| Message ID | 20220610152141.2148929-2-catalin.marinas@arm.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | kasan: Fix ordering between MTE tag colouring and page->flags | expand |
On 6/10/22 16:21, Catalin Marinas wrote: > __kasan_unpoison_pages() colours the memory with a random tag and stores > it in page->flags in order to re-create the tagged pointer via > page_to_virt() later. When the tag from the page->flags is read, ensure > that the in-memory tags are already visible by re-ordering the > page_kasan_tag_set() after kasan_unpoison(). The former already has > barriers in place through try_cmpxchg(). On the reader side, the order > is ensured by the address dependency between page->flags and the memory > access. > > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> > Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> > Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> > Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> > --- > mm/kasan/common.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/mm/kasan/common.c b/mm/kasan/common.c > index c40c0e7b3b5f..78be2beb7453 100644 > --- a/mm/kasan/common.c > +++ b/mm/kasan/common.c > @@ -108,9 +108,10 @@ void __kasan_unpoison_pages(struct page *page, unsigned int order, bool init) > return; > > tag = kasan_random_tag(); > + kasan_unpoison(set_tag(page_address(page), tag), > + PAGE_SIZE << order, init); > for (i = 0; i < (1 << order); i++) > page_kasan_tag_set(page + i, tag); > - kasan_unpoison(page_address(page), PAGE_SIZE << order, init); > } > > void __kasan_poison_pages(struct page *page, unsigned int order, bool init)
On Fri, Jun 10, 2022 at 04:21:38PM +0100, Catalin Marinas wrote: > __kasan_unpoison_pages() colours the memory with a random tag and stores > it in page->flags in order to re-create the tagged pointer via > page_to_virt() later. When the tag from the page->flags is read, ensure > that the in-memory tags are already visible by re-ordering the > page_kasan_tag_set() after kasan_unpoison(). The former already has > barriers in place through try_cmpxchg(). On the reader side, the order > is ensured by the address dependency between page->flags and the memory > access. > > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> > Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> > Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> > Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> > --- > mm/kasan/common.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/mm/kasan/common.c b/mm/kasan/common.c > index c40c0e7b3b5f..78be2beb7453 100644 > --- a/mm/kasan/common.c > +++ b/mm/kasan/common.c > @@ -108,9 +108,10 @@ void __kasan_unpoison_pages(struct page *page, unsigned int order, bool init) > return; > > tag = kasan_random_tag(); > + kasan_unpoison(set_tag(page_address(page), tag), > + PAGE_SIZE << order, init); > for (i = 0; i < (1 << order); i++) > page_kasan_tag_set(page + i, tag); > - kasan_unpoison(page_address(page), PAGE_SIZE << order, init); This looks good to me, but after reading the cover letter I'm wondering whether the try_cmpxchg() in page_kasan_tag_set() could be relaxed to try_cmpxchg_release() as a separate optimisation? Will
On Thu, Jul 07, 2022 at 10:22:37AM +0100, Will Deacon wrote: > On Fri, Jun 10, 2022 at 04:21:38PM +0100, Catalin Marinas wrote: > > __kasan_unpoison_pages() colours the memory with a random tag and stores > > it in page->flags in order to re-create the tagged pointer via > > page_to_virt() later. When the tag from the page->flags is read, ensure > > that the in-memory tags are already visible by re-ordering the > > page_kasan_tag_set() after kasan_unpoison(). The former already has > > barriers in place through try_cmpxchg(). On the reader side, the order > > is ensured by the address dependency between page->flags and the memory > > access. > > > > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com> > > Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com> > > Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com> > > Cc: Vincenzo Frascino <vincenzo.frascino@arm.com> > > --- > > mm/kasan/common.c | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/mm/kasan/common.c b/mm/kasan/common.c > > index c40c0e7b3b5f..78be2beb7453 100644 > > --- a/mm/kasan/common.c > > +++ b/mm/kasan/common.c > > @@ -108,9 +108,10 @@ void __kasan_unpoison_pages(struct page *page, unsigned int order, bool init) > > return; > > > > tag = kasan_random_tag(); > > + kasan_unpoison(set_tag(page_address(page), tag), > > + PAGE_SIZE << order, init); > > for (i = 0; i < (1 << order); i++) > > page_kasan_tag_set(page + i, tag); > > - kasan_unpoison(page_address(page), PAGE_SIZE << order, init); > > This looks good to me, but after reading the cover letter I'm wondering > whether the try_cmpxchg() in page_kasan_tag_set() could be relaxed to > try_cmpxchg_release() as a separate optimisation? I think it can be a try_cmpxchg_release() (I did not realise we have one). I'll post a patch later today.
diff --git a/mm/kasan/common.c b/mm/kasan/common.c index c40c0e7b3b5f..78be2beb7453 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -108,9 +108,10 @@ void __kasan_unpoison_pages(struct page *page, unsigned int order, bool init) return; tag = kasan_random_tag(); + kasan_unpoison(set_tag(page_address(page), tag), + PAGE_SIZE << order, init); for (i = 0; i < (1 << order); i++) page_kasan_tag_set(page + i, tag); - kasan_unpoison(page_address(page), PAGE_SIZE << order, init); } void __kasan_poison_pages(struct page *page, unsigned int order, bool init)