From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,INCLUDES_PATCH,MAILING_LIST_MULTI, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06F9AC07E95 for ; Fri, 16 Jul 2021 05:07:05 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 7C813613ED for ; Fri, 16 Jul 2021 05:07:04 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 7C813613ED Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=huawei.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id AF9B18D00F4; Fri, 16 Jul 2021 01:07:04 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id AA96B8D00EC; Fri, 16 Jul 2021 01:07:04 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 949E98D00F4; Fri, 16 Jul 2021 01:07:04 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 72D168D00EC for ; Fri, 16 Jul 2021 01:07:04 -0400 (EDT) Received: from smtpin23.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 47EF018575271 for ; Fri, 16 Jul 2021 05:07:03 +0000 (UTC) X-FDA: 78367266726.23.D1489AB Received: from szxga01-in.huawei.com (szxga01-in.huawei.com [45.249.212.187]) by imf24.hostedemail.com (Postfix) with ESMTP id 03472B000808 for ; Fri, 16 Jul 2021 05:07:01 +0000 (UTC) Received: from dggemv703-chm.china.huawei.com (unknown [172.30.72.55]) by szxga01-in.huawei.com (SkyGuard) with ESMTP id 4GQzb952ZJzYcvF; Fri, 16 Jul 2021 13:00:53 +0800 (CST) Received: from dggpemm500001.china.huawei.com (7.185.36.107) by dggemv703-chm.china.huawei.com (10.3.19.46) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Fri, 16 Jul 2021 13:06:33 +0800 Received: from [10.174.177.243] (10.174.177.243) by dggpemm500001.china.huawei.com (7.185.36.107) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Fri, 16 Jul 2021 13:06:33 +0800 Subject: Re: [PATCH -next 3/3] kasan: arm64: Fix pcpu_page_first_chunk crash with KASAN_VMALLOC From: Kefeng Wang To: Marco Elver , Dmitry Vyukov CC: Catalin Marinas , Will Deacon , Andrey Ryabinin , Andrey Konovalov , , , , , Daniel Axtens References: <20210705111453.164230-1-wangkefeng.wang@huawei.com> <20210705111453.164230-4-wangkefeng.wang@huawei.com> <089f5187-9a4d-72dc-1767-8130434bfb3a@huawei.com> Message-ID: <5f760f6c-dcbd-b28a-2116-a2fb233fc534@huawei.com> Date: Fri, 16 Jul 2021 13:06:32 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: <089f5187-9a4d-72dc-1767-8130434bfb3a@huawei.com> Content-Type: multipart/alternative; boundary="------------FB17C0B34F7D9467DE6387C5" Content-Language: en-US X-Originating-IP: [10.174.177.243] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To dggpemm500001.china.huawei.com (7.185.36.107) X-CFilter-Loop: Reflected X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 03472B000808 X-Stat-Signature: i8qhrxwyx9yhdxuxk7sumnff6zte3j5g Authentication-Results: imf24.hostedemail.com; dkim=none; dmarc=pass (policy=none) header.from=huawei.com; spf=pass (imf24.hostedemail.com: domain of wangkefeng.wang@huawei.com designates 45.249.212.187 as permitted sender) smtp.mailfrom=wangkefeng.wang@huawei.com X-HE-Tag: 1626412021-202980 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: --------------FB17C0B34F7D9467DE6387C5 Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: quoted-printable Hi Marco and Dmitry, any comments about the following replay, thanks. On 2021/7/6 12:07, Kefeng Wang wrote: > > Hi Marco and Dmitry, > > On 2021/7/5 23:04, Marco Elver wrote: >> On Mon, Jul 05, 2021 at 07:14PM +0800, Kefeng Wang wrote: >> [...] >>> +#ifdef CONFIG_KASAN_VMALLOC >>> +void __init __weak kasan_populate_early_vm_area_shadow(void *start, >>> + unsigned long size) >> This should probably not be __weak, otherwise you now have 2 __weak >> functions. > Indeed, forget it. >>> +{ >>> + unsigned long shadow_start, shadow_end; >>> + >>> + if (!is_vmalloc_or_module_addr(start)) >>> + return; >>> + >>> + shadow_start =3D (unsigned long)kasan_mem_to_shadow(start); >>> + shadow_start =3D ALIGN_DOWN(shadow_start, PAGE_SIZE); >>> + shadow_end =3D (unsigned long)kasan_mem_to_shadow(start + size); >>> + shadow_end =3D ALIGN(shadow_end, PAGE_SIZE); >>> + kasan_map_populate(shadow_start, shadow_end, >>> + early_pfn_to_nid(virt_to_pfn(start))); >>> +} >>> +#endif >> This function looks quite generic -- would any of this also apply to >> other architectures? I see that ppc and sparc at least also define >> CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK. > > I can't try ppc/sparc, but only ppc support KASAN_VMALLOC, > > I check the x86, it supports CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK, > > looks this issue is existing on x86 and ppc. > >>> void __init kasan_init(void) >>> { >>> kasan_init_shadow(); >>> diff --git a/include/linux/kasan.h b/include/linux/kasan.h >>> index 5310e217bd74..79d3895b0240 100644 >>> --- a/include/linux/kasan.h >>> +++ b/include/linux/kasan.h >>> @@ -49,6 +49,8 @@ extern p4d_t kasan_early_shadow_p4d[MAX_PTRS_PER_P4= D]; >>> int kasan_populate_early_shadow(const void *shadow_start, >>> const void *shadow_end); >>> =20 >>> +void kasan_populate_early_vm_area_shadow(void *start, unsigned long = size); >>> + >>> static inline void *kasan_mem_to_shadow(const void *addr) >>> { >>> return (void *)((unsigned long)addr >> KASAN_SHADOW_SCALE_SHIFT) >>> diff --git a/mm/kasan/init.c b/mm/kasan/init.c >>> index cc64ed6858c6..d39577d088a1 100644 >>> --- a/mm/kasan/init.c >>> +++ b/mm/kasan/init.c >>> @@ -279,6 +279,11 @@ int __ref kasan_populate_early_shadow(const void= *shadow_start, >>> return 0; >>> } >>> =20 >>> +void __init __weak kasan_populate_early_vm_area_shadow(void *start, >>> + unsigned long size) >>> +{ >>> +} >> I'm just wondering if this could be a generic function, perhaps with a= n >> appropriate IS_ENABLED() check of a generic Kconfig option >> (CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK ?) to short-circuit it, if it's >> not only an arm64 problem. > > kasan_map_populate() is arm64 special function, and the x86 has kasan_s= hallow_populate_pgds(), > ppc has kasan_init_shadow_page_tables(), so look those ARCHs should do = the same way like ARM64, > > Here we can't use kasan_populate_early_shadow(), this functions will ma= ke the early shadow maps > everything to a single page of zeroes=EF=BC=88kasan_early_shadow_page),= and set it pte_wrprotect, see > zero_pte_populate(), right? > > Also I try this, it crashs on ARM64 when change kasan_map_populate() to= kasan_populate_early_shadow(), > > Unable to handle kernel write to read-only memory at virtual address ff= ff700002938000 > ... > Call trace: > __memset+0x16c/0x1c0 > kasan_unpoison+0x34/0x6c > kasan_unpoison_vmalloc+0x2c/0x3c > __get_vm_area_node.constprop.0+0x13c/0x240 > __vmalloc_node_range+0xf4/0x4f0 > __vmalloc_node+0x80/0x9c > init_IRQ+0xe8/0x130 > start_kernel+0x188/0x360 > __primary_switched+0xc0/0xc8 > > >> But I haven't looked much further, so would appeal to you to either >> confirm or reject this idea. >> >> Thanks, >> -- Marco >> . >> --------------FB17C0B34F7D9467DE6387C5 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Hi Marco and Dmitry, any comments about the following replay, thanks.

On 2021/7/6 12:07, Kefeng Wang wrote:<= br>

Hi Marco and Dmitry,

On 2021/7/5 23:04, Marco Elver wrote= :
On Mon, Jul 05, 2021 at 07=
:14PM +0800, Kefeng Wang wrote:
[...]

+#ifdef CONFIG_KASAN_VMA=
LLOC
+void __init __weak kasan_populate_early_vm_area_shadow(void *start,
+						       unsigned long size)

This should probably not b=
e __weak, otherwise you now have 2 __weak
functions.
Indeed, forget it.
+{
+	unsigned long shadow_start, shadow_end;
+
+	if (!is_vmalloc_or_module_addr(start))
+		return;
+
+	shadow_start =3D (unsigned long)kasan_mem_to_shadow(start);
+	shadow_start =3D ALIGN_DOWN(shadow_start, PAGE_SIZE);
+	shadow_end =3D (unsigned long)kasan_mem_to_shadow(start + size);
+	shadow_end =3D ALIGN(shadow_end, PAGE_SIZE);
+	kasan_map_populate(shadow_start, shadow_end,
+			   early_pfn_to_nid(virt_to_pfn(start)));
+}
+#endif

This function looks quite =
generic -- would any of this also apply to
other architectures? I see that ppc and sparc at least also define
CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK.

I can't try ppc/sparc, but only ppc support KASAN_VMALLOC,

I check the x86, it supports CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK,

looks this issue is existing on x86 and ppc.

 void __init kasan_init(=
void)
 {
 	kasan_init_shadow();
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 5310e217bd74..79d3895b0240 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -49,6 +49,8 @@ extern p4d_t kasan_early_shadow_p4d[MAX_PTRS_PER_P4D];
 int kasan_populate_early_shadow(const void *shadow_start,
 				const void *shadow_end);
=20
+void kasan_populate_early_vm_area_shadow(void *start, unsigned long size=
);
+
 static inline void *kasan_mem_to_shadow(const void *addr)
 {
 	return (void *)((unsigned long)addr >> KASAN_SHADOW_SCALE_SHIFT)
diff --git a/mm/kasan/init.c b/mm/kasan/init.c
index cc64ed6858c6..d39577d088a1 100644
--- a/mm/kasan/init.c
+++ b/mm/kasan/init.c
@@ -279,6 +279,11 @@ int __ref kasan_populate_early_shadow(const void *sh=
adow_start,
 	return 0;
 }
=20
+void __init __weak kasan_populate_early_vm_area_shadow(void *start,
+						       unsigned long size)
+{
+}

I'm just wondering if this=
 could be a generic function, perhaps with an
appropriate IS_ENABLED() check of a generic Kconfig option
(CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK ?) to short-circuit it, if it's
not only an arm64 problem.

kasan_map_populate() is arm6=
4 special function, and the x86 has kasan_shallow_populate_pgds(),
ppc has kasan_init_shadow_page_tables(), so look those ARCHs should do th=
e same way like ARM64,

Here we can't use kasan_populate_early_shadow(), this functions will make=
 the early shadow maps
everything to a single page of zeroes=EF=BC=88kas=
an_early_shadow_page), and set it pte_wrprotect, see
zero_pte_populate(), right?=20

Also I try this, it crashs on ARM64 when change kasan_map_populate() to k=
asan_populate_early_shadow(),

Unable to handle kernel write to read-only memory at virtual address ffff=
700002938000
...
Call trace:
 __memset+0x16c/0x1c0
 kasan_unpoison+0x34/0x6c
 kasan_unpoison_vmalloc+0x2c/0x3c
 __get_vm_area_node.constprop.0+0x13c/0x240
 __vmalloc_node_range+0xf4/0x4f0
 __vmalloc_node+0x80/0x9c
 init_IRQ+0xe8/0x130
 start_kernel+0x188/0x360
 __primary_switched+0xc0/0xc8



But I haven't looked much =
further, so would appeal to you to either
confirm or reject this idea.

Thanks,
-- Marco
.
--------------FB17C0B34F7D9467DE6387C5--