From patchwork Tue Jan 24 20:35:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13114790 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB9D8C54E94 for ; Tue, 24 Jan 2023 20:35:37 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 59A556B0071; Tue, 24 Jan 2023 15:35:37 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 54AB56B0072; Tue, 24 Jan 2023 15:35:37 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 413726B0087; Tue, 24 Jan 2023 15:35:37 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 32E246B0071 for ; Tue, 24 Jan 2023 15:35:37 -0500 (EST) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 0F894140C96 for ; Tue, 24 Jan 2023 20:35:37 +0000 (UTC) X-FDA: 80390848314.28.46BADED Received: from out0.migadu.com (out0.migadu.com [94.23.1.103]) by imf13.hostedemail.com (Postfix) with ESMTP id 36C4F20015 for ; Tue, 24 Jan 2023 20:35:33 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=e31nyy9b; spf=pass (imf13.hostedemail.com: domain of andrey.konovalov@linux.dev designates 94.23.1.103 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1674592534; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=W129RU0688CMkJERFUWutZmKNSTdtW1e5I8TwXB2ZIY=; b=XHVrV+yyWA2uP0qWuUO28DO5DoMy7fBzxrv2e3S2JJm/WU1zqsHhdain63T/pGz1azWkiN aoBnjufk414rdBtqGjYFDyFyzEj2lm5fSb0zaeL1TSWJ2fYKqUa2qGeU7XzkbTpGEvgiqK WfEVTpZe8C9AuTA2u+cvlzctJQ1/pRU= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=e31nyy9b; spf=pass (imf13.hostedemail.com: domain of andrey.konovalov@linux.dev designates 94.23.1.103 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1674592534; a=rsa-sha256; cv=none; b=yCZpIJoPvbc0h10SYXYLDujWmGD4O8SH8RQwtjn+wCl9l/TWjy9yVVsOzUVYCXYylS4UHg us1raj2YtjSkKr/pCubQi7SyviSE/Pl3oNav2J9/X8uohAxktB/LOVehdeaCXur0PakJAS 3TU394JrZXHUcem3U8/1YthxltiFaF8= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1674592531; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=W129RU0688CMkJERFUWutZmKNSTdtW1e5I8TwXB2ZIY=; b=e31nyy9bI5fv1vwhrqpRnh+U2pkLv/1xPg2pfXBIWIJu0RShv4aqvIaHjX3TQEkMolQtVX Nrg1bR9X0605ML7hPoKOOeKm0K6UDReaF/dNTIeDXiGeIMJ9ZoU847qEmgu+2Ph58bP1+K NZnpKXZKxy9lMrD6KAPoFFyLOyFpt1c= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov , Peter Collingbourne Subject: [PATCH mm] kasan: reset page tags properly with sampling Date: Tue, 24 Jan 2023 21:35:26 +0100 Message-Id: <24ea20c1b19c2b4b56cf9f5b354915f8dbccfc77.1674592496.git.andreyknvl@google.com> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 36C4F20015 X-Rspam-User: X-Stat-Signature: rpxxakpegwbztwuua8uki17edc9du166 X-HE-Tag: 1674592533-149489 X-HE-Meta: U2FsdGVkX1+lV3hV8DVDEuddoVrfGV39zKFIik4bhXA9XQzCc2vvt/ebZ4D/ZnAZXOMl6Ro48Rh8S37J/KVXqpqouwOe8hLPAA6leb2BjWGDqrk43ZMRPu06l3UawQqOPG8BDlzLa432REgRSmKvo1IkL3EqKGW4o9uLIUvjhkFaANTpVI730WKrPO+weHRB79DZeKbjVouAWI/TwqbCQskpriPGdyTKJpV/00VzbEszAaEqAtwBc0aeZgI++2KHoNoEtPnVH0akpAnYeiXsEb0NkL61J5DQxqSxw3tZHcNPLWadPnDQRQN3FDYyXQRFw9tSjgpXEeS4EYfsipbM3uW7KOUVS5vJ49YJL2R19l37RnJ8cnHmHhw+dGCgAjKXn0mJr0rJ+tjPsXXcPPtYMTr7sSAYSVSKltm11lIkMSGf8nCvmUk+dX1aXh655aZX9o2Gln4Ds8D0B694U75DjP1qK8xordNnOnaP6R3MKEtgXI2AP12Vsl/edfmiiK3p6dWE0mpoq8bdEOyu49GvRtDZYyexciMsoIh42aHUntLSX5C9f/lw95IRE3fxRQaglszZcKJhfZqRkUC8hOZFrokKvVQEiFILpkiqbV14gOShKOJ6Qr8elu4ZwyQv0XVcVvEbTDtlndcDi4+Bz5e+IZHunjNqt1qWF5Spi3k1fWR+ihK1F787tEWYOG0JcydXq4vprnvYgzuBYMnlXUdYQ+TtU0A3Qj8dhwqTuHAFvNw9wRn1LJIUkEfZQHy9Gr4eWJ7cZrS6ogTjAA13JvRvCmTZv5boTnanPhb7bvVmIiBHYXbkqNpKLNIkxNpTm/70Gq4Ik3/z47jt88aontbyddm3raQ+InutzHnl+1Qs5yzs8Td9aJvNm1zduXqz6MfOhaBbEacAdbE3qe2vIBRc59gxNMN0TZX1Xdihk0jiB907cI1b1AkYSTkmJQiywJeRpJd11gS8rBE4C/3s8kp HJzZ4hqz Dolyp/5aQwRCHH12jDY19qG83n+RYVQ3ztgnZXGG77eWbrIhW9EBwXAWsQpMRAIovmuRG54fMGv8VoeiTfGBgOk20MDWIdvfc+THuRGeeE0A0Iog0Nt40E76Jib8yjhqglt/Z X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Andrey Konovalov The implementation of page_alloc poisoning sampling assumed that tag_clear_highpage resets page tags for __GFP_ZEROTAGS allocations. However, this is no longer the case since commit 70c248aca9e7 ("mm: kasan: Skip unpoisoning of user pages"). This leads to kernel crashes when MTE-enabled userspace mappings are used with Hardware Tag-Based KASAN enabled. Reset page tags for __GFP_ZEROTAGS allocations in post_alloc_hook(). Also clarify and fix related comments. Reported-by: Peter Collingbourne Tested-by: Peter Collingbourne Signed-off-by: Andrey Konovalov --- mm/page_alloc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 5514d84cc712..370d4f2c0276 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2471,7 +2471,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, bool init = !want_init_on_free() && want_init_on_alloc(gfp_flags) && !should_skip_init(gfp_flags); bool zero_tags = init && (gfp_flags & __GFP_ZEROTAGS); - bool reset_tags = !zero_tags; + bool reset_tags = true; int i; set_page_private(page, 0); @@ -2498,7 +2498,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, * (which happens only when memory should be initialized as well). */ if (zero_tags) { - /* Initialize both memory and tags. */ + /* Initialize both memory and memory tags. */ for (i = 0; i != 1 << order; ++i) tag_clear_highpage(page + i); @@ -2516,14 +2516,14 @@ inline void post_alloc_hook(struct page *page, unsigned int order, } else { /* * KASAN decided to exclude this allocation from being - * poisoned due to sampling. Skip poisoning as well. + * unpoisoned due to sampling. Skip poisoning as well. */ SetPageSkipKASanPoison(page); } } /* - * If memory tags have not been set, reset the page tags to ensure - * page_address() dereferencing does not fault. + * If memory tags have not been set by KASAN, reset the page tags to + * ensure page_address() dereferencing does not fault. */ if (reset_tags) { for (i = 0; i != 1 << order; ++i)