The patch titled
Subject: kasan: initialise array in kasan_memcmp test
has been added to the -mm tree. Its filename is
kasan-initialise-array-in-kasan_memcmp-test.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/kasan-initialise-array-in-kasan_memcmp-test.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/kasan-initialise-array-in-kasan_memcmp-test.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Daniel Axtens <dja@xxxxxxxxxx>
Subject: kasan: initialise array in kasan_memcmp test
memcmp may bail out before accessing all the memory if the buffers contain
differing bytes. kasan_memcmp calls memcmp with a stack array. Stack
variables are not necessarily initialised (in the absence of a compiler
plugin, at least). Sometimes this causes the memcpy to bail early thus
fail to trigger kasan.
Make sure the array initialised to zero in the code.
No other test is dependent on the contents of an array on the stack.
Link: http://lkml.kernel.org/r/20200423154503.5103-4-dja@xxxxxxxxxx
Signed-off-by: Daniel Axtens <dja@xxxxxxxxxx>
Reviewed-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Andrey Ryabinin <aryabinin@xxxxxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Cc: Daniel Micay <danielmicay@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
lib/test_kasan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/test_kasan.c~kasan-initialise-array-in-kasan_memcmp-test
+++ a/lib/test_kasan.c
@@ -638,7 +638,7 @@ static noinline void __init kasan_memcmp
{
char *ptr;
size_t size = 24;
- int arr[9];
+ int arr[9] = {};
pr_info("out-of-bounds in memcmp\n");
ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
_
Patches currently in -mm which might be from dja@xxxxxxxxxx are
kasan-stop-tests-being-eliminated-as-dead-code-with-fortify_source.patch
stringh-fix-incompatibility-between-fortify_source-and-kasan.patch
kasan-initialise-array-in-kasan_memcmp-test.patch
