From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED, USER_AGENT_NEOMUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7889AC32789 for ; Thu, 8 Nov 2018 12:22:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4A85A20892 for ; Thu, 8 Nov 2018 12:22:39 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4A85A20892 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726920AbeKHV5v (ORCPT ); Thu, 8 Nov 2018 16:57:51 -0500 Received: from foss.arm.com ([217.140.101.70]:39740 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726359AbeKHV5v (ORCPT ); Thu, 8 Nov 2018 16:57:51 -0500 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 4B189EBD; Thu, 8 Nov 2018 04:22:37 -0800 (PST) Received: from lakrids.cambridge.arm.com (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 73AEE3F5BD; Thu, 8 Nov 2018 04:22:31 -0800 (PST) Date: Thu, 8 Nov 2018 12:22:29 +0000 From: Mark Rutland To: Andrey Konovalov Cc: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Catalin Marinas , Will Deacon , Christoph Lameter , Andrew Morton , Nick Desaulniers , Marc Zyngier , Dave Martin , Ard Biesheuvel , "Eric W . Biederman" , Ingo Molnar , Paul Lawrence , Geert Uytterhoeven , Arnd Bergmann , "Kirill A . Shutemov" , Greg Kroah-Hartman , Kate Stewart , Mike Rapoport , kasan-dev@googlegroups.com, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sparse@vger.kernel.org, linux-mm@kvack.org, linux-kbuild@vger.kernel.org, Kostya Serebryany , Evgeniy Stepanov , Lee Smith , Ramana Radhakrishnan , Jacob Bramley , Ruben Ayrapetyan , Jann Horn , Mark Brand , Chintan Pandya , Vishwath Mohan Subject: Re: [PATCH v10 12/22] kasan, arm64: fix up fault handling logic Message-ID: <20181108122228.xqwhpkjritrvqneq@lakrids.cambridge.arm.com> References: <4891a504adf61c0daf1e83642b6f7519328dfd5f.1541525354.git.andreyknvl@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4891a504adf61c0daf1e83642b6f7519328dfd5f.1541525354.git.andreyknvl@google.com> User-Agent: NeoMutt/20170113 (1.7.2) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Nov 06, 2018 at 06:30:27PM +0100, Andrey Konovalov wrote: > show_pte in arm64 fault handling relies on the fact that the top byte of > a kernel pointer is 0xff, which isn't always the case with tag-based > KASAN. That's for the TTBR1 check, right? i.e. for the following to work: if (addr >= VA_START) ... we need the tag bits to be an extension of bit 55... > > This patch resets the top byte in show_pte. > > Reviewed-by: Andrey Ryabinin > Reviewed-by: Dmitry Vyukov > Signed-off-by: Andrey Konovalov > --- > arch/arm64/mm/fault.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > index 7d9571f4ae3d..d9a84d6f3343 100644 > --- a/arch/arm64/mm/fault.c > +++ b/arch/arm64/mm/fault.c > @@ -32,6 +32,7 @@ > #include > #include > #include > +#include > > #include > #include > @@ -141,6 +142,8 @@ void show_pte(unsigned long addr) > pgd_t *pgdp; > pgd_t pgd; > > + addr = (unsigned long)kasan_reset_tag((void *)addr); ... but this ORs in (0xffUL << 56), which is not correct for addresses which aren't TTBR1 addresses to begin with, where bit 55 is clear, and throws away useful information. We could use untagged_addr() here, but that wouldn't be right for kernels which don't use TBI1, and we'd erroneously report addresses under the TTBR1 range as being in the TTBR1 range. I also see that the entry assembly for el{1,0}_{da,ia} clears the tag for EL0 addresses. So we could have: static inline bool is_ttbr0_addr(unsigned long addr) { /* entry assembly clears tags for TTBR0 addrs */ return addr < TASK_SIZE_64; } static inline bool is_ttbr1_addr(unsigned long addr) { /* TTBR1 addresses may have a tag if HWKASAN is in use */ return arch_kasan_reset_tag(addr) >= VA_START; } ... and use those in the conditionals, leaving the addr as-is for reporting purposes. Thanks, Mark. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Mark Rutland Subject: Re: [PATCH v10 12/22] kasan, arm64: fix up fault handling logic Date: Thu, 8 Nov 2018 12:22:29 +0000 Message-ID: <20181108122228.xqwhpkjritrvqneq@lakrids.cambridge.arm.com> References: <4891a504adf61c0daf1e83642b6f7519328dfd5f.1541525354.git.andreyknvl@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <4891a504adf61c0daf1e83642b6f7519328dfd5f.1541525354.git.andreyknvl@google.com> Sender: linux-kernel-owner@vger.kernel.org To: Andrey Konovalov Cc: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Catalin Marinas , Will Deacon , Christoph Lameter , Andrew Morton , Nick Desaulniers , Marc Zyngier , Dave Martin , Ard Biesheuvel , "Eric W . Biederman" , Ingo Molnar , Paul Lawrence , Geert Uytterhoeven , Arnd Bergmann , "Kirill A . Shutemov" , Greg Kroah-Hartman , Kate Stewart List-Id: linux-sparse@vger.kernel.org On Tue, Nov 06, 2018 at 06:30:27PM +0100, Andrey Konovalov wrote: > show_pte in arm64 fault handling relies on the fact that the top byte of > a kernel pointer is 0xff, which isn't always the case with tag-based > KASAN. That's for the TTBR1 check, right? i.e. for the following to work: if (addr >= VA_START) ... we need the tag bits to be an extension of bit 55... > > This patch resets the top byte in show_pte. > > Reviewed-by: Andrey Ryabinin > Reviewed-by: Dmitry Vyukov > Signed-off-by: Andrey Konovalov > --- > arch/arm64/mm/fault.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > index 7d9571f4ae3d..d9a84d6f3343 100644 > --- a/arch/arm64/mm/fault.c > +++ b/arch/arm64/mm/fault.c > @@ -32,6 +32,7 @@ > #include > #include > #include > +#include > > #include > #include > @@ -141,6 +142,8 @@ void show_pte(unsigned long addr) > pgd_t *pgdp; > pgd_t pgd; > > + addr = (unsigned long)kasan_reset_tag((void *)addr); ... but this ORs in (0xffUL << 56), which is not correct for addresses which aren't TTBR1 addresses to begin with, where bit 55 is clear, and throws away useful information. We could use untagged_addr() here, but that wouldn't be right for kernels which don't use TBI1, and we'd erroneously report addresses under the TTBR1 range as being in the TTBR1 range. I also see that the entry assembly for el{1,0}_{da,ia} clears the tag for EL0 addresses. So we could have: static inline bool is_ttbr0_addr(unsigned long addr) { /* entry assembly clears tags for TTBR0 addrs */ return addr < TASK_SIZE_64; } static inline bool is_ttbr1_addr(unsigned long addr) { /* TTBR1 addresses may have a tag if HWKASAN is in use */ return arch_kasan_reset_tag(addr) >= VA_START; } ... and use those in the conditionals, leaving the addr as-is for reporting purposes. Thanks, Mark. From mboxrd@z Thu Jan 1 00:00:00 1970 From: mark.rutland@arm.com (Mark Rutland) Date: Thu, 8 Nov 2018 12:22:29 +0000 Subject: [PATCH v10 12/22] kasan, arm64: fix up fault handling logic In-Reply-To: <4891a504adf61c0daf1e83642b6f7519328dfd5f.1541525354.git.andreyknvl@google.com> References: <4891a504adf61c0daf1e83642b6f7519328dfd5f.1541525354.git.andreyknvl@google.com> Message-ID: <20181108122228.xqwhpkjritrvqneq@lakrids.cambridge.arm.com> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Tue, Nov 06, 2018 at 06:30:27PM +0100, Andrey Konovalov wrote: > show_pte in arm64 fault handling relies on the fact that the top byte of > a kernel pointer is 0xff, which isn't always the case with tag-based > KASAN. That's for the TTBR1 check, right? i.e. for the following to work: if (addr >= VA_START) ... we need the tag bits to be an extension of bit 55... > > This patch resets the top byte in show_pte. > > Reviewed-by: Andrey Ryabinin > Reviewed-by: Dmitry Vyukov > Signed-off-by: Andrey Konovalov > --- > arch/arm64/mm/fault.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > index 7d9571f4ae3d..d9a84d6f3343 100644 > --- a/arch/arm64/mm/fault.c > +++ b/arch/arm64/mm/fault.c > @@ -32,6 +32,7 @@ > #include > #include > #include > +#include > > #include > #include > @@ -141,6 +142,8 @@ void show_pte(unsigned long addr) > pgd_t *pgdp; > pgd_t pgd; > > + addr = (unsigned long)kasan_reset_tag((void *)addr); ... but this ORs in (0xffUL << 56), which is not correct for addresses which aren't TTBR1 addresses to begin with, where bit 55 is clear, and throws away useful information. We could use untagged_addr() here, but that wouldn't be right for kernels which don't use TBI1, and we'd erroneously report addresses under the TTBR1 range as being in the TTBR1 range. I also see that the entry assembly for el{1,0}_{da,ia} clears the tag for EL0 addresses. So we could have: static inline bool is_ttbr0_addr(unsigned long addr) { /* entry assembly clears tags for TTBR0 addrs */ return addr < TASK_SIZE_64; } static inline bool is_ttbr1_addr(unsigned long addr) { /* TTBR1 addresses may have a tag if HWKASAN is in use */ return arch_kasan_reset_tag(addr) >= VA_START; } ... and use those in the conditionals, leaving the addr as-is for reporting purposes. Thanks, Mark.