From patchwork Tue Jan 24 20:35:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 47888 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp2364776wrn; Tue, 24 Jan 2023 12:44:12 -0800 (PST) X-Google-Smtp-Source: AMrXdXtdChu1P4jlSrKaItG5yKOPVonU0YBqjn36wEWUBRovixgSOrkYCloDTdYaulRtoyAKWlbW X-Received: by 2002:a05:6402:27cf:b0:499:c332:3b50 with SMTP id c15-20020a05640227cf00b00499c3323b50mr42120199ede.39.1674593052663; Tue, 24 Jan 2023 12:44:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674593052; cv=none; d=google.com; s=arc-20160816; b=VTNq/OPoPhs8bwmQsHNlueAtsgT3lVBRwiAoCJ5CmukApfRyfh7iUjsHnvCdc5MW4y NnSGK8H64AS8zcYkfXZtrs+iqVzF5cs6XxVYfhP9aZHF3G2rx5ganRf/MPHcER12Jxee I3nz0OfdxihKCbrytrnEjqSPE3Qxs8cOXklOwKAJB0DZXDql80D+CxVjOmGtdD+pcPk/ kIXq+3oqCNyPRzKDFXFxTPfxPgBLyu9q9bIRfrqdV7vfCzVC38q6Sc5MW6XMZownHsnb x9JBIW0sadi/XYUsS6ExTkMMdDazh2NLGRpeBfc8qR62bsg/WgLx35rK66dOUKtAzR7g dB2Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=W129RU0688CMkJERFUWutZmKNSTdtW1e5I8TwXB2ZIY=; b=mjtNtU7Tc4lAoyCEPI2SxrT1IBjsnMS0fDlvRAotMrvEK/i/DlV5vSw9WRBfMtvCAc O2xQrbKqmK8bb65BUSsAwOHtZNpI7t+8huJPZrpIxVFpJJnTGWukrWse0ZM6to2wtsti KNF7qHMHqpCniaSlT8lzE91oEIk8QvLxQxrvdg5lEQ3jSF7/ulKaKT2S9O5JKSm/O9X4 akNb9z3r56KidJWmq9kOMKXpfVz2mkuDhL41InYjRVA/bbgW8xDAba4veLlpKGtmZYZz UecGFIIqz9yFAtDW336EA9LWN3rOF9RXhuUGGXYiLkragEhUpO1TSWPd/FbxORLnMP18 e52w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.dev header.s=key1 header.b=e31nyy9b; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.dev Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id b13-20020a056402350d00b004a001353e18si4861228edd.72.2023.01.24.12.43.48; Tue, 24 Jan 2023 12:44:12 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.dev header.s=key1 header.b=e31nyy9b; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.dev Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234042AbjAXUff (ORCPT + 99 others); Tue, 24 Jan 2023 15:35:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47250 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229482AbjAXUfe (ORCPT ); Tue, 24 Jan 2023 15:35:34 -0500 Received: from out0.migadu.com (out0.migadu.com [94.23.1.103]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 468891BC6 for ; Tue, 24 Jan 2023 12:35:33 -0800 (PST) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1674592531; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=W129RU0688CMkJERFUWutZmKNSTdtW1e5I8TwXB2ZIY=; b=e31nyy9bI5fv1vwhrqpRnh+U2pkLv/1xPg2pfXBIWIJu0RShv4aqvIaHjX3TQEkMolQtVX Nrg1bR9X0605ML7hPoKOOeKm0K6UDReaF/dNTIeDXiGeIMJ9ZoU847qEmgu+2Ph58bP1+K NZnpKXZKxy9lMrD6KAPoFFyLOyFpt1c= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov , Peter Collingbourne Subject: [PATCH mm] kasan: reset page tags properly with sampling Date: Tue, 24 Jan 2023 21:35:26 +0100 Message-Id: <24ea20c1b19c2b4b56cf9f5b354915f8dbccfc77.1674592496.git.andreyknvl@google.com> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755938084444712754?= X-GMAIL-MSGID: =?utf-8?q?1755938084444712754?= From: Andrey Konovalov The implementation of page_alloc poisoning sampling assumed that tag_clear_highpage resets page tags for __GFP_ZEROTAGS allocations. However, this is no longer the case since commit 70c248aca9e7 ("mm: kasan: Skip unpoisoning of user pages"). This leads to kernel crashes when MTE-enabled userspace mappings are used with Hardware Tag-Based KASAN enabled. Reset page tags for __GFP_ZEROTAGS allocations in post_alloc_hook(). Also clarify and fix related comments. Reported-by: Peter Collingbourne Tested-by: Peter Collingbourne Signed-off-by: Andrey Konovalov --- mm/page_alloc.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 5514d84cc712..370d4f2c0276 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2471,7 +2471,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, bool init = !want_init_on_free() && want_init_on_alloc(gfp_flags) && !should_skip_init(gfp_flags); bool zero_tags = init && (gfp_flags & __GFP_ZEROTAGS); - bool reset_tags = !zero_tags; + bool reset_tags = true; int i; set_page_private(page, 0); @@ -2498,7 +2498,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, * (which happens only when memory should be initialized as well). */ if (zero_tags) { - /* Initialize both memory and tags. */ + /* Initialize both memory and memory tags. */ for (i = 0; i != 1 << order; ++i) tag_clear_highpage(page + i); @@ -2516,14 +2516,14 @@ inline void post_alloc_hook(struct page *page, unsigned int order, } else { /* * KASAN decided to exclude this allocation from being - * poisoned due to sampling. Skip poisoning as well. + * unpoisoned due to sampling. Skip poisoning as well. */ SetPageSkipKASanPoison(page); } } /* - * If memory tags have not been set, reset the page tags to ensure - * page_address() dereferencing does not fault. + * If memory tags have not been set by KASAN, reset the page tags to + * ensure page_address() dereferencing does not fault. */ if (reset_tags) { for (i = 0; i != 1 << order; ++i)