From patchwork Tue Jan 24 20:40:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 13114795 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 986E4C54E94 for ; Tue, 24 Jan 2023 20:40:15 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 326976B0072; Tue, 24 Jan 2023 15:40:15 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 2AF766B0075; Tue, 24 Jan 2023 15:40:15 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 176C56B0078; Tue, 24 Jan 2023 15:40:15 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 059C66B0072 for ; Tue, 24 Jan 2023 15:40:15 -0500 (EST) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id CD48CC08E6 for ; Tue, 24 Jan 2023 20:40:14 +0000 (UTC) X-FDA: 80390859948.04.A56F874 Received: from out0.migadu.com (out0.migadu.com [94.23.1.103]) by imf23.hostedemail.com (Postfix) with ESMTP id 23A7D14000A for ; Tue, 24 Jan 2023 20:40:12 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=LRQ50Wlw; spf=pass (imf23.hostedemail.com: domain of andrey.konovalov@linux.dev designates 94.23.1.103 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1674592813; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:references:dkim-signature; bh=1AR/rv3Oa6O7jvIvFBjmYxJ41m4mSBsPB4PLJyrZR80=; b=Vz4pNS20LrScLhQ7afUAMm4g+y2XISlkgBrKMcSrIdNwjB4QMrzIZvSCURvZ8l+BLuLnET 1I2q4Fs4b9gYouR9ZFyNnFnGupOhHmopF1o25KLp6ImAZtBnfpCrBJPynTvxdxrg01MgjP ZIBkRIMQYxwsEMu2l9o3Tp+TM1fKVXY= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=LRQ50Wlw; spf=pass (imf23.hostedemail.com: domain of andrey.konovalov@linux.dev designates 94.23.1.103 as permitted sender) smtp.mailfrom=andrey.konovalov@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1674592813; a=rsa-sha256; cv=none; b=wzD0MNdYGEfGEZm0JMPbqA6Vj1dMOE+IZKCiw3J0ejgEa9Gd3rHf66p3mBakN/SfLTGSH6 AiMYfW5KjEp6lBh96UvWzfrFxbmySNzsYI5hePVEY7LYzHotx97MQPss1zFXqpqg0RTySk mIw4YUcNroQTLTjM2JYY+IJKJPYHJvI= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1674592811; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=1AR/rv3Oa6O7jvIvFBjmYxJ41m4mSBsPB4PLJyrZR80=; b=LRQ50Wlwhf1P8ib6bD5y2GyXEpsCFdUF085x/dfwV/VvezEeAHY1OezRZK/hl25p+jY+mi Tz8huiM9NBELezIT+858ud6mKtFPdqQ6cK4fT5RFKBZUFO4UUWv1VJmYvADVVCuCJ/1Jn/ 635A+wFIPnEfuPGzLQjo/LPVYOalXt0= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov , Peter Collingbourne Subject: [PATCH v2 mm] kasan: reset page tags properly with sampling Date: Tue, 24 Jan 2023 21:40:09 +0100 Message-Id: <5dbd866714b4839069e2d8469ac45b60953db290.1674592780.git.andreyknvl@google.com> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 23A7D14000A X-Stat-Signature: c44h76hnn9w9eyq7hexsoqm9r5ut6dt6 X-Rspam-User: X-HE-Tag: 1674592812-142335 X-HE-Meta: U2FsdGVkX1+BjjcIkKjCpga5V+k2erHnHCzaR4D7iJUdn8Fl6yKt2o3fkPA2ZgTfch9c109DOjTOdlwXXWDSCLOcGmY1ywNq0jy23BfwgMcM74pggk1m1EUn1d6/9wfMeXs2ilJu23ZfzkSsLOgzx8CIsEd2rHjPgNfWulaHw0lBJVXRvvRqA1xBtxAta2fm4PBPNdf+ftUGdcUto9DmOGIRW6JW06qK89x0oe8awvYSrWrqhcUNPKJ8onB2M/E7QNR2SvVpagmXiCvBYCo2VrkQLkbDECmDy3GAuK7elX8kXezGHDYeY/GzvTzQOQWUZxWydEp4/3z3U0IvchqBdpuWJ5FA2V6xqxqb2Dx++T3FSi/SbIw7ckGTQNpgn9TPBPw+0d9XrOWQu+yYqlz3lyyRI1Zdpjqa373Qehd9tx6UYrkMxsIf5FH3n1VumUlupFxSODiL+CfzWvJ5R9hvkDlT+Uo7PDBGi2cvhewGtg9KKb3GpyxvnDqeUB21WlG9Ba3guwDwzZiKwZYDHIxGn9YAijEovogrd+6h0bs4BZHUugvVLmXK8CUzC3CXfvz6kwWUKaJkNZMWvob2VrNqF8x/RssC+avY4I+YnLqAWYiRe5HBjVbkf1zZFJjXjvmTQpOs5mm91Z7fvXKlz3Bqx9p2/SNv6JACQRUOumnj3MHzxnjP8g4ACqDiSlfSc+f4Wd8nwV6TeMTiFdwEIBM9Oz1mYN08sjq/8wSefFNkCEW9y5dDNcyXrbVev59SmXB5uO4vlrLEnl5xjJEGrAaBQznvu+Lg06frJv7+Q4OMgEzDQdK+SmCNduZyLUgeHRDekS47IG2/QvwlqMyGAF5Qf359Z0y1M2Wb/BSlvfkuEL3r8hmSmuyIvk/y4oXpfCSYQNhcyF0akDQGEnG9AKMg1NqiyUg10uhdSqZGt+n2MG4oNH/3XFrZ720RjUICDo7NnswY+7Lz4ha1ni1kNMG MUO21Yor bwbePA1Ff6ALheCyMPwMjyi2IQHUdzyq8FLT7ozWiq7WUUyYOpqN0Aj+wS7o4FYfjqbBiNvuvuFaKiGbY/90OZSAycOzF7DMhcTbn0ZoAQHeqccfsy0SKDTFLTmpz7L8ODz0/ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Andrey Konovalov The implementation of page_alloc poisoning sampling assumed that tag_clear_highpage resets page tags for __GFP_ZEROTAGS allocations. However, this is no longer the case since commit 70c248aca9e7 ("mm: kasan: Skip unpoisoning of user pages"). This leads to kernel crashes when MTE-enabled userspace mappings are used with Hardware Tag-Based KASAN enabled. Reset page tags for __GFP_ZEROTAGS allocations in post_alloc_hook(). Also clarify and fix related comments. Reported-by: Peter Collingbourne Tested-by: Peter Collingbourne Signed-off-by: Andrey Konovalov --- mm/page_alloc.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 5514d84cc712..b917aebfd3d0 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2471,7 +2471,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, bool init = !want_init_on_free() && want_init_on_alloc(gfp_flags) && !should_skip_init(gfp_flags); bool zero_tags = init && (gfp_flags & __GFP_ZEROTAGS); - bool reset_tags = !zero_tags; + bool reset_tags = true; int i; set_page_private(page, 0); @@ -2498,7 +2498,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, * (which happens only when memory should be initialized as well). */ if (zero_tags) { - /* Initialize both memory and tags. */ + /* Initialize both memory and memory tags. */ for (i = 0; i != 1 << order; ++i) tag_clear_highpage(page + i); @@ -2516,14 +2516,15 @@ inline void post_alloc_hook(struct page *page, unsigned int order, } else { /* * KASAN decided to exclude this allocation from being - * poisoned due to sampling. Skip poisoning as well. + * (un)poisoned due to sampling. Make KASAN skip + * poisoning when the allocation is freed. */ SetPageSkipKASanPoison(page); } } /* - * If memory tags have not been set, reset the page tags to ensure - * page_address() dereferencing does not fault. + * If memory tags have not been set by KASAN, reset the page tags to + * ensure page_address() dereferencing does not fault. */ if (reset_tags) { for (i = 0; i != 1 << order; ++i)