kmsan: implement kmsan_check_skb()

google · May 17, 2019 · dd5f193 · dd5f193
1 parent 19ba068
commit dd5f193
Show file tree

Hide file tree

Showing 2 changed files with 40 additions and 0 deletions.
diff --git a/include/linux/kmsan-checks.h b/include/linux/kmsan-checks.h
@@ -4,6 +4,7 @@
 #include <linux/bug.h>
 #include <linux/types.h>
 
+struct sk_buff;
 
 #define KMSAN_DISABLE(flags) \
 	do {	\
@@ -69,6 +70,7 @@ static inline unsigned long KMSAN_INIT_8(unsigned long value) {
 void kmsan_poison_shadow(const volatile void *address, size_t size, gfp_t flags);
 void kmsan_unpoison_shadow(const volatile void *address, size_t size);
 void kmsan_check_memory(const volatile void *address, size_t size);
+void kmsan_check_skb(const struct sk_buff *skb);
 void kmsan_copy_to_user(const void *to, const void *from, size_t to_copy, size_t left);
 void *__msan_memcpy(void *dst, const void *src, u64 n);
 void kmsan_enter_runtime(unsigned long *flags);
@@ -81,6 +83,7 @@ void kmsan_leave_runtime(unsigned long *flags);
 static inline void kmsan_poison_shadow(const volatile void *address, size_t size, gfp_t flags) {}
 static inline void kmsan_unpoison_shadow(const volatile void *address, size_t size) {}
 static inline void kmsan_check_memory(const volatile void *address, size_t size) {}
+void kmsan_check_skb(const struct sk_buff *skb) {}
 static inline void kmsan_copy_to_user(
 	const void *to, const void *from, size_t to_copy, size_t left) {}
 static inline void *__msan_memcpy(void *dst, const void *src, size_t n)

diff --git a/mm/kmsan/kmsan.c b/mm/kmsan/kmsan.c
@@ -13,6 +13,7 @@
 #include <linux/compiler.h>
 #include <linux/console.h>
 #include <linux/export.h>
+#include <linux/highmem.h>
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/kmsan.h>
@@ -21,6 +22,7 @@
 #include <linux/preempt.h>
 #include <linux/percpu-defs.h>
 #include <linux/mm_types.h>
+#include <linux/skbuff.h>
 #include <linux/slab.h>
 #include <linux/stackdepot.h>
 #include <linux/stacktrace.h>
@@ -721,6 +723,41 @@ void kmsan_check_memory(const volatile void *addr, size_t size)
 }
 EXPORT_SYMBOL(kmsan_check_memory);
 
+/* Helper function to check an SKB. */
+void kmsan_check_skb(const struct sk_buff *skb)
+{
+	int start = skb_headlen(skb);
+	struct sk_buff *frag_iter;
+	int i, copy;
+	skb_frag_t *f;
+	u32 p_off, p_len, copied;
+	struct page *p;
+	u8 *vaddr;
+
+	if (!skb || !skb->len)
+		return;
+
+	kmsan_internal_check_memory(skb->data, skb_headlen(skb), 0, REASON_ANY);
+	if (skb_is_nonlinear(skb)) {
+		for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
+			f = &skb_shinfo(skb)->frags[i];
+
+			skb_frag_foreach_page(f,
+					      f->page_offset  - start,
+					      copy, p, p_off, p_len, copied) {
+				vaddr = kmap_atomic(p);
+				kmsan_internal_check_memory(vaddr + p_off,
+						p_len, /* user_addr*/ 0,
+						REASON_ANY);
+				kunmap_atomic(vaddr);
+			}
+		}
+	}
+	skb_walk_frags(skb, frag_iter)
+		kmsan_check_skb(frag_iter);
+}
+EXPORT_SYMBOL(kmsan_check_skb);
+
 /*
  * TODO(glider): this check shouldn't be performed for origin pages, because
  * they're always accessed after the shadow pages.