From ece69af2ede103e190ffdfccd9f9ec850606ab5e Mon Sep 17 00:00:00 2001 From: Jann Horn Date: Tue, 25 Mar 2025 17:01:34 +0100 Subject: [PATCH] rwonce: handle KCSAN like KASAN in read_word_at_a_time() read_word_at_a_time() is allowed to read out of bounds by straddling the end of an allocation (and the caller is expected to then mask off out-of-bounds data). This works as long as the caller guarantees that the access won't hit a pagefault (either by ensuring that addr is aligned or by explicitly checking where the next page boundary is). Such out-of-bounds data could include things like KASAN redzones, adjacent allocations that are concurrently written to, or simply an adjacent struct field that is concurrently updated. KCSAN should ignore racy reads of OOB data that is not actually used, just like KASAN, so (similar to the code above) change read_word_at_a_time() to use __no_sanitize_or_inline instead of __no_kasan_or_inline, and explicitly inform KCSAN that we're reading the first byte. We do have an instrument_read() helper that calls into both KASAN and KCSAN, but I'm instead open-coding that here to avoid having to pull the entire instrumented.h header into rwonce.h. Also, since this read can be racy by design, we should technically do READ_ONCE(), so add that. Fixes: dfd402a4c4ba ("kcsan: Add Kernel Concurrency Sanitizer infrastructure") Signed-off-by: Jann Horn Acked-by: Arnd Bergmann Acked-by: Marco Elver Signed-off-by: Arnd Bergmann --- include/asm-generic/rwonce.h | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/include/asm-generic/rwonce.h b/include/asm-generic/rwonce.h index 8d0a6280e9824..e9f2b84d2338c 100644 --- a/include/asm-generic/rwonce.h +++ b/include/asm-generic/rwonce.h @@ -79,11 +79,14 @@ unsigned long __read_once_word_nocheck(const void *addr) (typeof(x))__read_once_word_nocheck(&(x)); \ }) -static __no_kasan_or_inline +static __no_sanitize_or_inline unsigned long read_word_at_a_time(const void *addr) { + /* open-coded instrument_read(addr, 1) */ kasan_check_read(addr, 1); - return *(unsigned long *)addr; + kcsan_check_read(addr, 1); + + return READ_ONCE(*(unsigned long *)addr); } #endif /* __ASSEMBLY__ */ -- 2.39.5