* [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 23:36 ` Andrey Konovalov
0 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:36 UTC (permalink / raw)
To: Andrew Morton, Alexander Potapenko
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Marco Elver, Peter Collingbourne,
Evgenii Stepanov, Branislav Rankov, Kevin Brodsky, kasan-dev,
linux-arm-kernel, linux-mm, linux-kernel, Andrey Konovalov,
stable
Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
after debug_pagealloc_unmap_pages(). This causes a crash when
debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
unmapped page.
This patch puts kasan_free_nondeferred_pages() before
debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
the page unavailable.
Fixes: 94ab5b61ee16 ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS")
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
Changes v1->v2:
- Move kasan_free_nondeferred_pages() before arch_free_page().
---
mm/page_alloc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 969e7012fce0..0efb07b5907c 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
kernel_poison_pages(page, 1 << order);
+ /*
+ * With hardware tag-based KASAN, memory tags must be set before the
+ * page becomes unavailable via debug_pagealloc or arch_free_page.
+ */
+ kasan_free_nondeferred_pages(page, order, fpi_flags);
+
/*
* arch_free_page() can make the page's contents inaccessible. s390
* does this. So nothing which can access the page's contents should
@@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
debug_pagealloc_unmap_pages(page, 1 << order);
- kasan_free_nondeferred_pages(page, order, fpi_flags);
-
return true;
}
--
2.30.1.766.gb4fecdf3b7-goog
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 23:36 ` Andrey Konovalov
0 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:36 UTC (permalink / raw)
To: Andrew Morton, Alexander Potapenko
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Marco Elver, Peter Collingbourne,
Evgenii Stepanov, Branislav Rankov, Kevin Brodsky, kasan-dev,
linux-arm-kernel, linux-mm, linux-kernel, Andrey Konovalov,
stable
Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
after debug_pagealloc_unmap_pages(). This causes a crash when
debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
unmapped page.
This patch puts kasan_free_nondeferred_pages() before
debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
the page unavailable.
Fixes: 94ab5b61ee16 ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS")
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
Changes v1->v2:
- Move kasan_free_nondeferred_pages() before arch_free_page().
---
mm/page_alloc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 969e7012fce0..0efb07b5907c 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
kernel_poison_pages(page, 1 << order);
+ /*
+ * With hardware tag-based KASAN, memory tags must be set before the
+ * page becomes unavailable via debug_pagealloc or arch_free_page.
+ */
+ kasan_free_nondeferred_pages(page, order, fpi_flags);
+
/*
* arch_free_page() can make the page's contents inaccessible. s390
* does this. So nothing which can access the page's contents should
@@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
debug_pagealloc_unmap_pages(page, 1 << order);
- kasan_free_nondeferred_pages(page, order, fpi_flags);
-
return true;
}
--
2.30.1.766.gb4fecdf3b7-goog
^ permalink raw reply related [flat|nested] 13+ messages in thread
* [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 23:36 ` Andrey Konovalov
0 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:36 UTC (permalink / raw)
To: Andrew Morton, Alexander Potapenko
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Marco Elver, Peter Collingbourne,
Evgenii Stepanov, Branislav Rankov, Kevin Brodsky, kasan-dev,
linux-arm-kernel, linux-mm, linux-kernel, Andrey Konovalov,
stable
Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
after debug_pagealloc_unmap_pages(). This causes a crash when
debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
unmapped page.
This patch puts kasan_free_nondeferred_pages() before
debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
the page unavailable.
Fixes: 94ab5b61ee16 ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS")
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
Changes v1->v2:
- Move kasan_free_nondeferred_pages() before arch_free_page().
---
mm/page_alloc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 969e7012fce0..0efb07b5907c 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
kernel_poison_pages(page, 1 << order);
+ /*
+ * With hardware tag-based KASAN, memory tags must be set before the
+ * page becomes unavailable via debug_pagealloc or arch_free_page.
+ */
+ kasan_free_nondeferred_pages(page, order, fpi_flags);
+
/*
* arch_free_page() can make the page's contents inaccessible. s390
* does this. So nothing which can access the page's contents should
@@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
debug_pagealloc_unmap_pages(page, 1 << order);
- kasan_free_nondeferred_pages(page, order, fpi_flags);
-
return true;
}
--
2.30.1.766.gb4fecdf3b7-goog
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
2021-03-05 23:36 ` Andrey Konovalov
@ 2021-03-05 23:49 ` Andrew Morton
-1 siblings, 0 replies; 13+ messages in thread
From: Andrew Morton @ 2021-03-05 23:49 UTC (permalink / raw)
To: Andrey Konovalov
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, linux-arm-kernel, linux-mm,
linux-kernel, stable
On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> after debug_pagealloc_unmap_pages(). This causes a crash when
> debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> unmapped page.
>
> This patch puts kasan_free_nondeferred_pages() before
> debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> the page unavailable.
>
> ...
>
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
>
> kernel_poison_pages(page, 1 << order);
>
> + /*
> + * With hardware tag-based KASAN, memory tags must be set before the
> + * page becomes unavailable via debug_pagealloc or arch_free_page.
> + */
> + kasan_free_nondeferred_pages(page, order, fpi_flags);
> +
> /*
> * arch_free_page() can make the page's contents inaccessible. s390
> * does this. So nothing which can access the page's contents should
> @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
>
> debug_pagealloc_unmap_pages(page, 1 << order);
>
> - kasan_free_nondeferred_pages(page, order, fpi_flags);
> -
> return true;
> }
kasan_free_nondeferred_pages() has only two args in current mainline.
I fixed that in the obvious manner...
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 23:49 ` Andrew Morton
0 siblings, 0 replies; 13+ messages in thread
From: Andrew Morton @ 2021-03-05 23:49 UTC (permalink / raw)
To: Andrey Konovalov
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, linux-arm-kernel, linux-mm,
linux-kernel, stable
On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> after debug_pagealloc_unmap_pages(). This causes a crash when
> debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> unmapped page.
>
> This patch puts kasan_free_nondeferred_pages() before
> debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> the page unavailable.
>
> ...
>
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
>
> kernel_poison_pages(page, 1 << order);
>
> + /*
> + * With hardware tag-based KASAN, memory tags must be set before the
> + * page becomes unavailable via debug_pagealloc or arch_free_page.
> + */
> + kasan_free_nondeferred_pages(page, order, fpi_flags);
> +
> /*
> * arch_free_page() can make the page's contents inaccessible. s390
> * does this. So nothing which can access the page's contents should
> @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
>
> debug_pagealloc_unmap_pages(page, 1 << order);
>
> - kasan_free_nondeferred_pages(page, order, fpi_flags);
> -
> return true;
> }
kasan_free_nondeferred_pages() has only two args in current mainline.
I fixed that in the obvious manner...
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
2021-03-05 23:49 ` Andrew Morton
(?)
@ 2021-03-05 23:54 ` Andrey Konovalov
-1 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:54 UTC (permalink / raw)
To: Andrew Morton
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Sat, Mar 6, 2021 at 12:50 AM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
>
> > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > after debug_pagealloc_unmap_pages(). This causes a crash when
> > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > unmapped page.
> >
> > This patch puts kasan_free_nondeferred_pages() before
> > debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> > the page unavailable.
> >
> > ...
> >
> > --- a/mm/page_alloc.c
> > +++ b/mm/page_alloc.c
> > @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
> >
> > kernel_poison_pages(page, 1 << order);
> >
> > + /*
> > + * With hardware tag-based KASAN, memory tags must be set before the
> > + * page becomes unavailable via debug_pagealloc or arch_free_page.
> > + */
> > + kasan_free_nondeferred_pages(page, order, fpi_flags);
> > +
> > /*
> > * arch_free_page() can make the page's contents inaccessible. s390
> > * does this. So nothing which can access the page's contents should
> > @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
> >
> > debug_pagealloc_unmap_pages(page, 1 << order);
> >
> > - kasan_free_nondeferred_pages(page, order, fpi_flags);
> > -
> > return true;
> > }
>
> kasan_free_nondeferred_pages() has only two args in current mainline.
Ah, yes, forgot to mention: this goes on top of:
kasan: initialize shadow to TAG_INVALID for SW_TAGS
mm, kasan: don't poison boot memory with tag-based modes
>
> I fixed that in the obvious manner...
Thanks!
If you changed this patch, you'll also need to change the other one though.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 23:54 ` Andrey Konovalov
0 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:54 UTC (permalink / raw)
To: Andrew Morton
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Sat, Mar 6, 2021 at 12:50 AM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
>
> > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > after debug_pagealloc_unmap_pages(). This causes a crash when
> > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > unmapped page.
> >
> > This patch puts kasan_free_nondeferred_pages() before
> > debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> > the page unavailable.
> >
> > ...
> >
> > --- a/mm/page_alloc.c
> > +++ b/mm/page_alloc.c
> > @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
> >
> > kernel_poison_pages(page, 1 << order);
> >
> > + /*
> > + * With hardware tag-based KASAN, memory tags must be set before the
> > + * page becomes unavailable via debug_pagealloc or arch_free_page.
> > + */
> > + kasan_free_nondeferred_pages(page, order, fpi_flags);
> > +
> > /*
> > * arch_free_page() can make the page's contents inaccessible. s390
> > * does this. So nothing which can access the page's contents should
> > @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
> >
> > debug_pagealloc_unmap_pages(page, 1 << order);
> >
> > - kasan_free_nondeferred_pages(page, order, fpi_flags);
> > -
> > return true;
> > }
>
> kasan_free_nondeferred_pages() has only two args in current mainline.
Ah, yes, forgot to mention: this goes on top of:
kasan: initialize shadow to TAG_INVALID for SW_TAGS
mm, kasan: don't poison boot memory with tag-based modes
>
> I fixed that in the obvious manner...
Thanks!
If you changed this patch, you'll also need to change the other one though.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 23:54 ` Andrey Konovalov
0 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:54 UTC (permalink / raw)
To: Andrew Morton
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Sat, Mar 6, 2021 at 12:50 AM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
>
> > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > after debug_pagealloc_unmap_pages(). This causes a crash when
> > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > unmapped page.
> >
> > This patch puts kasan_free_nondeferred_pages() before
> > debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> > the page unavailable.
> >
> > ...
> >
> > --- a/mm/page_alloc.c
> > +++ b/mm/page_alloc.c
> > @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
> >
> > kernel_poison_pages(page, 1 << order);
> >
> > + /*
> > + * With hardware tag-based KASAN, memory tags must be set before the
> > + * page becomes unavailable via debug_pagealloc or arch_free_page.
> > + */
> > + kasan_free_nondeferred_pages(page, order, fpi_flags);
> > +
> > /*
> > * arch_free_page() can make the page's contents inaccessible. s390
> > * does this. So nothing which can access the page's contents should
> > @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
> >
> > debug_pagealloc_unmap_pages(page, 1 << order);
> >
> > - kasan_free_nondeferred_pages(page, order, fpi_flags);
> > -
> > return true;
> > }
>
> kasan_free_nondeferred_pages() has only two args in current mainline.
Ah, yes, forgot to mention: this goes on top of:
kasan: initialize shadow to TAG_INVALID for SW_TAGS
mm, kasan: don't poison boot memory with tag-based modes
>
> I fixed that in the obvious manner...
Thanks!
If you changed this patch, you'll also need to change the other one though.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
2021-03-05 23:54 ` Andrey Konovalov
(?)
@ 2021-03-05 23:54 ` Andrey Konovalov
-1 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:54 UTC (permalink / raw)
To: Andrew Morton
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Sat, Mar 6, 2021 at 12:54 AM Andrey Konovalov <andreyknvl@google.com> wrote:
>
> On Sat, Mar 6, 2021 at 12:50 AM Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> > On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> >
> > > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > > after debug_pagealloc_unmap_pages(). This causes a crash when
> > > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > > unmapped page.
> > >
> > > This patch puts kasan_free_nondeferred_pages() before
> > > debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> > > the page unavailable.
> > >
> > > ...
> > >
> > > --- a/mm/page_alloc.c
> > > +++ b/mm/page_alloc.c
> > > @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > kernel_poison_pages(page, 1 << order);
> > >
> > > + /*
> > > + * With hardware tag-based KASAN, memory tags must be set before the
> > > + * page becomes unavailable via debug_pagealloc or arch_free_page.
> > > + */
> > > + kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > +
> > > /*
> > > * arch_free_page() can make the page's contents inaccessible. s390
> > > * does this. So nothing which can access the page's contents should
> > > @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > debug_pagealloc_unmap_pages(page, 1 << order);
> > >
> > > - kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > -
> > > return true;
> > > }
> >
> > kasan_free_nondeferred_pages() has only two args in current mainline.
>
> Ah, yes, forgot to mention: this goes on top of:
>
> kasan: initialize shadow to TAG_INVALID for SW_TAGS
> mm, kasan: don't poison boot memory with tag-based modes
>
> >
> > I fixed that in the obvious manner...
>
> Thanks!
>
> If you changed this patch, you'll also need to change the other one though.
Nevermind, just realized that this should be a backportable fix :)
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 23:54 ` Andrey Konovalov
0 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:54 UTC (permalink / raw)
To: Andrew Morton
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Sat, Mar 6, 2021 at 12:54 AM Andrey Konovalov <andreyknvl@google.com> wrote:
>
> On Sat, Mar 6, 2021 at 12:50 AM Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> > On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> >
> > > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > > after debug_pagealloc_unmap_pages(). This causes a crash when
> > > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > > unmapped page.
> > >
> > > This patch puts kasan_free_nondeferred_pages() before
> > > debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> > > the page unavailable.
> > >
> > > ...
> > >
> > > --- a/mm/page_alloc.c
> > > +++ b/mm/page_alloc.c
> > > @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > kernel_poison_pages(page, 1 << order);
> > >
> > > + /*
> > > + * With hardware tag-based KASAN, memory tags must be set before the
> > > + * page becomes unavailable via debug_pagealloc or arch_free_page.
> > > + */
> > > + kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > +
> > > /*
> > > * arch_free_page() can make the page's contents inaccessible. s390
> > > * does this. So nothing which can access the page's contents should
> > > @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > debug_pagealloc_unmap_pages(page, 1 << order);
> > >
> > > - kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > -
> > > return true;
> > > }
> >
> > kasan_free_nondeferred_pages() has only two args in current mainline.
>
> Ah, yes, forgot to mention: this goes on top of:
>
> kasan: initialize shadow to TAG_INVALID for SW_TAGS
> mm, kasan: don't poison boot memory with tag-based modes
>
> >
> > I fixed that in the obvious manner...
>
> Thanks!
>
> If you changed this patch, you'll also need to change the other one though.
Nevermind, just realized that this should be a backportable fix :)
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 23:54 ` Andrey Konovalov
0 siblings, 0 replies; 13+ messages in thread
From: Andrey Konovalov @ 2021-03-05 23:54 UTC (permalink / raw)
To: Andrew Morton
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Sat, Mar 6, 2021 at 12:54 AM Andrey Konovalov <andreyknvl@google.com> wrote:
>
> On Sat, Mar 6, 2021 at 12:50 AM Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> > On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> >
> > > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > > after debug_pagealloc_unmap_pages(). This causes a crash when
> > > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > > unmapped page.
> > >
> > > This patch puts kasan_free_nondeferred_pages() before
> > > debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> > > the page unavailable.
> > >
> > > ...
> > >
> > > --- a/mm/page_alloc.c
> > > +++ b/mm/page_alloc.c
> > > @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > kernel_poison_pages(page, 1 << order);
> > >
> > > + /*
> > > + * With hardware tag-based KASAN, memory tags must be set before the
> > > + * page becomes unavailable via debug_pagealloc or arch_free_page.
> > > + */
> > > + kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > +
> > > /*
> > > * arch_free_page() can make the page's contents inaccessible. s390
> > > * does this. So nothing which can access the page's contents should
> > > @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > debug_pagealloc_unmap_pages(page, 1 << order);
> > >
> > > - kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > -
> > > return true;
> > > }
> >
> > kasan_free_nondeferred_pages() has only two args in current mainline.
>
> Ah, yes, forgot to mention: this goes on top of:
>
> kasan: initialize shadow to TAG_INVALID for SW_TAGS
> mm, kasan: don't poison boot memory with tag-based modes
>
> >
> > I fixed that in the obvious manner...
>
> Thanks!
>
> If you changed this patch, you'll also need to change the other one though.
Nevermind, just realized that this should be a backportable fix :)
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
2021-03-05 23:54 ` Andrey Konovalov
@ 2021-03-06 1:27 ` Andrew Morton
-1 siblings, 0 replies; 13+ messages in thread
From: Andrew Morton @ 2021-03-06 1:27 UTC (permalink / raw)
To: Andrey Konovalov
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Sat, 6 Mar 2021 00:54:32 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> On Sat, Mar 6, 2021 at 12:50 AM Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> > On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> >
> > > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > > after debug_pagealloc_unmap_pages(). This causes a crash when
> > > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > > unmapped page.
> > >
> > > This patch puts kasan_free_nondeferred_pages() before
> > > debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> > > the page unavailable.
> > >
> > > ...
> > >
> > > --- a/mm/page_alloc.c
> > > +++ b/mm/page_alloc.c
> > > @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > kernel_poison_pages(page, 1 << order);
> > >
> > > + /*
> > > + * With hardware tag-based KASAN, memory tags must be set before the
> > > + * page becomes unavailable via debug_pagealloc or arch_free_page.
> > > + */
> > > + kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > +
> > > /*
> > > * arch_free_page() can make the page's contents inaccessible. s390
> > > * does this. So nothing which can access the page's contents should
> > > @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > debug_pagealloc_unmap_pages(page, 1 << order);
> > >
> > > - kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > -
> > > return true;
> > > }
> >
> > kasan_free_nondeferred_pages() has only two args in current mainline.
>
> Ah, yes, forgot to mention: this goes on top of:
>
> kasan: initialize shadow to TAG_INVALID for SW_TAGS
> mm, kasan: don't poison boot memory with tag-based modes
This patch (kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC) is
cc:stable, so it should come head of the other two lower priority
patches.
> >
> > I fixed that in the obvious manner...
>
> Thanks!
>
> If you changed this patch, you'll also need to change the other one though.
Yup.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-06 1:27 ` Andrew Morton
0 siblings, 0 replies; 13+ messages in thread
From: Andrew Morton @ 2021-03-06 1:27 UTC (permalink / raw)
To: Andrey Konovalov
Cc: Alexander Potapenko, Catalin Marinas, Will Deacon,
Vincenzo Frascino, Dmitry Vyukov, Andrey Ryabinin, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Sat, 6 Mar 2021 00:54:32 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> On Sat, Mar 6, 2021 at 12:50 AM Andrew Morton <akpm@linux-foundation.org> wrote:
> >
> > On Sat, 6 Mar 2021 00:36:33 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> >
> > > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > > after debug_pagealloc_unmap_pages(). This causes a crash when
> > > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > > unmapped page.
> > >
> > > This patch puts kasan_free_nondeferred_pages() before
> > > debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
> > > the page unavailable.
> > >
> > > ...
> > >
> > > --- a/mm/page_alloc.c
> > > +++ b/mm/page_alloc.c
> > > @@ -1304,6 +1304,12 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > kernel_poison_pages(page, 1 << order);
> > >
> > > + /*
> > > + * With hardware tag-based KASAN, memory tags must be set before the
> > > + * page becomes unavailable via debug_pagealloc or arch_free_page.
> > > + */
> > > + kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > +
> > > /*
> > > * arch_free_page() can make the page's contents inaccessible. s390
> > > * does this. So nothing which can access the page's contents should
> > > @@ -1313,8 +1319,6 @@ static __always_inline bool free_pages_prepare(struct page *page,
> > >
> > > debug_pagealloc_unmap_pages(page, 1 << order);
> > >
> > > - kasan_free_nondeferred_pages(page, order, fpi_flags);
> > > -
> > > return true;
> > > }
> >
> > kasan_free_nondeferred_pages() has only two args in current mainline.
>
> Ah, yes, forgot to mention: this goes on top of:
>
> kasan: initialize shadow to TAG_INVALID for SW_TAGS
> mm, kasan: don't poison boot memory with tag-based modes
This patch (kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC) is
cc:stable, so it should come head of the other two lower priority
patches.
> >
> > I fixed that in the obvious manner...
>
> Thanks!
>
> If you changed this patch, you'll also need to change the other one though.
Yup.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2021-03-06 1:29 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-05 23:36 [PATCH v2] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC Andrey Konovalov
2021-03-05 23:36 ` Andrey Konovalov
2021-03-05 23:36 ` Andrey Konovalov
2021-03-05 23:49 ` Andrew Morton
2021-03-05 23:49 ` Andrew Morton
2021-03-05 23:54 ` Andrey Konovalov
2021-03-05 23:54 ` Andrey Konovalov
2021-03-05 23:54 ` Andrey Konovalov
2021-03-05 23:54 ` Andrey Konovalov
2021-03-05 23:54 ` Andrey Konovalov
2021-03-05 23:54 ` Andrey Konovalov
2021-03-06 1:27 ` Andrew Morton
2021-03-06 1:27 ` Andrew Morton
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.