| Message ID | b2aa056b65b8f1a410379bf2f6ef439d5d99e8eb.1541525354.git.andreyknvl@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | kasan: add software tag-based mode for arm64 | expand |
Hi Andrey, On Tue, Nov 06, 2018 at 06:30:23PM +0100, Andrey Konovalov wrote: > __kimg_to_phys (which is used by virt_to_phys) and _virt_addr_is_linear > (which is used by virt_addr_valid) assume that the top byte of the address > is 0xff, which isn't always the case with tag-based KASAN. I'm confused by this. Why/when do kimg address have a non-default tag? Any kimg address is part of the static kernel image, so it's not obvious to me how a kimg address would gain a tag. Could you please explain how this happens in the commit message? > This patch resets the tag in those macros. > > Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com> > Reviewed-by: Dmitry Vyukov <dvyukov@google.com> > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > --- > arch/arm64/include/asm/memory.h | 14 ++++++++++++-- > 1 file changed, 12 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h > index 0f1e024a951f..3226a0218b0b 100644 > --- a/arch/arm64/include/asm/memory.h > +++ b/arch/arm64/include/asm/memory.h > @@ -92,6 +92,15 @@ > #define KASAN_THREAD_SHIFT 0 > #endif > > +#ifdef CONFIG_KASAN_SW_TAGS > +#define KASAN_TAG_SHIFTED(tag) ((unsigned long)(tag) << 56) > +#define KASAN_SET_TAG(addr, tag) (((addr) & ~KASAN_TAG_SHIFTED(0xff)) | \ > + KASAN_TAG_SHIFTED(tag)) > +#define KASAN_RESET_TAG(addr) KASAN_SET_TAG(addr, 0xff) > +#else > +#define KASAN_RESET_TAG(addr) addr > +#endif Nit: the rest of the helper macros in this file are lower-case, with specialised helpers prefixed with several underscores. Could we please stick with that convention? e.g. have __tag_set() and __tag_reset() helpers. > + > #define MIN_THREAD_SHIFT (14 + KASAN_THREAD_SHIFT) > > /* > @@ -232,7 +241,7 @@ static inline unsigned long kaslr_offset(void) > #define __is_lm_address(addr) (!!((addr) & BIT(VA_BITS - 1))) > > #define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET) > -#define __kimg_to_phys(addr) ((addr) - kimage_voffset) > +#define __kimg_to_phys(addr) (KASAN_RESET_TAG(addr) - kimage_voffset) IIUC You need to adjust __lm_to_phys() too, since that could be passed an address from SLAB. Maybe that's done in a later patch, but if so it's confusing to split it out that way. It would be nicer to fix all the *_to_*() helpers in one go. > > #define __virt_to_phys_nodebug(x) ({ \ > phys_addr_t __x = (phys_addr_t)(x); \ > @@ -308,7 +317,8 @@ static inline void *phys_to_virt(phys_addr_t x) > #endif > #endif > > -#define _virt_addr_is_linear(kaddr) (((u64)(kaddr)) >= PAGE_OFFSET) > +#define _virt_addr_is_linear(kaddr) (KASAN_RESET_TAG((u64)(kaddr)) >= \ > + PAGE_OFFSET) This is painful to read. Could you please split this like: #define _virt_addr_is_linear(kaddr) \ (__tag_reset((u64)(kaddr)) >= PAGE_OFFSET) ... and we could reformat virt_addr_valid() in the same way while we're at it. Thanks, Mark.
On Tue, Nov 06, 2018 at 06:30:23PM +0100, Andrey Konovalov wrote: > --- a/arch/arm64/include/asm/memory.h > +++ b/arch/arm64/include/asm/memory.h > @@ -92,6 +92,15 @@ > #define KASAN_THREAD_SHIFT 0 > #endif > > +#ifdef CONFIG_KASAN_SW_TAGS > +#define KASAN_TAG_SHIFTED(tag) ((unsigned long)(tag) << 56) > +#define KASAN_SET_TAG(addr, tag) (((addr) & ~KASAN_TAG_SHIFTED(0xff)) | \ > + KASAN_TAG_SHIFTED(tag)) > +#define KASAN_RESET_TAG(addr) KASAN_SET_TAG(addr, 0xff) > +#else > +#define KASAN_RESET_TAG(addr) addr > +#endif I think we should reuse the untagged_addr() macro we have in uaccess.h (make it more general and move to another header file).
On Wed, Nov 7, 2018 at 5:52 PM, Mark Rutland <mark.rutland@arm.com> wrote: > Hi Andrey, > > On Tue, Nov 06, 2018 at 06:30:23PM +0100, Andrey Konovalov wrote: >> __kimg_to_phys (which is used by virt_to_phys) and _virt_addr_is_linear >> (which is used by virt_addr_valid) assume that the top byte of the address >> is 0xff, which isn't always the case with tag-based KASAN. > > I'm confused by this. Why/when do kimg address have a non-default tag? > > Any kimg address is part of the static kernel image, so it's not obvious > to me how a kimg address would gain a tag. Could you please explain how > this happens in the commit message? If kimg address always points into the kernel image, then it shouldn't be tagged, and this can be removed. > >> This patch resets the tag in those macros. >> >> Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com> >> Reviewed-by: Dmitry Vyukov <dvyukov@google.com> >> Signed-off-by: Andrey Konovalov <andreyknvl@google.com> >> --- >> arch/arm64/include/asm/memory.h | 14 ++++++++++++-- >> 1 file changed, 12 insertions(+), 2 deletions(-) >> >> diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h >> index 0f1e024a951f..3226a0218b0b 100644 >> --- a/arch/arm64/include/asm/memory.h >> +++ b/arch/arm64/include/asm/memory.h >> @@ -92,6 +92,15 @@ >> #define KASAN_THREAD_SHIFT 0 >> #endif >> >> +#ifdef CONFIG_KASAN_SW_TAGS >> +#define KASAN_TAG_SHIFTED(tag) ((unsigned long)(tag) << 56) >> +#define KASAN_SET_TAG(addr, tag) (((addr) & ~KASAN_TAG_SHIFTED(0xff)) | \ >> + KASAN_TAG_SHIFTED(tag)) >> +#define KASAN_RESET_TAG(addr) KASAN_SET_TAG(addr, 0xff) >> +#else >> +#define KASAN_RESET_TAG(addr) addr >> +#endif > > Nit: the rest of the helper macros in this file are lower-case, with > specialised helpers prefixed with several underscores. Could we please > stick with that convention? > > e.g. have __tag_set() and __tag_reset() helpers. Will do in v11. > >> + >> #define MIN_THREAD_SHIFT (14 + KASAN_THREAD_SHIFT) >> >> /* >> @@ -232,7 +241,7 @@ static inline unsigned long kaslr_offset(void) >> #define __is_lm_address(addr) (!!((addr) & BIT(VA_BITS - 1))) >> >> #define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET) >> -#define __kimg_to_phys(addr) ((addr) - kimage_voffset) >> +#define __kimg_to_phys(addr) (KASAN_RESET_TAG(addr) - kimage_voffset) > > IIUC You need to adjust __lm_to_phys() too, since that could be passed > an address from SLAB. > > Maybe that's done in a later patch, but if so it's confusing to split it > out that way. It would be nicer to fix all the *_to_*() helpers in one > go. __lm_to_phys() does & ~PAGE_OFFSET, so it resets the tag by itself. I can add an explicit __tag_reset() if you think it makes sense. > >> >> #define __virt_to_phys_nodebug(x) ({ \ >> phys_addr_t __x = (phys_addr_t)(x); \ >> @@ -308,7 +317,8 @@ static inline void *phys_to_virt(phys_addr_t x) >> #endif >> #endif >> >> -#define _virt_addr_is_linear(kaddr) (((u64)(kaddr)) >= PAGE_OFFSET) >> +#define _virt_addr_is_linear(kaddr) (KASAN_RESET_TAG((u64)(kaddr)) >= \ >> + PAGE_OFFSET) > > This is painful to read. Could you please split this like: > > #define _virt_addr_is_linear(kaddr) \ > (__tag_reset((u64)(kaddr)) >= PAGE_OFFSET) > > ... and we could reformat virt_addr_valid() in the same way while we're > at it. Will do in v11. Thanks!
On Wed, Nov 7, 2018 at 7:10 PM, Catalin Marinas <catalin.marinas@arm.com> wrote: > On Tue, Nov 06, 2018 at 06:30:23PM +0100, Andrey Konovalov wrote: >> --- a/arch/arm64/include/asm/memory.h >> +++ b/arch/arm64/include/asm/memory.h >> @@ -92,6 +92,15 @@ >> #define KASAN_THREAD_SHIFT 0 >> #endif >> >> +#ifdef CONFIG_KASAN_SW_TAGS >> +#define KASAN_TAG_SHIFTED(tag) ((unsigned long)(tag) << 56) >> +#define KASAN_SET_TAG(addr, tag) (((addr) & ~KASAN_TAG_SHIFTED(0xff)) | \ >> + KASAN_TAG_SHIFTED(tag)) >> +#define KASAN_RESET_TAG(addr) KASAN_SET_TAG(addr, 0xff) >> +#else >> +#define KASAN_RESET_TAG(addr) addr >> +#endif > > I think we should reuse the untagged_addr() macro we have in uaccess.h > (make it more general and move to another header file). Will do in v11, thanks!
On Wed, Nov 14, 2018 at 8:23 PM, Andrey Konovalov <andreyknvl@google.com> wrote: > On Wed, Nov 7, 2018 at 5:52 PM, Mark Rutland <mark.rutland@arm.com> wrote: >>> /* >>> @@ -232,7 +241,7 @@ static inline unsigned long kaslr_offset(void) >>> #define __is_lm_address(addr) (!!((addr) & BIT(VA_BITS - 1))) >>> >>> #define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET) >>> -#define __kimg_to_phys(addr) ((addr) - kimage_voffset) >>> +#define __kimg_to_phys(addr) (KASAN_RESET_TAG(addr) - kimage_voffset) >> >> IIUC You need to adjust __lm_to_phys() too, since that could be passed >> an address from SLAB. >> >> Maybe that's done in a later patch, but if so it's confusing to split it >> out that way. It would be nicer to fix all the *_to_*() helpers in one >> go. > > __lm_to_phys() does & ~PAGE_OFFSET, so it resets the tag by itself. I > can add an explicit __tag_reset() if you think it makes sense. Hi Mark, I think I've addressed all of your comments except for this one. Do you think it makes sense to add explicit __tag_reset() calls to __lm_to_phys() and a few other macros, that already set the tag to 0 by doing & ~PAGE_OFFSET? Thanks!
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h index 0f1e024a951f..3226a0218b0b 100644 --- a/arch/arm64/include/asm/memory.h +++ b/arch/arm64/include/asm/memory.h @@ -92,6 +92,15 @@ #define KASAN_THREAD_SHIFT 0 #endif +#ifdef CONFIG_KASAN_SW_TAGS +#define KASAN_TAG_SHIFTED(tag) ((unsigned long)(tag) << 56) +#define KASAN_SET_TAG(addr, tag) (((addr) & ~KASAN_TAG_SHIFTED(0xff)) | \ + KASAN_TAG_SHIFTED(tag)) +#define KASAN_RESET_TAG(addr) KASAN_SET_TAG(addr, 0xff) +#else +#define KASAN_RESET_TAG(addr) addr +#endif + #define MIN_THREAD_SHIFT (14 + KASAN_THREAD_SHIFT) /* @@ -232,7 +241,7 @@ static inline unsigned long kaslr_offset(void) #define __is_lm_address(addr) (!!((addr) & BIT(VA_BITS - 1))) #define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET) -#define __kimg_to_phys(addr) ((addr) - kimage_voffset) +#define __kimg_to_phys(addr) (KASAN_RESET_TAG(addr) - kimage_voffset) #define __virt_to_phys_nodebug(x) ({ \ phys_addr_t __x = (phys_addr_t)(x); \ @@ -308,7 +317,8 @@ static inline void *phys_to_virt(phys_addr_t x) #endif #endif -#define _virt_addr_is_linear(kaddr) (((u64)(kaddr)) >= PAGE_OFFSET) +#define _virt_addr_is_linear(kaddr) (KASAN_RESET_TAG((u64)(kaddr)) >= \ + PAGE_OFFSET) #define virt_addr_valid(kaddr) (_virt_addr_is_linear(kaddr) && \ _virt_addr_valid(kaddr))