From patchwork Tue Jan 24 20:40:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: andrey.konovalov@linux.dev X-Patchwork-Id: 47889 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp2365347wrn; Tue, 24 Jan 2023 12:45:36 -0800 (PST) X-Google-Smtp-Source: AMrXdXtfNSQbfGGYq4jYG46vGLa6ijZFJtTO1ybLky70Icd8cGTPDijRQj6Ux79AcazvSYotFKFo X-Received: by 2002:a17:902:8205:b0:192:feef:588 with SMTP id x5-20020a170902820500b00192feef0588mr22883258pln.23.1674593136368; Tue, 24 Jan 2023 12:45:36 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674593136; cv=none; d=google.com; s=arc-20160816; b=IO3V+9b/K8c5/EKVOeCFtwm13sWVnWayY2cVOgf57kJFXMHDbD+uKri4WbyZqelU6e ZtxTt+9gDKMw5NEklUIlGzfDBSvOM+Y/mTklOXSgycFt34AR0ZpFKoUBo7oVOWFfdw8c +/J/g/b9EUftJR1YUqDaTajEno3REXYxm0HwRHK1rjJO7mnEDhH0B17vbMILMPHYvLe1 nZ6mJ7w5XUM0AHHF29XRIYNay0bFHwOOMo9QZZOR00cnpjWpYKP91d2wQy2otziMs1TC OZa+8zCQO9z9hTwseVxCH2HICgXOGH2kFNmUIqSPZgB2OwIMGYEBup2xmb7Yx8dauYsJ 45Ew== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=1AR/rv3Oa6O7jvIvFBjmYxJ41m4mSBsPB4PLJyrZR80=; b=da5EKn8xp42QaWpl2BordPJP49ROoRhCNycGEeVo3lShJOwRZFRfmNrMNTHCTgj6eu HUGf5WyJTeomI3nOkuS9Lp3SYNs9r2X7Op4nLXHQeRht/tTOAocRYkZwlJOpcK6mMpi+ E4He8RaO7u8/dSXUQXwLe59GJ9KZg9iYwDtA7QHNcO8KGsr3nmJKzzL52h09xilpLhWG NBnCNaG9XhAtfW4rbZV32XG/t1Zt1jYtdeMmbrADelNU6FYXStXEnq88I6Xw5Z6vVvg/ OGBdL9HBICMowYOGX8FFPWWFvUFdS1203GmqvFbA6yJS2IWAoXY6M+klmyL9il5Vir75 t58g== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linux.dev header.s=key1 header.b=LRQ50Wlw; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.dev Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id je13-20020a170903264d00b00189a6834dbesi3575773plb.103.2023.01.24.12.45.13; Tue, 24 Jan 2023 12:45:36 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linux.dev header.s=key1 header.b=LRQ50Wlw; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linux.dev Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233674AbjAXUkQ (ORCPT + 99 others); Tue, 24 Jan 2023 15:40:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229754AbjAXUkO (ORCPT ); Tue, 24 Jan 2023 15:40:14 -0500 Received: from out0.migadu.com (out0.migadu.com [94.23.1.103]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E1994B1AD for ; Tue, 24 Jan 2023 12:40:13 -0800 (PST) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1674592811; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=1AR/rv3Oa6O7jvIvFBjmYxJ41m4mSBsPB4PLJyrZR80=; b=LRQ50Wlwhf1P8ib6bD5y2GyXEpsCFdUF085x/dfwV/VvezEeAHY1OezRZK/hl25p+jY+mi Tz8huiM9NBELezIT+858ud6mKtFPdqQ6cK4fT5RFKBZUFO4UUWv1VJmYvADVVCuCJ/1Jn/ 635A+wFIPnEfuPGzLQjo/LPVYOalXt0= From: andrey.konovalov@linux.dev To: Andrew Morton Cc: Andrey Konovalov , Marco Elver , Alexander Potapenko , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov , Peter Collingbourne Subject: [PATCH v2 mm] kasan: reset page tags properly with sampling Date: Tue, 24 Jan 2023 21:40:09 +0100 Message-Id: <5dbd866714b4839069e2d8469ac45b60953db290.1674592780.git.andreyknvl@google.com> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_PASS, SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755938084444712754?= X-GMAIL-MSGID: =?utf-8?q?1755938172726214113?= From: Andrey Konovalov The implementation of page_alloc poisoning sampling assumed that tag_clear_highpage resets page tags for __GFP_ZEROTAGS allocations. However, this is no longer the case since commit 70c248aca9e7 ("mm: kasan: Skip unpoisoning of user pages"). This leads to kernel crashes when MTE-enabled userspace mappings are used with Hardware Tag-Based KASAN enabled. Reset page tags for __GFP_ZEROTAGS allocations in post_alloc_hook(). Also clarify and fix related comments. Reported-by: Peter Collingbourne Tested-by: Peter Collingbourne Signed-off-by: Andrey Konovalov --- mm/page_alloc.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 5514d84cc712..b917aebfd3d0 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -2471,7 +2471,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, bool init = !want_init_on_free() && want_init_on_alloc(gfp_flags) && !should_skip_init(gfp_flags); bool zero_tags = init && (gfp_flags & __GFP_ZEROTAGS); - bool reset_tags = !zero_tags; + bool reset_tags = true; int i; set_page_private(page, 0); @@ -2498,7 +2498,7 @@ inline void post_alloc_hook(struct page *page, unsigned int order, * (which happens only when memory should be initialized as well). */ if (zero_tags) { - /* Initialize both memory and tags. */ + /* Initialize both memory and memory tags. */ for (i = 0; i != 1 << order; ++i) tag_clear_highpage(page + i); @@ -2516,14 +2516,15 @@ inline void post_alloc_hook(struct page *page, unsigned int order, } else { /* * KASAN decided to exclude this allocation from being - * poisoned due to sampling. Skip poisoning as well. + * (un)poisoned due to sampling. Make KASAN skip + * poisoning when the allocation is freed. */ SetPageSkipKASanPoison(page); } } /* - * If memory tags have not been set, reset the page tags to ensure - * page_address() dereferencing does not fault. + * If memory tags have not been set by KASAN, reset the page tags to + * ensure page_address() dereferencing does not fault. */ if (reset_tags) { for (i = 0; i != 1 << order; ++i)