From: Alexander Potapenko <glider@google.com>
To: Christoph Hellwig <hch@lst.de>
Cc: Andrew Morton <akpm@linux-foundation.org>,
Jens Axboe <axboe@kernel.dk>, "Theodore Ts'o" <tytso@mit.edu>,
Dmitry Torokhov <dmitry.torokhov@gmail.com>,
"Martin K. Petersen" <martin.petersen@oracle.com>,
"Michael S. Tsirkin" <mst@redhat.com>,
Eric Dumazet <edumazet@google.com>,
Eric Van Hensbergen <ericvh@gmail.com>,
Takashi Iwai <tiwai@suse.com>,
Vegard Nossum <vegard.nossum@oracle.com>,
Dmitry Vyukov <dvyukov@google.com>,
Matthew Wilcox <willy@infradead.org>,
Linux Memory Management List <linux-mm@kvack.org>,
Al Viro <viro@zeniv.linux.org.uk>,
Andrey Ryabinin <aryabinin@virtuozzo.com>,
Andy Lutomirski <luto@kernel.org>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Harry Wentland <harry.wentland@amd.com>,
Herbert Xu <herbert@gondor.apana.org.au>,
Ingo Molnar <mingo@elte.hu>,
Martin Schwidefsky <schwidefsky@de.ibm.com>,
Michal Simek <monstr@monstr.eu>, Petr Mladek <pmladek@suse.com>,
Sergey Senozhatsky <sergey.senozhatsky@gmail.com>,
Steven Rostedt <rostedt@goodmis.org>,
Thomas Gleixner <tglx@linutronix.de>,
Wolfram Sang <wsa@the-dreams.de>,
Vasily Gorbik <gor@linux.ibm.com>,
Ilya Leoshkevich <iii@linux.ibm.com>,
Mark Rutland <mark.rutland@arm.com>,
Randy Dunlap <rdunlap@infradead.org>,
Andrey Konovalov <andreyknvl@google.com>,
Marco Elver <elver@google.com>
Subject: Re: [PATCH RFC v2 22/25] kmsan: unpoisoning buffers from devices etc.
Date: Thu, 7 Nov 2019 14:00:31 +0100 [thread overview]
Message-ID: <CAG_fn=XOj43cC_JFBArU1_-uBn5V=fAAQCRhm2fQV=s+6RTYBA@mail.gmail.com> (raw)
In-Reply-To: <CAG_fn=XNPSfsP7O2rtKYtr-Nxg=hTaK9mmR93yWoruXxBW6Yyg@mail.gmail.com>
On Tue, Nov 5, 2019 at 4:02 PM Alexander Potapenko <glider@google.com> wrote:
>
> On Wed, Oct 30, 2019 at 3:38 PM Christoph Hellwig <hch@lst.de> wrote:
> >
> > On Wed, Oct 30, 2019 at 03:22:34PM +0100, glider@google.com wrote:
> > > When data is copied to memory from a device KMSAN should treat it as
> > > initialized. In most cases it's enough to just unpoison the buffer that
> > > is known to come from a device.
> > > In the case with __do_page_cache_readahead() and bio_copy_user_iov() we
> > > have to mark the whole pages as ignored by KMSAN, as it's not obvious
> > > where these pages are read again.
> >
> > A lot of this looks pretty strange. Why don't you instrument
> > the dma_map / dma_sync infrastucture? That should avoid most of the
> > driver hooks.
>
> That's the exact reason I'm sending these patches: I simply don't know
> the kernel code good enough.
> May I ask you for some pointers?
> My goal is to mark data copied from the device as initialized (by
> calling kmsan_unpoison_shadow(ptr, size)), and, if possible, check
> data that's about to be copied to device (by calling
> kmsan_check_memory(ptr, size)).
> My understanding is that:
> 1. calls to dma_map_* and dma_sync_* with direction=DMA_FROM_DEVICE
> denote that the corresponding kernel buffer can be marked as
> initialized
> 2. calls to dma_unmap_* and dma_sync_* with direction=DMA_TO_DEVICE
> denote that the buffer will be copied to device (and must be checked
> for being initialized)
> 3. I need some translation table to find out the virtual address for
> a given dma_addr_t
> Does this sound reasonable?
Initializing memory in dma_map_ still leaves out the reports as the one below.
There seems to be a DMA access somewhere in blk_execute_rq(), but I
fail to see why it's not covered.
=============================================
BUG: KMSAN: uninit-value in[< none >]
sr_check_events+0x1091/0x1190 drivers/scsi/sr.c:246
CPU: 0 PID: 5 Comm: kworker/0:0 Not tainted 5.4.0-rc5+ #3266
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Workqueue: events_freezable_power_ disk_events_workfn
Call Trace:
[< inline >] __dump_stack lib/dump_stack.c:77
[< none >] dump_stack+0x196/0x1f0 lib/dump_stack.c:113
[< none >] kmsan_report+0x127/0x220 mm/kmsan/kmsan_report.c:108
[< none >] __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:245
[< inline >] sr_get_events drivers/scsi/sr.c:213
[< none >] sr_check_events+0x1091/0x1190 drivers/scsi/sr.c:246
[< inline >] cdrom_update_events drivers/cdrom/cdrom.c:1476
[< none >] cdrom_check_events+0xc3/0x260 drivers/cdrom/cdrom.c:1486
[< none >] sr_block_check_events+0x3c4/0x670 drivers/scsi/sr.c:614
[< none >] disk_check_events+0x154/0x8b0 block/genhd.c:1855
[< none >] disk_events_workfn+0x47/0x50 block/genhd.c:1841
[< none >] process_one_work+0x1556/0x1ef0 kernel/workqueue.c:2269
...
Uninit was stored to memory at:
[< inline >] kmsan_save_stack_with_flags mm/kmsan/kmsan.c:151
[< none >] kmsan_internal_chain_origin+0xa3/0x160
mm/kmsan/kmsan.c:319
[< none >] kmsan_memcpy_memmove_metadata+0x271/0x2e0
mm/kmsan/kmsan.c:254
[< none >] kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:274
[< none >] __msan_memcpy+0x55/0x70 mm/kmsan/kmsan_instr.c:129
[< none >] bio_copy_kern_endio_read+0x467/0x990 block/bio.c:1543
[< none >] bio_endio+0xa36/0xbb0 block/bio.c:1850
[< inline >] req_bio_endio block/blk-core.c:242
[< none >] blk_update_request+0xd3c/0x20a0 block/blk-core.c:1462
[< none >] scsi_end_request+0x10b/0xeb0 drivers/scsi/scsi_lib.c:579
[< none >] scsi_io_completion+0x279/0x2660
drivers/scsi/scsi_lib.c:963
[< none >] scsi_finish_command+0x6f9/0x720 drivers/scsi/scsi.c:228
[< none >] scsi_softirq_done+0x772/0x980 drivers/scsi/scsi_lib.c:1477
[< none >] blk_done_softirq+0x300/0x4f0 block/blk-softirq.c:37
[< none >] __do_softirq+0x311/0x83d kernel/softirq.c:293
...
Uninit was created at:
[< none >] kmsan_save_stack_with_flags+0x3f/0x90 mm/kmsan/kmsan.c:151
[< inline >] kmsan_internal_alloc_meta_for_pages
mm/kmsan/kmsan_shadow.c:362
[< none >] kmsan_alloc_page+0x14e/0x360 mm/kmsan/kmsan_shadow.c:391
[< none >] __alloc_pages_nodemask+0x594e/0x6050 mm/page_alloc.c:4796
[< none >] alloc_pages_current+0x682/0x990 mm/mempolicy.c:2188
[< inline >] alloc_pages ./include/linux/gfp.h:511
[< none >] bio_copy_kern+0x4c5/0xed0 block/bio.c:1590
[< none >] blk_rq_map_kern+0x458/0x7e0 block/blk-map.c:237
[< none >] __scsi_execute+0x2cf/0xaf0 drivers/scsi/scsi_lib.c:265
[< inline >] scsi_execute_req ./include/scsi/scsi_device.h:451
[< inline >] sr_get_events drivers/scsi/sr.c:207
[< none >] sr_check_events+0x2ff/0x1190 drivers/scsi/sr.c:246
[< inline >] cdrom_update_events drivers/cdrom/cdrom.c:1476
[< none >] cdrom_check_events+0xc3/0x260 drivers/cdrom/cdrom.c:1486
[< none >] sr_block_check_events+0x3c4/0x670 drivers/scsi/sr.c:614
[< none >] disk_check_events+0x154/0x8b0 block/genhd.c:1855
[< none >] disk_events_workfn+0x47/0x50 block/genhd.c:1841
=============================================
> I still don't understand how to handle DMA_BIDIRECTIONAL. Will it be
> sane to assume that at each dma_{map,sync,unmap}_* call must always
> check the memory range and then unpoison it?
>
> Thanks in advance
>
> --
> Alexander Potapenko
> Software Engineer
>
> Google Germany GmbH
> Erika-Mann-Straße, 33
> 80636 München
>
> Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
> Registergericht und -nummer: Hamburg, HRB 86891
> Sitz der Gesellschaft: Hamburg
--
Alexander Potapenko
Software Engineer
Google Germany GmbH
Erika-Mann-Straße, 33
80636 München
Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
Registergericht und -nummer: Hamburg, HRB 86891
Sitz der Gesellschaft: Hamburg
next prev parent reply other threads:[~2019-11-07 13:00 UTC|newest]
Thread overview: 57+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-30 14:22 [PATCH RFC v2 00/25] Add KernelMemorySanitizer infrastructure glider
2019-10-30 14:22 ` [PATCH RFC v2 01/25] stackdepot: check depot_index before accessing the stack slab glider
2019-10-30 14:22 ` [PATCH RFC v2 02/25] stackdepot: prevent Clang from optimizing away stackdepot_memcmp() glider
2019-11-01 5:50 ` Sergey Senozhatsky
2019-11-06 11:43 ` Alexander Potapenko
2019-11-07 6:08 ` Sergey Senozhatsky
2019-11-07 9:04 ` Arnd Bergmann
2019-11-07 9:22 ` Alexander Potapenko
2019-11-07 9:28 ` Arnd Bergmann
2019-11-07 9:43 ` Alexander Potapenko
[not found] ` <47fdac13-fa2c-2acd-2480-5e6d4db208f8@virtuozzo.com>
2019-11-07 10:00 ` Arnd Bergmann
[not found] ` <6875c6e6-2f1f-f8e6-e5d7-d451c48397ff@virtuozzo.com>
2019-11-07 10:30 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 03/25] kasan: stackdepot: move filter_irq_stacks() to stackdepot.c glider
2019-10-30 14:22 ` [PATCH RFC v2 04/25] stackdepot: reserve 5 extra bits in depot_stack_handle_t glider
2019-10-30 14:22 ` [PATCH RFC v2 05/25] kmsan: add ReST documentation glider
2019-10-30 14:22 ` [PATCH RFC v2 06/25] kmsan: gfp: introduce __GFP_NO_KMSAN_SHADOW glider
2019-10-30 14:22 ` [PATCH RFC v2 07/25] kmsan: introduce __no_sanitize_memory and __SANITIZE_MEMORY__ glider
2019-10-30 15:50 ` Andrey Konovalov
2019-11-01 12:52 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 08/25] kmsan: reduce vmalloc space glider
2019-10-30 14:22 ` [PATCH RFC v2 09/25] kmsan: add KMSAN runtime glider
2019-11-08 12:08 ` Dmitry Vyukov
2019-11-08 12:17 ` Dmitry Vyukov
2019-11-21 12:06 ` Alexander Potapenko
2019-11-13 8:13 ` Wolfram Sang
2019-11-21 12:01 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 10/25] kmsan: define READ_ONCE_NOCHECK() glider
2019-11-05 14:21 ` Mark Rutland
2019-11-21 12:08 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 11/25] kmsan: x86: sync metadata pages on page fault glider
2019-10-30 14:22 ` [PATCH RFC v2 12/25] kmsan: add tests for KMSAN glider
2019-10-30 14:22 ` [PATCH RFC v2 13/25] kmsan: make READ_ONCE_TASK_STACK() return initialized values glider
2019-10-30 14:22 ` [PATCH RFC v2 14/25] kmsan: Kconfig changes to disable options incompatible with KMSAN glider
2019-10-30 14:34 ` Qian Cai
2019-10-30 14:34 ` Christoph Hellwig
2019-10-30 14:22 ` [PATCH RFC v2 15/25] kmsan: Changing existing files to enable KMSAN builds glider
2019-10-30 14:36 ` Christoph Hellwig
2019-10-30 14:22 ` [PATCH RFC v2 16/25] kmsan: disable KMSAN instrumentation for certain kernel parts glider
2019-10-30 14:22 ` [PATCH RFC v2 17/25] kmsan: mm: call KMSAN hooks from SLUB code glider
2019-10-30 16:07 ` Andrey Konovalov
2019-10-30 14:22 ` [PATCH RFC v2 18/25] kmsan: call KMSAN hooks where needed glider
2019-10-31 11:49 ` Petr Mladek
2019-11-01 8:26 ` Sergey Senozhatsky
2019-11-05 14:12 ` Alexander Potapenko
2019-11-06 9:04 ` Petr Mladek
2019-11-06 9:07 ` Sergey Senozhatsky
2019-10-30 14:22 ` [PATCH RFC v2 19/25] kmsan: disable instrumentation of certain functions glider
2019-10-30 14:22 ` [PATCH RFC v2 20/25] kmsan: unpoison |tlb| in arch_tlb_gather_mmu() glider
2019-10-30 14:22 ` [PATCH RFC v2 21/25] kmsan: use __msan_memcpy() where possible glider
2019-10-30 14:22 ` [PATCH RFC v2 22/25] kmsan: unpoisoning buffers from devices etc glider
2019-10-30 14:38 ` Christoph Hellwig
2019-11-05 15:02 ` Alexander Potapenko
2019-11-07 13:00 ` Alexander Potapenko [this message]
2019-11-13 11:07 ` Alexander Potapenko
2019-10-30 14:22 ` [PATCH RFC v2 23/25] kmsan: hooks for copy_to_user() and friends glider
2019-10-30 14:22 ` [PATCH RFC v2 24/25] kmsan: disable strscpy() optimization under KMSAN glider
2019-10-30 14:22 ` [PATCH RFC v2 25/25] net: kasan: kmsan: support CONFIG_GENERIC_CSUM on x86, enable it for KASAN/KMSAN glider
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAG_fn=XOj43cC_JFBArU1_-uBn5V=fAAQCRhm2fQV=s+6RTYBA@mail.gmail.com' \
--to=glider@google.com \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@google.com \
--cc=ard.biesheuvel@linaro.org \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=axboe@kernel.dk \
--cc=dmitry.torokhov@gmail.com \
--cc=dvyukov@google.com \
--cc=edumazet@google.com \
--cc=elver@google.com \
--cc=ericvh@gmail.com \
--cc=gor@linux.ibm.com \
--cc=gregkh@linuxfoundation.org \
--cc=harry.wentland@amd.com \
--cc=hch@lst.de \
--cc=herbert@gondor.apana.org.au \
--cc=iii@linux.ibm.com \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mark.rutland@arm.com \
--cc=martin.petersen@oracle.com \
--cc=mingo@elte.hu \
--cc=monstr@monstr.eu \
--cc=mst@redhat.com \
--cc=pmladek@suse.com \
--cc=rdunlap@infradead.org \
--cc=rostedt@goodmis.org \
--cc=schwidefsky@de.ibm.com \
--cc=sergey.senozhatsky@gmail.com \
--cc=tglx@linutronix.de \
--cc=tiwai@suse.com \
--cc=tytso@mit.edu \
--cc=vegard.nossum@oracle.com \
--cc=viro@zeniv.linux.org.uk \
--cc=willy@infradead.org \
--cc=wsa@the-dreams.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).