:29:15 UTC
5d3f00e kmsan: replace %p with %px, also drop some dead pr_errs() 28 August 2018, 10:29:15 UTC
dbb8efe kmsan: align dummy metadata pages on PAGE_SIZE 28 August 2018, 10:29:15 UTC
2fbfdff kmsan: drop an occasionally committed debug line 28 August 2018, 10:29:15 UTC
ccc1418 kmsan: don't instrument big percpu arrays (temporary workaround) This is a hotfix for syzbot. The current Clang version dies with the following error message: 1. <eof> parser at end of file 2. Code generation 3. Running pass 'Function Pass Manager' on module 'arch/x86/mm/cpu_entry_area.c'. 4. Running pass 'X86 DAG->DAG Instruction Selection' on function '@setup_cpu_entry_areas' clang-7: error: unable to execute command: Aborted when attempting to build the kernel with extended stack size (see 0f35ce79c491cbf0). This can be fixed in the compiler, but for now it's faster to disable instrumentation for arch/x86/kernel/setup_percpu.c and arch/x86/mm/cpu_entry_area.c 28 August 2018, 10:29:14 UTC
8e1e7ab kmsan: hotfix page_64_types.h 28 August 2018, 10:29:14 UTC
cf157ba kmsan: double the stack size again (4x from normal stack size) 28 August 2018, 10:29:14 UTC
08968b8 kmsan: drop unused_msan_check_range() 28 August 2018, 10:29:14 UTC
8e7f5fa kmsan: minor report improvements - capitalize the first words on lines - print empty lines between stacks - more understandable text 28 August 2018, 10:29:14 UTC
e912451 kmsan: support panic_on_warn 28 August 2018, 10:29:14 UTC
d05b535 kmsan: provide __force_order to fix linkage New KMSAN instrumentation pass requires the fake __force_order variable to be present at link time 28 August 2018, 10:29:14 UTC
448a64b kmsan: unpoison pages allocated for reading in bio_copy_kern() SCSI devices overwrite these pages with data that we consider initialized. It's hard to find the exact place where it happens, so just unpoison the pages in advance. Sketch test case: int main() { int fd = open("/dev/sg0", O_RDWR); struct scsi_ioctl_command *cmd; cmd = calloc(1, sizeof(struct scsi_ioctl_command) + 128); cmd->outlen = 0x4a; ioctl(fd, /*SCSI_IOCTL_SEND_COMMAND*/1, cmd); fprintf(stderr, "data: %p\n", cmd->data); return 0; } 28 August 2018, 10:29:14 UTC
back to top