Bug 211787 - KASAN (hw-tags): don't leak kernel pointers
Summary: KASAN (hw-tags): don't leak kernel pointers
Status: NEW
Alias: None
Product: Memory Management
Classification: Unclassified
Component: Sanitizers (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: MM/Sanitizers virtual assignee
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-02-15 20:00 UTC by Andrey Konovalov
Modified: 2021-02-19 14:38 UTC (History)
1 user (show)

See Also:
Kernel Version: upstream
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description Andrey Konovalov 2021-02-15 20:00:25 UTC
As HW_TAGS KASAN can be used a memory corruption mitigation for production, it shouldn't leak kernel pointers in its reports.

At the same time, as it can be used as a debugging tool, it should show all pointers as is in the debug mode.

The current plan is to do what KFENCE does [1], and only show unhashed pointers when no_hash_pointers command line parameter is provided.

Generic/SW_TAGS KASAN modes should always show unhashed pointers as is.

[1] https://github.com/google/kasan/pull/178
Comment 1 Andrey Konovalov 2021-02-19 14:38:10 UTC
The same is also applicable to register values. Besides leaking pointers that can be used to bypass KASLR, registers can contain private user information, which shouldn't be included in the bug reports (having Android in mind).

KFENCE takes the approach to only show register values when no_hash_pointers is enabled.

Note You need to log in before you can comment on or make changes to this bug.