From patchwork Tue Dec 7 18:32:25 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 12695184 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 11EBCC433EF for ; Tue, 7 Dec 2021 18:34:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=isGgLIBFB34trPjKdy+YWBZsNp7atBNENz+yh0tgN/w=; b=izrdXyHP7ciGpZ Hv48x1+9hQcIfAGQC1VRAd0LQuD612tKmEfPi5/Th3Z6cbonq7XA7rn/fOW43g0+upSPzvV50xBDS 53bZHUgxpz5bQZ4R25CVbHCTcPW257fs1U6N60JC6zh4nU3E6A6RITQye+F8nI6cSNUSmg/E2v1tK 1XQr4Dj7vcYHhY/7g+9++pkso9Wy/xccGkBOQ2tUYr1CSu8LbrsUJ2Dahnh/HrPilEp4dYA/QVHdy 8mn62XypXCP3PuIgw+05OCVVfGoDgj2waW1SSNkX9rAZeea0fVGnCau57JNKarrz+FtmY6+k3jDEL mHbc3Drx/3s1BIPLbH0Q==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mufHA-009mni-9N; Tue, 07 Dec 2021 18:33:16 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mufGU-009mYr-5E for linux-arm-kernel@lists.infradead.org; Tue, 07 Dec 2021 18:32:35 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 531E311FB; Tue, 7 Dec 2021 10:32:33 -0800 (PST) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 383713F73B; Tue, 7 Dec 2021 10:32:32 -0800 (PST) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: andreyknvl@gmail.com, catalin.marinas@arm.com, dvyukov@google.com, glider@google.com, mark.rutland@arm.com, ryabinin.a.a@gmail.com, will@kernel.org Subject: [PATCH v2 1/2] arm64: mm: use die_kernel_fault() in do_mem_abort() Date: Tue, 7 Dec 2021 18:32:25 +0000 Message-Id: <20211207183226.834557-2-mark.rutland@arm.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211207183226.834557-1-mark.rutland@arm.com> References: <20211207183226.834557-1-mark.rutland@arm.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211207_103234_292099_816790D6 X-CRM114-Status: GOOD ( 12.74 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org If we take an unhandled fault from EL1, either: a) The xFSC handler calls die_kernel_fault() directly. In this case, die_kernel_fault() calls: pr_alert(..., msg, addr); mem_abort_decode(esr); show_pte(addr); die(); bust_spinlocks(0); do_exit(SIGKILL); b) The xFSC handler returns to do_mem_abort(), indicating failure. In this case, do_mem_abort() calls: pr_alert(..., addr); mem_abort_decode(esr); show_pte(addr); arm64_notify_die() { die(); } This inconstency is unfortunatem, and in theory in case (b) registered notifiers can prevent us from terminating the faulting thread by returning NOTIFY_STOP, whereupon we'll end up returning from the fault, replaying, and almost certainly get stuck in a livelock spewing errors into dmesg. We don't expect notifers to fix things up, since we dump state to dmesg before invoking them, so it would be more sensible to consistently terminate the thread in this case. This patch has do_mem_abort() call die_kernel_fault() for unhandled faults taken from EL1. Where we would previously have logged a messafe of the form: | Unhandled fault at ${ADDR} ... we will now log a message of the form: | Unable to handle kernel ${FAULT_NAME} at virtual address ${ADDR} ... and we will consistently terminate the thread from which the fault was taken. Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: Will Deacon --- arch/arm64/mm/fault.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 9ae24e3b72be..b7b9caa41bc7 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -813,11 +813,8 @@ void do_mem_abort(unsigned long far, unsigned int esr, struct pt_regs *regs) if (!inf->fn(far, esr, regs)) return; - if (!user_mode(regs)) { - pr_alert("Unhandled fault at 0x%016lx\n", addr); - mem_abort_decode(esr); - show_pte(addr); - } + if (!user_mode(regs)) + die_kernel_fault(inf->name, addr, esr, regs); /* * At this point we have an unrecognized fault type whose tag bits may From patchwork Tue Dec 7 18:32:26 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 12695185 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id E366DC433EF for ; Tue, 7 Dec 2021 18:35:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:Cc:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=gALKlVG7f25ixrQooMb20HzMzrGDAGouzNVyk0k9aLc=; b=AjZ5rU5UbbyynI K9nVuMGPuYs9+Yv34lmqShRNE5c3Y8rp4s9mQbsVOY1oQsSTqq6IDbT6+NfwdJ+fTLgvTz4uLxwZ0 mNHzTJ9yCGH/8WIMlEgHDPXUJHXgGriuv1koUKhnOfi8Pej9vVEwEpYUYOYZ9gPmmbIw+TbrIVTyv 25CUaK0l157nm95sybZrpDpj8EpKfFZKfY2nta0FLiR4XZ+onXVSXHhq6iKX+nine1nc1wdm86tNu KuJKF4k6Gfz2DzW0qeAaGrBdsjoq+67iBDRhqmmiuagiijXgATtC1+L1r6btx6XukOOunoYKsoJ4s dKM//fj1tLd6fDGksHkA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mufHf-009mxT-II; Tue, 07 Dec 2021 18:33:48 +0000 Received: from foss.arm.com ([217.140.110.172]) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mufGW-009ma5-Lt for linux-arm-kernel@lists.infradead.org; Tue, 07 Dec 2021 18:32:38 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 925B11063; Tue, 7 Dec 2021 10:32:35 -0800 (PST) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.121.207.14]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 76B143F73B; Tue, 7 Dec 2021 10:32:34 -0800 (PST) From: Mark Rutland To: linux-arm-kernel@lists.infradead.org Cc: andreyknvl@gmail.com, catalin.marinas@arm.com, dvyukov@google.com, glider@google.com, mark.rutland@arm.com, ryabinin.a.a@gmail.com, will@kernel.org Subject: [PATCH v2 2/2] arm64: mm: log potential KASAN shadow alias Date: Tue, 7 Dec 2021 18:32:26 +0000 Message-Id: <20211207183226.834557-3-mark.rutland@arm.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20211207183226.834557-1-mark.rutland@arm.com> References: <20211207183226.834557-1-mark.rutland@arm.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211207_103236_805930_DE308AA9 X-CRM114-Status: GOOD ( 10.84 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org When the kernel is built with KASAN_GENERIC or KASAN_SW_TAGS, shadow memory is allocated and mapped for all legitimate kernel addresses, and prior to a regular memory access instrumentation will read from the corresponding shadow address. Due to the way memory addresses are converted to shadow addresses, bogus pointers (e.g. NULL) can generate shadow addresses out of the bounds of allocated shadow memory. For example, with KASAN_GENERIC and 48-bit VAs, NULL would have a shadow address of dfff800000000000, which falls between the TTBR ranges. To make such cases easier to debug, this patch makes die_kernel_fault() dump the real memory address range for any potential KASAN shadow access using kasan_non_canonical_hook(), which results in fault information as below when KASAN is enabled: | Unable to handle kernel paging request at virtual address dfff800000000017 | KASAN: null-ptr-deref in range [0x00000000000000b8-0x00000000000000bf] | Mem abort info: | ESR = 0x96000004 | EC = 0x25: DABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | Data abort info: | ISV = 0, ISS = 0x00000004 | CM = 0, WnR = 0 | [dfff800000000017] address between user and kernel address ranges Signed-off-by: Mark Rutland Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Catalin Marinas Cc: Dmitry Vyukov Cc: Will Deacon --- arch/arm64/mm/fault.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index b7b9caa41bc7..9a9e7675b187 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -297,6 +297,8 @@ static void die_kernel_fault(const char *msg, unsigned long addr, pr_alert("Unable to handle kernel %s at virtual address %016lx\n", msg, addr); + kasan_non_canonical_hook(addr); + mem_abort_decode(esr); show_pte(addr);