Implement kernel sanitizers #2527

Extravert-ir · 2020-04-11T02:18:44Z

TODO:

UndefinedBehaviorSanitizer (UBSan, -fsanitize=undefined)
-fsanitize=nullability* group of checks
KernelAddressSanitizer (KASan, -fsanitize=address)
Test on 64bit builds

ThFabba

User mode sanitizers should be implemented in mingw-w64

We generally implement our own runtime and try not to rely on the compiler's so this isn't obvious to me. Can you elaborate?

ntoskrnl/CMakeLists.txt

sdk/lib/ksanitize/ubsan.c

ThFabba · 2020-04-11T06:21:02Z

sdk/lib/ksanitize/ubsan.c

+     * A proper solution would need probably a lock-free bounded queue built
+     * with atomic operations with the property of miltiple consumers and
+     * multiple producers. Maintaining and validating such code is not
+     * worth the effort.


Hey we might have such a thing... SLISTs! ;)

"miltiple consumers"? 🤔

drivers/filesystems/udfs/CMakeLists.txt

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries

Do not return STATUS_NOT_IMPLEMENTED on things we actually handle

Extravert-ir · 2021-06-20T03:10:31Z

We generally implement our own runtime and try not to rely on the compiler's so this isn't obvious to me. Can you elaborate?

The usermode runtime for sanitizers is not that easy thing to do, so better reuse what others do. Looking at it a year after, seems like the best option would be to finally adopt LLVM's libc++ and use their sanitizer facilities

Extravert-ir · 2021-06-20T03:21:55Z

Example outputs (these are real messages from current master)

UBSan: Undefined Behavior in ntoskrnl/ke/i386/patpge.c:146:63, left shift of 731095 by 12 places cannot be represented in type 'int'
Call trace:
===========
<ntoskrnl.exe: 002BDE86>
<ntoskrnl.exe: 002BF870>
<ntoskrnl.exe: 002C0923>
<ntoskrnl.exe: 00281CBB>
<ntoskrnl.exe: 00281D35>
<ntoskrnl.exe: 002820A6>
<ntoskrnl.exe: 0047DCFD>
<ntoskrnl.exe: 00467B3C>
<ntoskrnl.exe: 0045BCD5>
<ntoskrnl.exe: 0005A1D0>
<ntoskrnl.exe: 0024C38D>
<ntoskrnl.exe: 002822F0>
<ntoskrnl.exe: 0024C360>

UBSan: Undefined Behavior in win32ss/gdi/dib/dib.c:186:92, left shift of 12 by 28 places cannot be represented in type 'int'
Call trace:
===========
<win32k.sys:310b96 (sdk/lib/ksanitize/ubsan.c:1343 (Report))>
<win32k.sys:312580 (sdk/lib/ksanitize/ubsan.c:564 (HandleShiftOutOfBounds))>
<win32k.sys:313633 (sdk/lib/ksanitize/ubsan.c:1205 (__ubsan_handle_shift_out_of_bounds))>
<win32k.sys:2183e0 (win32ss/gdi/dib/dib.c:186 (DIB_DoRop))>
<win32k.sys:30873e (home/victor/Documents/reactos/build/libsan/win32ss/gdi/dib/dib32gen.c:594 (DIB_32BPP_BitBlt_Generic))>
<win32k.sys:30d59f (home/victor/Documents/reactos/build/libsan/win32ss/gdi/dib/dib32gen.c:5707 (DIB_32BPP_BitBlt))>
<win32k.sys:2416c (win32ss/gdi/eng/bitblt.c:271 (CallDibBitBlt))>
<win32k.sys:23827 (win32ss/gdi/eng/bitblt.c:553 (EngBitBlt))>
<win32k.sys:27587 (win32ss/gdi/eng/bitblt.c:799 (IntEngBitBlt))>
<win32k.sys:162c5e (win32ss/gdi/ntgdi/bitblt.c:509 (NtGdiMaskBlt))>
<win32k.sys:166365 (win32ss/gdi/ntgdi/bitblt.c:186 (NtGdiBitBlt))>
<ntoskrnl.exe:3fea (:0 (KiSystemCallTrampoline))>
<ntoskrnl.exe:28cc7b (ntoskrnl/ke/i386/traphdlr.c:1844 (KiSystemServiceHandler))>
<ntoskrnl.exe:3e34 (:0 (KiFastCallEntry))>
<comctl32.dll:364ed>
<comctl32.dll:366d7>
<explorer.exe:1a649>
<explorer.exe:15f6a>
<explorer.exe:26951>
<user32.dll:6669e>
<user32.dll:5a8f6>
<user32.dll:5c726>
<ntdll.dll:10069>
<user32.dll:64079>
<explorer.exe:194ba>
<explorer.exe:d347>

HBelusca

I was wondering: Isn't it this library that requires the usage of a specific memory area (allocated by the kernel) for doing its job? If so, where is it initialized?

HBelusca · 2021-06-20T13:40:59Z

sdk/cmake/baseaddress.cmake

@@ -1,389 +1,386 @@
-# Generated from R:\build\master\gcc
+# Generated from /home/victor/Documents/reactos/build/libsan


private info leak :P

HBelusca · 2021-06-20T13:41:30Z

sdk/cmake/gcc.cmake

+            # we have too many alignment warnings at the moment
+            target_compile_options(${MODULE} PRIVATE "-fsanitize=undefined;-fno-sanitize=alignment")
+
+            # win32k&dependencies require a special version of ksanitize


Suggested change

# win32k&dependencies require a special version of ksanitize

# win32k & dependencies require a special version of ksanitize

HBelusca · 2021-06-20T14:01:58Z

ntoskrnl/CMakeLists.txt


 target_link_libraries(ntoskrnl cportlib csq ${PSEH_LIB} arbiter cmlib ntlsalib rtl ${ROSSYM_LIB} libcntpr wdmguid ioevent)

+# dynamic analysis switches


Suggested change

# dynamic analysis switches

# Dynamic analysis switches

Extravert-ir · 2021-06-20T14:33:32Z

Isn't it this library that requires the usage of a specific memory area (allocated by the kernel) for doing its job?

Not yet, UndefinedBehaviorSanitizer is simple in that regard - doesn't need anything from the kernel. I'm working on AddressSanitizer - that will require a special area to be reserved

zefklop · 2021-06-21T10:17:35Z

drivers/filesystems/udfs/CMakeLists.txt


 if(CMAKE_C_COMPILER_ID STREQUAL "GNU")
-    target_compile_options(udfs PRIVATE -Wno-unused-but-set-variable)
+    target_compile_options(udfs PRIVATE -Wno-unused-but-set-variable -Wno-stringop-overflow)


Why for this PR ? Maybe we should fix them.

Oh, that's the UDF driver, I don't really want to look into it :D

But that's a general problem - when various optimization levels are enabled, different errors pop up here and there

zefklop · 2021-06-21T10:19:18Z

ntoskrnl/include/internal/ntoskrnl.h

 #endif

+#ifdef __SANITIZE_UB__
+#define NO_SANITIZE __attribute__ ((no_sanitize("undefined")))


I'd prefer to have it in crtdefs.h as

/* -fsanitize control */ #if defined(__GNUC__) || defined(__clang__) # define ATTRIBUTE_NO_SANITIZE(__x) __attribute__((__no_sanitize__(__x))) #else # define ATTRIBUTE_NO_SANITIZE(__x) #endif

This makes it clearer that you want to disable this or that sanitizer, and allows disabling more than one for them with e.g ATTRIBUTE_NO_SANITIZE("thread,undefined")

Ahemmm... until we see whether there are other functions in our code base that may need the sanitizer to not be applied on them, it might be better to keep that only where it's needed (so far just the kernel), and not pollute our CRT with unrelated stuff. And even if you would want to move that into some global header, a specific separate one might be better.

until we see whether there are other functions in our code base that may need the sanitizer to not be applied on them
I have some 😄
And even if you would want to move that into some global header, a specific separate one might be better.
crtdefs already has some of those GCC/clang/MSVC enabled/disabled stuff. And this is the point of it: abstract the compiler specific stuff

Dunno... I see sanitizer stuff as something separate from compiler 🤷

Well, it is the compiler instrumenting generated binaries in order to make the relevant checks. It can't be closer to compiler than that 😉

@HBelusca check this article for example - explains how Address Sanitizer works https://lwn.net/Articles/612153/

ntoskrnl/kd64/kdapi.c

zefklop · 2021-06-21T10:25:57Z

Maybe you want to add object files to import libraries with target_sources(libntoskrnl PRIVATE $<TARGET_OBJECTS:ksanitize>) instead of adding target_link_libraries everywhere.

github-actions · 2022-08-28T01:16:34Z

This PR is stale because it received no updates in the last 4 months. Without removing the stale label, or commenting on this ticket it will be closed in 2 weeks.

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries PR #2527

PR #2527

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries PR #2527

PR #2527

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries PR #2527

PR #2527

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries PR #2527

PR #2527

ThFabba reviewed Apr 11, 2020

View reviewed changes

binarymaster added the enhancement For PRs with an enhancement/new feature. label Apr 15, 2020

Extravert-ir mentioned this pull request May 24, 2020

[REACTOS] Fully sync RUNTIME_CHECKS support #2851

Closed

This was referenced May 24, 2020

[CMAKE] gcc.cmake: Remove unwanted ${MODULE} in an add_compile_flags() #2846

Closed

[REACTOS] Lower case 'RunTmChk' #2849

Closed

binarymaster added the kernel&hal Code changes to the ntoskrnl and HAL label Feb 7, 2021

Extravert-ir added 2 commits June 19, 2021 23:33

[CMAKE] Suppress errors which prevent compiling with -Og

88e6bd1

[NTOS:KE] Remove useless dprint

d617a13

Extravert-ir force-pushed the ubsan2 branch from 43bd76a to b357211 Compare June 20, 2021 02:55

github-actions bot added the drivers Kernel mode drivers and frameworks label Jun 20, 2021

Extravert-ir added 2 commits June 20, 2021 06:04

[KSANITIZE] Add kernel mode sanitizer library (ksanitize)

23b5176

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries

[NTOS:KD64] Fix KdSystemDebugControl

204b35f

Do not return STATUS_NOT_IMPLEMENTED on things we actually handle

Extravert-ir force-pushed the ubsan2 branch from b357211 to 204b35f Compare June 20, 2021 03:05

HBelusca reviewed Jun 20, 2021

View reviewed changes

zefklop reviewed Jun 21, 2021

View reviewed changes

ntoskrnl/kd64/kdapi.c Show resolved Hide resolved

nickdimeglio mentioned this pull request Apr 17, 2022

Implement kernel sanitizers #4455

Closed

binarymaster added the needs rebase This PR needs to be rebased before merge label Apr 29, 2022

github-actions bot added the no-pr-activity PRs with no further activity from the author. label Aug 28, 2022

github-actions bot closed this Sep 12, 2022

hpoussin pushed a commit that referenced this pull request Oct 23, 2025

[KSANITIZE] Add kernel mode sanitizer library (ksanitize)

791f667

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries PR #2527

hpoussin pushed a commit that referenced this pull request Oct 23, 2025

[CMAKE] Suppress errors which prevent compiling with -Og

5e5f1f1

PR #2527

hpoussin pushed a commit that referenced this pull request Oct 23, 2025

[KSANITIZE] Add kernel mode sanitizer library (ksanitize)

179f177

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries PR #2527

hpoussin pushed a commit that referenced this pull request Oct 23, 2025

[CMAKE] Suppress errors which prevent compiling with -Og

fc30d79

PR #2527

hpoussin pushed a commit that referenced this pull request Oct 24, 2025

[KSANITIZE] Add kernel mode sanitizer library (ksanitize)

a89aecc

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries PR #2527

hpoussin pushed a commit that referenced this pull request Oct 24, 2025

[CMAKE] Suppress errors which prevent compiling with -Og

5e6eae2

PR #2527

hpoussin pushed a commit that referenced this pull request Oct 24, 2025

[KSANITIZE] Add kernel mode sanitizer library (ksanitize)

fa53a97

Add SANITIZE_UB switch for enabling -fsanitize=undefined on binaries PR #2527

hpoussin pushed a commit that referenced this pull request Oct 24, 2025

[CMAKE] Suppress errors which prevent compiling with -Og

d239fd0

PR #2527

hpoussin mentioned this pull request Oct 24, 2025

Implement kernel sanitizers #8435

Open

6 tasks

		@@ -1,389 +1,386 @@
		# Generated from R:\build\master\gcc
		# Generated from /home/victor/Documents/reactos/build/libsan

	# win32k&dependencies require a special version of ksanitize
	# win32k & dependencies require a special version of ksanitize


		target_link_libraries(ntoskrnl cportlib csq ${PSEH_LIB} arbiter cmlib ntlsalib rtl ${ROSSYM_LIB} libcntpr wdmguid ioevent)

		# dynamic analysis switches

Uh oh!

Implement kernel sanitizers #2527

Implement kernel sanitizers #2527

Uh oh!

Conversation

Extravert-ir commented Apr 11, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ThFabba left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Extravert-ir commented Jun 20, 2021

Uh oh!

Extravert-ir commented Jun 20, 2021

Uh oh!

HBelusca left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Extravert-ir commented Jun 20, 2021

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zefklop Jun 21, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zefklop Jun 21, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Extravert-ir Jun 21, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

zefklop commented Jun 21, 2021

Uh oh!

github-actions bot commented Aug 28, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Extravert-ir commented Apr 11, 2020 •

edited

Loading

zefklop Jun 21, 2021 •

edited

Loading

zefklop Jun 21, 2021 •

edited

Loading

Extravert-ir Jun 21, 2021 •

edited

Loading