Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Implement kernel sanitizers #2527

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

Implement kernel sanitizers #2527

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
88e6bd1
[CMAKE] Suppress errors which prevent compiling with -Og
Extravert-ir Apr 10, 2020
d617a13
[NTOS:KE] Remove useless dprint
Extravert-ir Apr 11, 2020
23b5176
[KSANITIZE] Add kernel mode sanitizer library (ksanitize)
Extravert-ir Apr 11, 2020
204b35f
[NTOS:KD64] Fix KdSystemDebugControl
Extravert-ir Jun 20, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions drivers/base/bootvid/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,10 @@ add_library(bootvid MODULE
bootvid.rc
${CMAKE_CURRENT_BINARY_DIR}/bootvid.def)

if(SANITIZE_UB)
target_link_libraries(bootvid ksanitize)
endif()

set_module_type(bootvid kerneldll ENTRYPOINT 0)
add_importlibs(bootvid ntoskrnl hal)
add_pch(bootvid precomp.h SOURCE)
Expand Down
5 changes: 5 additions & 0 deletions drivers/base/kdrosdbg/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@ list(APPEND SOURCE
${CMAKE_CURRENT_BINARY_DIR}/kdcom.def)

add_library(kdcom MODULE ${SOURCE})

if(SANITIZE_UB)
target_link_libraries(kdcom ksanitize)
endif()

set_module_type(kdcom kerneldll ENTRYPOINT 0)
add_importlibs(kdcom ntoskrnl hal)
target_link_libraries(kdcom cportlib)
Expand Down
2 changes: 1 addition & 1 deletion drivers/filesystems/udfs/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,7 +51,7 @@ if(MSVC)
endif()

if(CMAKE_C_COMPILER_ID STREQUAL "GNU")
target_compile_options(udfs PRIVATE -Wno-unused-but-set-variable)
target_compile_options(udfs PRIVATE -Wno-unused-but-set-variable -Wno-stringop-overflow)
Copy link
Contributor

@zefklop zefklop Jun 21, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why for this PR ? Maybe we should fix them.

Copy link
Member Author

@Extravert-ir Extravert-ir Jun 21, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh, that's the UDF driver, I don't really want to look into it :D

Copy link
Member Author

@Extravert-ir Extravert-ir Jun 21, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But that's a general problem - when various optimization levels are enabled, different errors pop up here and there

endif()

set_module_type(udfs kernelmodedriver)
Expand Down
5 changes: 5 additions & 0 deletions hal/halx86/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,11 @@ function(add_hal _halname)
else()
target_link_libraries(${_halname} -lgcc)
endif()

if(SANITIZE_UB)
target_compile_options(${_halname} PRIVATE "-fsanitize=undefined;-fno-sanitize=alignment")
target_link_libraries(${_halname} ksanitize)
endif()
endfunction()

# The components
Expand Down
1 change: 1 addition & 0 deletions ntoskrnl/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@ endif()

target_link_libraries(ntoskrnl cportlib csq ${PSEH_LIB} arbiter cmlib ntlsalib rtl ${ROSSYM_LIB} libcntpr wdmguid ioevent)

# dynamic analysis switches
Copy link
Contributor

@HBelusca HBelusca Jun 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# dynamic analysis switches
# Dynamic analysis switches

if(STACK_PROTECTOR)
target_sources(ntoskrnl PRIVATE $<TARGET_OBJECTS:gcc_ssp_nt>)
endif()
Expand Down
6 changes: 6 additions & 0 deletions ntoskrnl/include/internal/ntoskrnl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,12 @@

#endif

#ifdef __SANITIZE_UB__
#define NO_SANITIZE __attribute__ ((no_sanitize("undefined")))
Copy link
Contributor

@zefklop zefklop Jun 21, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd prefer to have it in crtdefs.h as

/* -fsanitize control */
#if defined(__GNUC__) || defined(__clang__)
# define ATTRIBUTE_NO_SANITIZE(__x) __attribute__((__no_sanitize__(__x)))
#else
# define ATTRIBUTE_NO_SANITIZE(__x)
#endif

This makes it clearer that you want to disable this or that sanitizer, and allows disabling more than one for them with e.g ATTRIBUTE_NO_SANITIZE("thread,undefined")

Copy link
Contributor

@HBelusca HBelusca Jun 21, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ahemmm... until we see whether there are other functions in our code base that may need the sanitizer to not be applied on them, it might be better to keep that only where it's needed (so far just the kernel), and not pollute our CRT with unrelated stuff. And even if you would want to move that into some global header, a specific separate one might be better.

Copy link
Contributor

@zefklop zefklop Jun 21, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

until we see whether there are other functions in our code base that may need the sanitizer to not be applied on them
I have some 😄
And even if you would want to move that into some global header, a specific separate one might be better.
crtdefs already has some of those GCC/clang/MSVC enabled/disabled stuff. And this is the point of it: abstract the compiler specific stuff

Copy link
Contributor

@HBelusca HBelusca Jun 21, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dunno... I see sanitizer stuff as something separate from compiler 🤷

Copy link
Contributor

@zefklop zefklop Jun 21, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Well, it is the compiler instrumenting generated binaries in order to make the relevant checks. It can't be closer to compiler than that 😉

Copy link
Member Author

@Extravert-ir Extravert-ir Jun 21, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@HBelusca check this article for example - explains how Address Sanitizer works https://lwn.net/Articles/612153/

#else
#define NO_SANITIZE
#endif

#ifndef _WIN64
C_ASSERT(FIELD_OFFSET(KUSER_SHARED_DATA, SystemCall) == 0x300);

Expand Down
4 changes: 2 additions & 2 deletions ntoskrnl/kd64/kdapi.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2199,15 +2199,15 @@ KdSystemDebugControl(
break;

}
break;
return STATUS_SUCCESS;
}
#endif

/* Special case for stack frame dumps */
case 'DsoR':
{
KeRosDumpStackFrames((PULONG_PTR)InputBuffer, InputBufferLength);
break;
return STATUS_SUCCESS;
}
#if defined(KDBG)
/* Register KDBG CLI callback */
Expand Down
1 change: 0 additions & 1 deletion ntoskrnl/ke/bug.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -274,7 +274,6 @@ KeRosDumpStackFrames(IN PULONG_PTR Frame OPTIONAL,
{
/* Get the current frames (skip the two. One for the dumper, one for the caller) */
RealFrameCount = RtlCaptureStackBackTrace(2, FrameCount, (PVOID*)Frames, NULL);
DPRINT1("RealFrameCount =%lu\n", RealFrameCount);

/* Dump them */
KeRosDumpStackFrameArray(Frames, RealFrameCount);
Expand Down
2 changes: 2 additions & 0 deletions ntoskrnl/ke/i386/kiinit.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -616,6 +616,7 @@ KiInitializeKernel(IN PKPROCESS InitProcess,
}

CODE_SEG("INIT")
NO_SANITIZE
VOID
FASTCALL
KiGetMachineBootPointers(IN PKGDTENTRY *Gdt,
Expand Down Expand Up @@ -711,6 +712,7 @@ KiMarkPageAsReadOnly(

CODE_SEG("INIT")
DECLSPEC_NORETURN
NO_SANITIZE
VOID
NTAPI
KiSystemStartup(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
Expand Down
767 changes: 382 additions & 385 deletions sdk/cmake/baseaddress.cmake
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 1 addition & 0 deletions sdk/cmake/config.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,7 @@ endif()

if(GCC)
option(STACK_PROTECTOR "Whether to enable the GCC stack checker while compiling" OFF)
option(SANITIZE_UB "Enable -fsanitize=undefined for GCC builds" OFF)
endif()

set(USE_DUMMY_PSEH FALSE CACHE BOOL
Expand Down
20 changes: 20 additions & 0 deletions sdk/cmake/gcc.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,10 +34,15 @@ if(USE_DUMMY_PSEH)
add_definitions(-D_USE_DUMMY_PSEH=1)
endif()

# Dynamic analysis
if(STACK_PROTECTOR)
add_compile_options(-fstack-protector-strong)
endif()

if(SANITIZE_UB)
add_compile_definitions(__SANITIZE_UB__)
endif()

# Compiler Core
add_compile_options(-pipe -fms-extensions -fno-strict-aliasing)

Expand Down Expand Up @@ -138,6 +143,11 @@ else()
endif()
endif()

# GCC optimizer bug. See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85175
if((OPTIMIZE STREQUAL "3") AND (GCC_VERSION VERSION_GREATER 8))
add_compile_options(-Wno-format-overflow)
endif()

# Link-time code generation
if(LTCG)
add_compile_options(-flto -fno-fat-lto-objects)
Expand Down Expand Up @@ -314,6 +324,16 @@ function(set_module_type_toolchain MODULE TYPE)

# Believe it or not, cmake doesn't do that
set_property(TARGET ${MODULE} APPEND PROPERTY LINK_DEPENDS $<TARGET_PROPERTY:native-pefixup,IMPORTED_LOCATION>)

if(SANITIZE_UB)
# we have too many alignment warnings at the moment
target_compile_options(${MODULE} PRIVATE "-fsanitize=undefined;-fno-sanitize=alignment")

# win32k&dependencies require a special version of ksanitize
Copy link
Contributor

@HBelusca HBelusca Jun 20, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# win32k&dependencies require a special version of ksanitize
# win32k & dependencies require a special version of ksanitize

if(NOT ${TYPE} STREQUAL "kerneldll")
target_link_libraries(${MODULE} ksanitize)
endif()
endif()
endif()
endfunction()

Expand Down
17 changes: 11 additions & 6 deletions sdk/lib/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,6 @@ add_subdirectory(cryptlib)

if(MSVC)
add_subdirectory(cpprt)
add_subdirectory(RunTmChk)
endif()

add_subdirectory(delayimp)
Expand All @@ -26,11 +25,6 @@ add_subdirectory(epsapi)
add_subdirectory(evtlib)
add_subdirectory(fast486)
add_subdirectory(fslib)

if(STACK_PROTECTOR)
add_subdirectory(gcc_ssp)
endif()

add_subdirectory(ioevent)
add_subdirectory(lsalib)
add_subdirectory(nt)
Expand All @@ -52,6 +46,17 @@ add_subdirectory(udmihelp)
add_subdirectory(uuid)
add_subdirectory(wdmguid)

if(STACK_PROTECTOR)
add_subdirectory(gcc_ssp)
endif()

if(SANITIZE_UB)
add_subdirectory(ksanitize)
endif()

if(RUNTIME_CHECKS)
add_subdirectory(runtmchk)
endif()
else()

add_subdirectory(3rdparty/zlib)
Expand Down
11 changes: 11 additions & 0 deletions sdk/lib/ksanitize/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@

list(APPEND SOURCE
ubsan.c)

add_library(ksanitize ${SOURCE})
target_compile_definitions(ksanitize PUBLIC LIBSAN_KMODE)
add_importlibs(ksanitize ntoskrnl)

add_library(ksanitize_w32k ${SOURCE})
target_compile_definitions(ksanitize_w32k PUBLIC LIBSAN_W32K)
add_importlibs(ksanitize_w32k win32k)
Loading