From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
the arch/x86 maintainers <x86@kernel.org>,
"H. Peter Anvin" <hpa@zytor.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>,
Yosry Ahmed <yosryahmed@google.com>,
Nhat Pham <nphamcs@gmail.com>, Minchan Kim <minchan@kernel.org>,
linux-mm <linux-mm@kvack.org>,
kasan-dev <kasan-dev@googlegroups.com>,
Mark-PK Tsai <mark-pk.tsai@mediatek.com>,
Sergey Senozhatsky <senozhatsky@chromium.org>,
Alexander Potapenko <glider@google.com>
Subject: [PATCH v2] x86: disable non-instrumented version of copy_page when KMSAN is enabled
Date: Sat, 24 Feb 2024 15:27:57 +0900 [thread overview]
Message-ID: <7f322fe9-34ba-43be-bb50-539577d1c183@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <678f31f8-5890-47fa-972e-df966aeb783d@I-love.SAKURA.ne.jp>
I found that commit afb2d666d025 ("zsmalloc: use copy_page for full page
copy") caused a false-positive KMSAN warning.
[ 50.030627][ T2974] BUG: KMSAN: use-after-free in obj_malloc+0x6cc/0x7b0
[ 50.165956][ T2974] Uninit was stored to memory at:
[ 50.170819][ T2974] obj_malloc+0x70a/0x7b0
[ 50.328931][ T2974] Uninit was created at:
[ 50.341845][ T2974] free_unref_page_prepare+0x130/0xfc0
We need to use instrumented version when KMSAN is enabled.
Let arch/x86/include/asm/page_64.h implement copy_page() using memcpy()
like arch/x86/include/asm/page_32.h does.
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
---
arch/x86/include/asm/page_64.h | 9 +++++++++
1 file changed, 9 insertions(+)
Changes in v2:
Update explanation, for I misinterpreted source/destination direction.
diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index cc6b8e087192..f13bba3a9dab 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -58,7 +58,16 @@ static inline void clear_page(void *page)
: "cc", "memory", "rax", "rcx");
}
+#ifdef CONFIG_KMSAN
+/* Use of non-instrumented assembly version confuses KMSAN. */
+void *memcpy(void *to, const void *from, __kernel_size_t len);
+static inline void copy_page(void *to, void *from)
+{
+ memcpy(to, from, PAGE_SIZE);
+}
+#else
void copy_page(void *to, void *from);
+#endif
#ifdef CONFIG_X86_5LEVEL
/*
--
2.34.1
next prev parent reply other threads:[~2024-02-24 6:28 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-23 2:10 [mm/page_alloc or mm/vmscan or mm/zswap] use-after-free in obj_malloc() Tetsuo Handa
2024-02-23 2:27 ` Yosry Ahmed
2024-02-23 4:48 ` Sergey Senozhatsky
2024-02-23 4:50 ` Yosry Ahmed
2024-02-23 4:56 ` Sergey Senozhatsky
2024-02-23 4:58 ` Sergey Senozhatsky
2024-02-23 5:05 ` Yosry Ahmed
2024-02-23 5:19 ` Sergey Senozhatsky
2024-02-23 5:23 ` Chengming Zhou
2024-02-23 5:29 ` Sergey Senozhatsky
2024-02-23 9:26 ` Tetsuo Handa
2024-02-23 10:10 ` Chengming Zhou
2024-02-23 4:43 ` Sergey Senozhatsky
2024-02-23 15:22 ` Tetsuo Handa
2024-02-23 23:54 ` [PATCH] x86: disable non-instrumented version of copy_page when KMSAN is enabled Tetsuo Handa
2024-02-24 6:27 ` Tetsuo Handa [this message]
2024-02-24 14:23 ` [mm/page_alloc or mm/vmscan or mm/zswap] use-after-free in obj_malloc() Sergey Senozhatsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=7f322fe9-34ba-43be-bb50-539577d1c183@I-love.SAKURA.ne.jp \
--to=penguin-kernel@i-love.sakura.ne.jp \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=glider@google.com \
--cc=hannes@cmpxchg.org \
--cc=hpa@zytor.com \
--cc=kasan-dev@googlegroups.com \
--cc=linux-mm@kvack.org \
--cc=mark-pk.tsai@mediatek.com \
--cc=minchan@kernel.org \
--cc=mingo@redhat.com \
--cc=nphamcs@gmail.com \
--cc=senozhatsky@chromium.org \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=yosryahmed@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).