Alexander Potapenko
authored
As noticed by Brian, KMSAN should not be zeroing the origin when unpoisoning parts of a four-byte uninitialized value, e.g.: char a[4]; kmsan_unpoison_memory(a, 1); This led to false negatives, as certain poisoned values could receive zero origins, preventing those values from being reported. To fix the problem, check that kmsan_internal_set_shadow_origin() writes zero origins only to slots which have zero shadow. Link: https://lkml.kernel.org/r/20240528104807.738758-1-glider@google.com Fixes: f80be457 ("kmsan: add KMSAN runtime core") Signed-off-by:Alexander Potapenko <glider@google.com> Reported-by:
Brian Johannesmeyer <bjohannesmeyer@gmail.com> Link: https://lore.kernel.org/lkml/20240524232804.1984355-1-bjohannesmeyer@gmail.com/T/ Reviewed-by:
Marco Elver <elver@google.com> Tested-by:
Brian Johannesmeyer <bjohannesmeyer@gmail.com> Cc: Dmitry Vyukov <dvyukov@google.com> Cc: Kees Cook <keescook@chromium.org> Cc: <stable@vger.kernel.org> Signed-off-by:
Andrew Morton <akpm@linux-foundation.org>
Name | Last commit | Last update |
---|---|---|
.. | ||
Makefile | ||
core.c | ||
hooks.c | ||
init.c | ||
instrumentation.c | ||
kmsan.h | ||
kmsan_test.c | ||
report.c | ||
shadow.c |