| Message ID | 74133d1a57c47cb8fec791dd5d1e6417b0579fc3.1600204505.git.andreyknvl@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | kasan: add hardware tag-based mode for arm64 | expand |
On Tue, Sep 15, 2020 at 11:16:15PM +0200, Andrey Konovalov wrote: > Provide implementation of KASAN functions required for the hardware > tag-based mode. Those include core functions for memory and pointer > tagging (tags_hw.c) and bug reporting (report_tags_hw.c). Also adapt > common KASAN code to support the new mode. > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> For the arm64 bits in this patch: Acked-by: Catalin Marinas <catalin.marinas@arm.com>
On Tue, Sep 15, 2020 at 11:16PM +0200, Andrey Konovalov wrote: [...] > arch/arm64/include/asm/memory.h | 4 +- > arch/arm64/kernel/setup.c | 1 - > include/linux/kasan.h | 6 +-- > include/linux/mm.h | 2 +- > include/linux/page-flags-layout.h | 2 +- > mm/kasan/Makefile | 5 ++ > mm/kasan/common.c | 14 +++--- > mm/kasan/kasan.h | 17 +++++-- > mm/kasan/report_tags_hw.c | 47 +++++++++++++++++++ > mm/kasan/report_tags_sw.c | 2 +- > mm/kasan/shadow.c | 2 +- > mm/kasan/tags_hw.c | 78 +++++++++++++++++++++++++++++++ > mm/kasan/tags_sw.c | 2 +- > 13 files changed, 162 insertions(+), 20 deletions(-) > create mode 100644 mm/kasan/report_tags_hw.c > create mode 100644 mm/kasan/tags_hw.c [...] > diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c > index 77c4c9bad1b8..5985be8af2c6 100644 > --- a/arch/arm64/kernel/setup.c > +++ b/arch/arm64/kernel/setup.c > @@ -358,7 +358,6 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) > smp_init_cpus(); > smp_build_mpidr_hash(); > > - /* Init percpu seeds for random tags after cpus are set up. */ Why was the comment removed and not updated? > kasan_init_tags(); > > #ifdef CONFIG_ARM64_SW_TTBR0_PAN
On Fri, Sep 18, 2020 at 12:46 PM Marco Elver <elver@google.com> wrote: > > On Tue, Sep 15, 2020 at 11:16PM +0200, Andrey Konovalov wrote: > [...] > > arch/arm64/include/asm/memory.h | 4 +- > > arch/arm64/kernel/setup.c | 1 - > > include/linux/kasan.h | 6 +-- > > include/linux/mm.h | 2 +- > > include/linux/page-flags-layout.h | 2 +- > > mm/kasan/Makefile | 5 ++ > > mm/kasan/common.c | 14 +++--- > > mm/kasan/kasan.h | 17 +++++-- > > mm/kasan/report_tags_hw.c | 47 +++++++++++++++++++ > > mm/kasan/report_tags_sw.c | 2 +- > > mm/kasan/shadow.c | 2 +- > > mm/kasan/tags_hw.c | 78 +++++++++++++++++++++++++++++++ > > mm/kasan/tags_sw.c | 2 +- > > 13 files changed, 162 insertions(+), 20 deletions(-) > > create mode 100644 mm/kasan/report_tags_hw.c > > create mode 100644 mm/kasan/tags_hw.c > [...] > > diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c > > index 77c4c9bad1b8..5985be8af2c6 100644 > > --- a/arch/arm64/kernel/setup.c > > +++ b/arch/arm64/kernel/setup.c > > @@ -358,7 +358,6 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) > > smp_init_cpus(); > > smp_build_mpidr_hash(); > > > > - /* Init percpu seeds for random tags after cpus are set up. */ > > Why was the comment removed and not updated? Will fix in v3, thanks!
[ Sorry for the additional email on this patch; trying to consolidate comments now. ] On Tue, Sep 15, 2020 at 11:16PM +0200, Andrey Konovalov wrote: > Provide implementation of KASAN functions required for the hardware > tag-based mode. Those include core functions for memory and pointer > tagging (tags_hw.c) and bug reporting (report_tags_hw.c). Also adapt > common KASAN code to support the new mode. > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> > --- > Change-Id: I8a8689ba098174a4d0ef3f1d008178387c80ee1c > --- > arch/arm64/include/asm/memory.h | 4 +- > arch/arm64/kernel/setup.c | 1 - > include/linux/kasan.h | 6 +-- > include/linux/mm.h | 2 +- > include/linux/page-flags-layout.h | 2 +- > mm/kasan/Makefile | 5 ++ > mm/kasan/common.c | 14 +++--- > mm/kasan/kasan.h | 17 +++++-- > mm/kasan/report_tags_hw.c | 47 +++++++++++++++++++ > mm/kasan/report_tags_sw.c | 2 +- > mm/kasan/shadow.c | 2 +- > mm/kasan/tags_hw.c | 78 +++++++++++++++++++++++++++++++ > mm/kasan/tags_sw.c | 2 +- > 13 files changed, 162 insertions(+), 20 deletions(-) > create mode 100644 mm/kasan/report_tags_hw.c > create mode 100644 mm/kasan/tags_hw.c [...] > diff --git a/mm/kasan/common.c b/mm/kasan/common.c > index 41c7f1105eaa..412a23d1546b 100644 > --- a/mm/kasan/common.c > +++ b/mm/kasan/common.c > @@ -118,7 +118,7 @@ void kasan_free_pages(struct page *page, unsigned int order) > */ > static inline unsigned int optimal_redzone(unsigned int object_size) > { > - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) > + if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) > return 0; > > return > @@ -183,14 +183,14 @@ size_t kasan_metadata_size(struct kmem_cache *cache) > struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache, > const void *object) > { > - return (void *)object + cache->kasan_info.alloc_meta_offset; > + return (void *)reset_tag(object) + cache->kasan_info.alloc_meta_offset; > } > > struct kasan_free_meta *get_free_info(struct kmem_cache *cache, > const void *object) > { > BUILD_BUG_ON(sizeof(struct kasan_free_meta) > 32); > - return (void *)object + cache->kasan_info.free_meta_offset; > + return (void *)reset_tag(object) + cache->kasan_info.free_meta_offset; > } > > void kasan_poison_slab(struct page *page) > @@ -272,7 +272,8 @@ void * __must_check kasan_init_slab_obj(struct kmem_cache *cache, > alloc_info = get_alloc_info(cache, object); > __memset(alloc_info, 0, sizeof(*alloc_info)); Suggested edit below (assuming the line-break wasn't intentional; this should still be within checkpatch.pl's 100 col limit): ------ - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || - IS_ENABLED(CONFIG_KASAN_HW_TAGS)) + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || IS_ENABLED(CONFIG_KASAN_HW_TAGS)) object = set_tag(object, assign_tag(cache, object, true, false)); @@ -343,8 +342,7 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object, redzone_end = round_up((unsigned long)object + cache->object_size, KASAN_GRANULE_SIZE); - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || - IS_ENABLED(CONFIG_KASAN_HW_TAGS)) + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || IS_ENABLED(CONFIG_KASAN_HW_TAGS)) tag = assign_tag(cache, object, false, keep_tag); ------ > - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) > + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || > + IS_ENABLED(CONFIG_KASAN_HW_TAGS)) > object = set_tag(object, > assign_tag(cache, object, true, false)); > > @@ -342,10 +343,11 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object, > redzone_end = round_up((unsigned long)object + cache->object_size, > KASAN_GRANULE_SIZE); > > - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) > + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || > + IS_ENABLED(CONFIG_KASAN_HW_TAGS)) > tag = assign_tag(cache, object, false, keep_tag); > > - /* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */ > + /* Tag is ignored in set_tag without CONFIG_KASAN_SW/HW_TAGS */ > kasan_unpoison_memory(set_tag(object, tag), size); > kasan_poison_memory((void *)redzone_start, redzone_end - redzone_start, > KASAN_KMALLOC_REDZONE); [...] > diff --git a/mm/kasan/report_tags_hw.c b/mm/kasan/report_tags_hw.c > new file mode 100644 > index 000000000000..c2f73c46279a > --- /dev/null > +++ b/mm/kasan/report_tags_hw.c > @@ -0,0 +1,47 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * This file contains hardware tag-based KASAN specific error reporting code. > + * > + * Copyright (c) 2020 Google, Inc. > + * Author: Andrey Konovalov <andreyknvl@google.com> > + * > + * This program is free software; you can redistribute it and/or modify > + * it under the terms of the GNU General Public License version 2 as > + * published by the Free Software Foundation. > + * I do not think we put the "This program is ..." preamble in new files anymore. It should be covered by SPDX tag above. > + */ > + > +#include <linux/kasan.h> > +#include <linux/kernel.h> > +#include <linux/memory.h> > +#include <linux/mm.h> > +#include <linux/string.h> > +#include <linux/types.h> [...] > diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c > index 4888084ecdfc..ca69726adf8f 100644 > --- a/mm/kasan/shadow.c > +++ b/mm/kasan/shadow.c > @@ -111,7 +111,7 @@ void kasan_unpoison_memory(const void *address, size_t size) > > if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) > *shadow = tag; > - else > + else /* CONFIG_KASAN_GENERIC */ > *shadow = size & KASAN_GRANULE_MASK; > } > } > diff --git a/mm/kasan/tags_hw.c b/mm/kasan/tags_hw.c > new file mode 100644 > index 000000000000..c93d43379e39 > --- /dev/null > +++ b/mm/kasan/tags_hw.c > @@ -0,0 +1,78 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * This file contains core hardware tag-based KASAN code. > + * > + * Copyright (c) 2020 Google, Inc. > + * Author: Andrey Konovalov <andreyknvl@google.com> > + * > + * This program is free software; you can redistribute it and/or modify > + * it under the terms of the GNU General Public License version 2 as > + * published by the Free Software Foundation. > + * I do not think we put the "This program is ..." preamble in new files anymore. It should be covered by SPDX tag above. > + */ > + > +#include <linux/kasan.h> > +#include <linux/kernel.h> > +#include <linux/memory.h> > +#include <linux/mm.h> > +#include <linux/string.h> > +#include <linux/types.h> > + > +#include "kasan.h" > + > +void kasan_init_tags(void) > +{ > + init_tags(KASAN_TAG_MAX); > +} > + > +void *kasan_reset_tag(const void *addr) > +{ > + return reset_tag(addr); > +} > + To help readability, would this edit be ok? ------ void kasan_poison_memory(const void *address, size_t size, u8 value) { - set_mem_tag_range(reset_tag(address), - round_up(size, KASAN_GRANULE_SIZE), value); + set_mem_tag_range(reset_tag(address), round_up(size, KASAN_GRANULE_SIZE), value); } void kasan_unpoison_memory(const void *address, size_t size) { - set_mem_tag_range(reset_tag(address), - round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); + set_mem_tag_range(reset_tag(address), round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); } ------ > +void kasan_poison_memory(const void *address, size_t size, u8 value) > +{ > + set_mem_tag_range(reset_tag(address), > + round_up(size, KASAN_GRANULE_SIZE), value); > +} > + > +void kasan_unpoison_memory(const void *address, size_t size) > +{ > + set_mem_tag_range(reset_tag(address), > + round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); > +} > + > +u8 random_tag(void) > +{ > + return get_random_tag(); > +} > + > +bool check_invalid_free(void *addr) > +{ > + u8 ptr_tag = get_tag(addr); > + u8 mem_tag = get_mem_tag(addr); > + Why not just: ------ - if (shadow_byte == KASAN_TAG_INVALID) - return true; - if (tag != KASAN_TAG_KERNEL && tag != shadow_byte) - return true; - return false; + return shadow_byte == KASAN_TAG_INVALID || + (tag != KASAN_TAG_KERNEL && tag != shadow_byte); } ------ > + if (mem_tag == KASAN_TAG_INVALID) > + return true; > + if (ptr_tag != KASAN_TAG_KERNEL && ptr_tag != mem_tag) > + return true; > + return false; > +} > + Thanks, -- Marco
On Fri, Sep 18, 2020 at 2:52 PM Marco Elver <elver@google.com> wrote: > > [ Sorry for the additional email on this patch; trying to consolidate > comments now. ] > > On Tue, Sep 15, 2020 at 11:16PM +0200, Andrey Konovalov wrote: > > Provide implementation of KASAN functions required for the hardware > > tag-based mode. Those include core functions for memory and pointer > > tagging (tags_hw.c) and bug reporting (report_tags_hw.c). Also adapt > > common KASAN code to support the new mode. > > > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com> > > --- > > Change-Id: I8a8689ba098174a4d0ef3f1d008178387c80ee1c > > --- > > arch/arm64/include/asm/memory.h | 4 +- > > arch/arm64/kernel/setup.c | 1 - > > include/linux/kasan.h | 6 +-- > > include/linux/mm.h | 2 +- > > include/linux/page-flags-layout.h | 2 +- > > mm/kasan/Makefile | 5 ++ > > mm/kasan/common.c | 14 +++--- > > mm/kasan/kasan.h | 17 +++++-- > > mm/kasan/report_tags_hw.c | 47 +++++++++++++++++++ > > mm/kasan/report_tags_sw.c | 2 +- > > mm/kasan/shadow.c | 2 +- > > mm/kasan/tags_hw.c | 78 +++++++++++++++++++++++++++++++ > > mm/kasan/tags_sw.c | 2 +- > > 13 files changed, 162 insertions(+), 20 deletions(-) > > create mode 100644 mm/kasan/report_tags_hw.c > > create mode 100644 mm/kasan/tags_hw.c > [...] > > diff --git a/mm/kasan/common.c b/mm/kasan/common.c > > index 41c7f1105eaa..412a23d1546b 100644 > > --- a/mm/kasan/common.c > > +++ b/mm/kasan/common.c > > @@ -118,7 +118,7 @@ void kasan_free_pages(struct page *page, unsigned int order) > > */ > > static inline unsigned int optimal_redzone(unsigned int object_size) > > { > > - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) > > + if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) > > return 0; > > > > return > > @@ -183,14 +183,14 @@ size_t kasan_metadata_size(struct kmem_cache *cache) > > struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache, > > const void *object) > > { > > - return (void *)object + cache->kasan_info.alloc_meta_offset; > > + return (void *)reset_tag(object) + cache->kasan_info.alloc_meta_offset; > > } > > > > struct kasan_free_meta *get_free_info(struct kmem_cache *cache, > > const void *object) > > { > > BUILD_BUG_ON(sizeof(struct kasan_free_meta) > 32); > > - return (void *)object + cache->kasan_info.free_meta_offset; > > + return (void *)reset_tag(object) + cache->kasan_info.free_meta_offset; > > } > > > > void kasan_poison_slab(struct page *page) > > @@ -272,7 +272,8 @@ void * __must_check kasan_init_slab_obj(struct kmem_cache *cache, > > alloc_info = get_alloc_info(cache, object); > > __memset(alloc_info, 0, sizeof(*alloc_info)); > > Suggested edit below (assuming the line-break wasn't intentional; this > should still be within checkpatch.pl's 100 col limit): > ------ > - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || > - IS_ENABLED(CONFIG_KASAN_HW_TAGS)) > + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || IS_ENABLED(CONFIG_KASAN_HW_TAGS)) > object = set_tag(object, > assign_tag(cache, object, true, false)); > > @@ -343,8 +342,7 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object, > redzone_end = round_up((unsigned long)object + cache->object_size, > KASAN_GRANULE_SIZE); > > - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || > - IS_ENABLED(CONFIG_KASAN_HW_TAGS)) > + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || IS_ENABLED(CONFIG_KASAN_HW_TAGS)) > tag = assign_tag(cache, object, false, keep_tag); > ------ > > > - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) > > + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || > > + IS_ENABLED(CONFIG_KASAN_HW_TAGS)) > > object = set_tag(object, > > assign_tag(cache, object, true, false)); > > > > @@ -342,10 +343,11 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object, > > redzone_end = round_up((unsigned long)object + cache->object_size, > > KASAN_GRANULE_SIZE); > > > > - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) > > + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || > > + IS_ENABLED(CONFIG_KASAN_HW_TAGS)) > > tag = assign_tag(cache, object, false, keep_tag); > > > > - /* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */ > > + /* Tag is ignored in set_tag without CONFIG_KASAN_SW/HW_TAGS */ > > kasan_unpoison_memory(set_tag(object, tag), size); > > kasan_poison_memory((void *)redzone_start, redzone_end - redzone_start, > > KASAN_KMALLOC_REDZONE); > [...] > > diff --git a/mm/kasan/report_tags_hw.c b/mm/kasan/report_tags_hw.c > > new file mode 100644 > > index 000000000000..c2f73c46279a > > --- /dev/null > > +++ b/mm/kasan/report_tags_hw.c > > @@ -0,0 +1,47 @@ > > +// SPDX-License-Identifier: GPL-2.0 > > +/* > > + * This file contains hardware tag-based KASAN specific error reporting code. > > + * > > + * Copyright (c) 2020 Google, Inc. > > + * Author: Andrey Konovalov <andreyknvl@google.com> > > + * > > + * This program is free software; you can redistribute it and/or modify > > + * it under the terms of the GNU General Public License version 2 as > > + * published by the Free Software Foundation. > > + * > > I do not think we put the "This program is ..." preamble in new files > anymore. It should be covered by SPDX tag above. > > > + */ > > + > > +#include <linux/kasan.h> > > +#include <linux/kernel.h> > > +#include <linux/memory.h> > > +#include <linux/mm.h> > > +#include <linux/string.h> > > +#include <linux/types.h> > [...] > > diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c > > index 4888084ecdfc..ca69726adf8f 100644 > > --- a/mm/kasan/shadow.c > > +++ b/mm/kasan/shadow.c > > @@ -111,7 +111,7 @@ void kasan_unpoison_memory(const void *address, size_t size) > > > > if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) > > *shadow = tag; > > - else > > + else /* CONFIG_KASAN_GENERIC */ > > *shadow = size & KASAN_GRANULE_MASK; > > } > > } > > diff --git a/mm/kasan/tags_hw.c b/mm/kasan/tags_hw.c > > new file mode 100644 > > index 000000000000..c93d43379e39 > > --- /dev/null > > +++ b/mm/kasan/tags_hw.c > > @@ -0,0 +1,78 @@ > > +// SPDX-License-Identifier: GPL-2.0 > > +/* > > + * This file contains core hardware tag-based KASAN code. > > + * > > + * Copyright (c) 2020 Google, Inc. > > + * Author: Andrey Konovalov <andreyknvl@google.com> > > + * > > + * This program is free software; you can redistribute it and/or modify > > + * it under the terms of the GNU General Public License version 2 as > > + * published by the Free Software Foundation. > > + * > > I do not think we put the "This program is ..." preamble in new files > anymore. It should be covered by SPDX tag above. > > > + */ > > + > > +#include <linux/kasan.h> > > +#include <linux/kernel.h> > > +#include <linux/memory.h> > > +#include <linux/mm.h> > > +#include <linux/string.h> > > +#include <linux/types.h> > > + > > +#include "kasan.h" > > + > > +void kasan_init_tags(void) > > +{ > > + init_tags(KASAN_TAG_MAX); > > +} > > + > > +void *kasan_reset_tag(const void *addr) > > +{ > > + return reset_tag(addr); > > +} > > + > > To help readability, would this edit be ok? > ------ > void kasan_poison_memory(const void *address, size_t size, u8 value) > { > - set_mem_tag_range(reset_tag(address), > - round_up(size, KASAN_GRANULE_SIZE), value); > + set_mem_tag_range(reset_tag(address), round_up(size, KASAN_GRANULE_SIZE), value); > } > > void kasan_unpoison_memory(const void *address, size_t size) > { > - set_mem_tag_range(reset_tag(address), > - round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); > + set_mem_tag_range(reset_tag(address), round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); > } > ------ > > > +void kasan_poison_memory(const void *address, size_t size, u8 value) > > +{ > > + set_mem_tag_range(reset_tag(address), > > + round_up(size, KASAN_GRANULE_SIZE), value); > > +} > > + > > +void kasan_unpoison_memory(const void *address, size_t size) > > +{ > > + set_mem_tag_range(reset_tag(address), > > + round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); > > +} > > + > > +u8 random_tag(void) > > +{ > > + return get_random_tag(); > > +} > > + > > +bool check_invalid_free(void *addr) > > +{ > > + u8 ptr_tag = get_tag(addr); > > + u8 mem_tag = get_mem_tag(addr); > > + > > > Why not just: > ------ > - if (shadow_byte == KASAN_TAG_INVALID) > - return true; > - if (tag != KASAN_TAG_KERNEL && tag != shadow_byte) > - return true; > - return false; > + return shadow_byte == KASAN_TAG_INVALID || > + (tag != KASAN_TAG_KERNEL && tag != shadow_byte); > } > ------ > > > + if (mem_tag == KASAN_TAG_INVALID) > > + return true; > > + if (ptr_tag != KASAN_TAG_KERNEL && ptr_tag != mem_tag) > > + return true; > > + return false; > > +} > > + Will fix all these in v3, thanks!
On Tue, Sep 15, 2020 at 11:16PM +0200, Andrey Konovalov wrote: > diff --git a/include/linux/kasan.h b/include/linux/kasan.h > index 875bbcedd994..613c9d38eee5 100644 > --- a/include/linux/kasan.h > +++ b/include/linux/kasan.h > @@ -184,7 +184,7 @@ static inline void kasan_record_aux_stack(void *ptr) {} > > #endif /* CONFIG_KASAN_GENERIC */ > > -#ifdef CONFIG_KASAN_SW_TAGS > +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) > > void kasan_init_tags(void); > > @@ -193,7 +193,7 @@ void *kasan_reset_tag(const void *addr); > bool kasan_report(unsigned long addr, size_t size, > bool is_write, unsigned long ip); > > -#else /* CONFIG_KASAN_SW_TAGS */ > +#else /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */ > > static inline void kasan_init_tags(void) { } > > @@ -202,7 +202,7 @@ static inline void *kasan_reset_tag(const void *addr) > return (void *)addr; > } > > -#endif /* CONFIG_KASAN_SW_TAGS */ > +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS*/ > > #ifdef CONFIG_KASAN_VMALLOC It's not visible by looking at this diff, but there is some #ifdef-redundancy that I do not understand where it came from. This is what I have to fix it: diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 613c9d38eee5..80a0e5b11f2b 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -40,6 +40,12 @@ static inline void *kasan_mem_to_shadow(const void *addr) int kasan_add_zero_shadow(void *start, unsigned long size); void kasan_remove_zero_shadow(void *start, unsigned long size); +/* Enable reporting bugs after kasan_disable_current() */ +extern void kasan_enable_current(void); + +/* Disable reporting bugs for current task */ +extern void kasan_disable_current(void); + #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ static inline int kasan_add_zero_shadow(void *start, unsigned long size) @@ -50,18 +56,6 @@ static inline void kasan_remove_zero_shadow(void *start, unsigned long size) {} -#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ - -#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) - -/* Enable reporting bugs after kasan_disable_current() */ -extern void kasan_enable_current(void); - -/* Disable reporting bugs for current task */ -extern void kasan_disable_current(void); - -#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ - static inline void kasan_enable_current(void) {} static inline void kasan_disable_current(void) {}
On Fri, Sep 18, 2020 at 5:19 PM Marco Elver <elver@google.com> wrote: > > On Tue, Sep 15, 2020 at 11:16PM +0200, Andrey Konovalov wrote: > > > diff --git a/include/linux/kasan.h b/include/linux/kasan.h > > index 875bbcedd994..613c9d38eee5 100644 > > --- a/include/linux/kasan.h > > +++ b/include/linux/kasan.h > > @@ -184,7 +184,7 @@ static inline void kasan_record_aux_stack(void *ptr) {} > > > > #endif /* CONFIG_KASAN_GENERIC */ > > > > -#ifdef CONFIG_KASAN_SW_TAGS > > +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) > > > > void kasan_init_tags(void); > > > > @@ -193,7 +193,7 @@ void *kasan_reset_tag(const void *addr); > > bool kasan_report(unsigned long addr, size_t size, > > bool is_write, unsigned long ip); > > > > -#else /* CONFIG_KASAN_SW_TAGS */ > > +#else /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */ > > > > static inline void kasan_init_tags(void) { } > > > > @@ -202,7 +202,7 @@ static inline void *kasan_reset_tag(const void *addr) > > return (void *)addr; > > } > > > > -#endif /* CONFIG_KASAN_SW_TAGS */ > > +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS*/ > > > > #ifdef CONFIG_KASAN_VMALLOC > > It's not visible by looking at this diff, but there is some > #ifdef-redundancy that I do not understand where it came from. > > This is what I have to fix it: > > diff --git a/include/linux/kasan.h b/include/linux/kasan.h > index 613c9d38eee5..80a0e5b11f2b 100644 > --- a/include/linux/kasan.h > +++ b/include/linux/kasan.h > @@ -40,6 +40,12 @@ static inline void *kasan_mem_to_shadow(const void *addr) > int kasan_add_zero_shadow(void *start, unsigned long size); > void kasan_remove_zero_shadow(void *start, unsigned long size); > > +/* Enable reporting bugs after kasan_disable_current() */ > +extern void kasan_enable_current(void); > + > +/* Disable reporting bugs for current task */ > +extern void kasan_disable_current(void); > + > #else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ > > static inline int kasan_add_zero_shadow(void *start, unsigned long size) > @@ -50,18 +56,6 @@ static inline void kasan_remove_zero_shadow(void *start, > unsigned long size) > {} > > -#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ > - > -#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) > - > -/* Enable reporting bugs after kasan_disable_current() */ > -extern void kasan_enable_current(void); > - > -/* Disable reporting bugs for current task */ > -extern void kasan_disable_current(void); > - > -#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ > - > static inline void kasan_enable_current(void) {} > static inline void kasan_disable_current(void) {} Oh yeah, I'll fix this, thanks!
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h index de9af7bea90d..b5d6b824c21c 100644 --- a/arch/arm64/include/asm/memory.h +++ b/arch/arm64/include/asm/memory.h @@ -215,7 +215,7 @@ static inline unsigned long kaslr_offset(void) (__force __typeof__(addr))__addr; \ }) -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) #define __tag_shifted(tag) ((u64)(tag) << 56) #define __tag_reset(addr) __untagged_addr(addr) #define __tag_get(addr) (__u8)((u64)(addr) >> 56) @@ -223,7 +223,7 @@ static inline unsigned long kaslr_offset(void) #define __tag_shifted(tag) 0UL #define __tag_reset(addr) (addr) #define __tag_get(addr) 0 -#endif /* CONFIG_KASAN_SW_TAGS */ +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */ static inline const void *__tag_set(const void *addr, u8 tag) { diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index 77c4c9bad1b8..5985be8af2c6 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -358,7 +358,6 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) smp_init_cpus(); smp_build_mpidr_hash(); - /* Init percpu seeds for random tags after cpus are set up. */ kasan_init_tags(); #ifdef CONFIG_ARM64_SW_TTBR0_PAN diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 875bbcedd994..613c9d38eee5 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -184,7 +184,7 @@ static inline void kasan_record_aux_stack(void *ptr) {} #endif /* CONFIG_KASAN_GENERIC */ -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) void kasan_init_tags(void); @@ -193,7 +193,7 @@ void *kasan_reset_tag(const void *addr); bool kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip); -#else /* CONFIG_KASAN_SW_TAGS */ +#else /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */ static inline void kasan_init_tags(void) { } @@ -202,7 +202,7 @@ static inline void *kasan_reset_tag(const void *addr) return (void *)addr; } -#endif /* CONFIG_KASAN_SW_TAGS */ +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS*/ #ifdef CONFIG_KASAN_VMALLOC diff --git a/include/linux/mm.h b/include/linux/mm.h index 4312c6c808e9..a3cac68c737c 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1411,7 +1411,7 @@ static inline bool cpupid_match_pid(struct task_struct *task, int cpupid) } #endif /* CONFIG_NUMA_BALANCING */ -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) static inline u8 page_kasan_tag(const struct page *page) { return (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK; diff --git a/include/linux/page-flags-layout.h b/include/linux/page-flags-layout.h index e200eef6a7fd..7d4ec26d8a3e 100644 --- a/include/linux/page-flags-layout.h +++ b/include/linux/page-flags-layout.h @@ -77,7 +77,7 @@ #define LAST_CPUPID_SHIFT 0 #endif -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) #define KASAN_TAG_WIDTH 8 #else #define KASAN_TAG_WIDTH 0 diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile index 0789f9023884..f8cf9ba674a1 100644 --- a/mm/kasan/Makefile +++ b/mm/kasan/Makefile @@ -10,9 +10,11 @@ CFLAGS_REMOVE_init.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_quarantine.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report_generic.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_report_tags_hw.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report_tags_sw.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_shadow.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_tags_sw.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_tags_hw.o = $(CC_FLAGS_FTRACE) # Function splitter causes unnecessary splits in __asan_load1/__asan_store1 # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533 @@ -27,10 +29,13 @@ CFLAGS_init.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_quarantine.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report_generic.o := $(CC_FLAGS_KASAN_RUNTIME) +CFLAGS_report_tags_hw.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report_tags_sw.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_shadow.o := $(CC_FLAGS_KASAN_RUNTIME) +CFLAGS_tags_hw.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_tags_sw.o := $(CC_FLAGS_KASAN_RUNTIME) obj-$(CONFIG_KASAN) := common.o report.o obj-$(CONFIG_KASAN_GENERIC) += init.o generic.o report_generic.o shadow.o quarantine.o obj-$(CONFIG_KASAN_SW_TAGS) += init.o report_tags_sw.o shadow.o tags_sw.o +obj-$(CONFIG_KASAN_HW_TAGS) += tags_hw.o report_tags_hw.o diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 41c7f1105eaa..412a23d1546b 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -118,7 +118,7 @@ void kasan_free_pages(struct page *page, unsigned int order) */ static inline unsigned int optimal_redzone(unsigned int object_size) { - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) + if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) return 0; return @@ -183,14 +183,14 @@ size_t kasan_metadata_size(struct kmem_cache *cache) struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache, const void *object) { - return (void *)object + cache->kasan_info.alloc_meta_offset; + return (void *)reset_tag(object) + cache->kasan_info.alloc_meta_offset; } struct kasan_free_meta *get_free_info(struct kmem_cache *cache, const void *object) { BUILD_BUG_ON(sizeof(struct kasan_free_meta) > 32); - return (void *)object + cache->kasan_info.free_meta_offset; + return (void *)reset_tag(object) + cache->kasan_info.free_meta_offset; } void kasan_poison_slab(struct page *page) @@ -272,7 +272,8 @@ void * __must_check kasan_init_slab_obj(struct kmem_cache *cache, alloc_info = get_alloc_info(cache, object); __memset(alloc_info, 0, sizeof(*alloc_info)); - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || + IS_ENABLED(CONFIG_KASAN_HW_TAGS)) object = set_tag(object, assign_tag(cache, object, true, false)); @@ -342,10 +343,11 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object, redzone_end = round_up((unsigned long)object + cache->object_size, KASAN_GRANULE_SIZE); - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || + IS_ENABLED(CONFIG_KASAN_HW_TAGS)) tag = assign_tag(cache, object, false, keep_tag); - /* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */ + /* Tag is ignored in set_tag without CONFIG_KASAN_SW/HW_TAGS */ kasan_unpoison_memory(set_tag(object, tag), size); kasan_poison_memory((void *)redzone_start, redzone_end - redzone_start, KASAN_KMALLOC_REDZONE); diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index ba63d8a62968..1e9eda217be7 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -152,6 +152,10 @@ struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache, struct kasan_free_meta *get_free_info(struct kmem_cache *cache, const void *object); +void kasan_poison_memory(const void *address, size_t size, u8 value); + +#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) + static inline const void *kasan_shadow_to_mem(const void *shadow_addr) { return (void *)(((unsigned long)shadow_addr - KASAN_SHADOW_OFFSET) @@ -163,8 +167,6 @@ static inline bool addr_has_metadata(const void *addr) return (addr >= kasan_shadow_to_mem((void *)KASAN_SHADOW_START)); } -void kasan_poison_memory(const void *address, size_t size, u8 value); - /** * check_memory_region - Check memory region, and report if invalid access. * @addr: the accessed address @@ -176,6 +178,15 @@ void kasan_poison_memory(const void *address, size_t size, u8 value); bool check_memory_region(unsigned long addr, size_t size, bool write, unsigned long ret_ip); +#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ + +static inline bool addr_has_metadata(const void *addr) +{ + return true; +} + +#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ + bool check_invalid_free(void *addr); void *find_first_bad_addr(void *addr, size_t size); @@ -212,7 +223,7 @@ static inline void quarantine_reduce(void) { } static inline void quarantine_remove_cache(struct kmem_cache *cache) { } #endif -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) void print_tags(u8 addr_tag, const void *addr); diff --git a/mm/kasan/report_tags_hw.c b/mm/kasan/report_tags_hw.c new file mode 100644 index 000000000000..c2f73c46279a --- /dev/null +++ b/mm/kasan/report_tags_hw.c @@ -0,0 +1,47 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * This file contains hardware tag-based KASAN specific error reporting code. + * + * Copyright (c) 2020 Google, Inc. + * Author: Andrey Konovalov <andreyknvl@google.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#include <linux/kasan.h> +#include <linux/kernel.h> +#include <linux/memory.h> +#include <linux/mm.h> +#include <linux/string.h> +#include <linux/types.h> + +#include "kasan.h" + +const char *get_bug_type(struct kasan_access_info *info) +{ + return "invalid-access"; +} + +void *find_first_bad_addr(void *addr, size_t size) +{ + return reset_tag(addr); +} + +void metadata_fetch_row(char *buffer, void *row) +{ + int i; + + for (i = 0; i < META_BYTES_PER_ROW; i++) + buffer[i] = mte_get_mem_tag(row + i * KASAN_GRANULE_SIZE); +} + +void print_tags(u8 addr_tag, const void *addr) +{ + u8 memory_tag = mte_get_mem_tag((void *)addr); + + pr_err("Pointer tag: [%02x], memory tag: [%02x]\n", + addr_tag, memory_tag); +} diff --git a/mm/kasan/report_tags_sw.c b/mm/kasan/report_tags_sw.c index 4060d0503462..b2894902bc47 100644 --- a/mm/kasan/report_tags_sw.c +++ b/mm/kasan/report_tags_sw.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 /* - * This file contains tag-based KASAN specific error reporting code. + * This file contains software tag-based KASAN specific error reporting code. * * Copyright (c) 2014 Samsung Electronics Co., Ltd. * Author: Andrey Ryabinin <ryabinin.a.a@gmail.com> diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c index 4888084ecdfc..ca69726adf8f 100644 --- a/mm/kasan/shadow.c +++ b/mm/kasan/shadow.c @@ -111,7 +111,7 @@ void kasan_unpoison_memory(const void *address, size_t size) if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) *shadow = tag; - else + else /* CONFIG_KASAN_GENERIC */ *shadow = size & KASAN_GRANULE_MASK; } } diff --git a/mm/kasan/tags_hw.c b/mm/kasan/tags_hw.c new file mode 100644 index 000000000000..c93d43379e39 --- /dev/null +++ b/mm/kasan/tags_hw.c @@ -0,0 +1,78 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * This file contains core hardware tag-based KASAN code. + * + * Copyright (c) 2020 Google, Inc. + * Author: Andrey Konovalov <andreyknvl@google.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#include <linux/kasan.h> +#include <linux/kernel.h> +#include <linux/memory.h> +#include <linux/mm.h> +#include <linux/string.h> +#include <linux/types.h> + +#include "kasan.h" + +void kasan_init_tags(void) +{ + init_tags(KASAN_TAG_MAX); +} + +void *kasan_reset_tag(const void *addr) +{ + return reset_tag(addr); +} + +void kasan_poison_memory(const void *address, size_t size, u8 value) +{ + set_mem_tag_range(reset_tag(address), + round_up(size, KASAN_GRANULE_SIZE), value); +} + +void kasan_unpoison_memory(const void *address, size_t size) +{ + set_mem_tag_range(reset_tag(address), + round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); +} + +u8 random_tag(void) +{ + return get_random_tag(); +} + +bool check_invalid_free(void *addr) +{ + u8 ptr_tag = get_tag(addr); + u8 mem_tag = get_mem_tag(addr); + + if (mem_tag == KASAN_TAG_INVALID) + return true; + if (ptr_tag != KASAN_TAG_KERNEL && ptr_tag != mem_tag) + return true; + return false; +} + +void kasan_set_free_info(struct kmem_cache *cache, + void *object, u8 tag) +{ + struct kasan_alloc_meta *alloc_meta; + + alloc_meta = get_alloc_info(cache, object); + kasan_set_track(&alloc_meta->free_track[0], GFP_NOWAIT); +} + +struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, + void *object, u8 tag) +{ + struct kasan_alloc_meta *alloc_meta; + + alloc_meta = get_alloc_info(cache, object); + return &alloc_meta->free_track[0]; +} diff --git a/mm/kasan/tags_sw.c b/mm/kasan/tags_sw.c index feb42c1763b8..3df978b8d1d9 100644 --- a/mm/kasan/tags_sw.c +++ b/mm/kasan/tags_sw.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 /* - * This file contains core tag-based KASAN code. + * This file contains core software tag-based KASAN code. * * Copyright (c) 2018 Google, Inc. * Author: Andrey Konovalov <andreyknvl@google.com>