From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0F30C433F5 for ; Mon, 13 Dec 2021 21:59:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243448AbhLMV7s (ORCPT ); Mon, 13 Dec 2021 16:59:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33242 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S243466AbhLMV7q (ORCPT ); Mon, 13 Dec 2021 16:59:46 -0500 Received: from mail-il1-x132.google.com (mail-il1-x132.google.com [IPv6:2607:f8b0:4864:20::132]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 79F21C061574 for ; Mon, 13 Dec 2021 13:59:46 -0800 (PST) Received: by mail-il1-x132.google.com with SMTP id t1so3406429ils.11 for ; Mon, 13 Dec 2021 13:59:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BNW1RvPQZwm1C5HKSe2mnjCE7ya9sQIsxIsz8L3X9Xo=; b=AFw0EAZVYhtZb0kjOzExWi8L294KFToI1Em3urGtFjSQd9JkW7HjFQ4iOp6lcdkTDs s0KIuURm3rHMjTYCFxnzDKQlNvw3GNad4PAvf/7jFd0feQzei3a80L5AQbp4+2nUsdZl jZCgp9p/1Hr6AnkKBZ/OE1bWN7IZ7Gi7ubTdEccmlU882chctjUEhw64P7vq+pjGuqav ubgjskP7/39W6k9MPSe/ZFUrtf+cQ9W0v0CyU3bo8wOW2z6VdIVHpYaRBoAxMkywbiAE 110JqPwMiLmJyFXVjTlD3G9dQZRWEn/fptDxE9Yddf6QBLjRbFg7PPH0dnQswAHxQktH XVhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BNW1RvPQZwm1C5HKSe2mnjCE7ya9sQIsxIsz8L3X9Xo=; b=wzlv124RSnHcz3E0DkLioaGJv+Y2BVWcGb0W7PuSv4CyqXY44Mj/Sjz4VdtgltKRqO z7UG2IH8nn1ELPa+1kIs7+hlPuxC7QoaZz9g+0PzR31kwtSTGEnCNuiItg27IfG0YoXV POnZZeshsBz6+ZqSfk1uKhRrH7MmR15Zu3vZzXRXS5iHG3LF60D++uk1ifmkj0CWUuS5 xqwzSrtc1JMgymWSXrNvYWf8j7xXNYItv/kBkDdSVMIJFYbBIqgtf3cKu9lJc+bY+V8n 4v+7DeHWawEI1geUSLIT+UHMPDnZ+ZtMZHxhKZikENHiVuOsvJPQNamJ+gDz2c4Fx4xR SPhw== X-Gm-Message-State: AOAM5304uP+ZKDLZPtPBn02z0Po6USXyGbZVMNRAUzMT487IJrYTwswA OOThMOZMVbkGen5ydJD0j5ZFfbjdbYS3gwk5Mfs= X-Google-Smtp-Source: ABdhPJw/1rN4lq8DuEoGuVwsZabrwHwTtkKTIszhbJcLxpcHOEkIJwhJK1EKrYh44rTOBDgVCMPkoPzceaTP/CJTLBA= X-Received: by 2002:a05:6e02:f07:: with SMTP id x7mr921673ilj.28.1639432785937; Mon, 13 Dec 2021 13:59:45 -0800 (PST) MIME-Version: 1.0 References: <4a5ec956a2666c1f967c9789534a8ac4d4fe26f9.1639432170.git.andreyknvl@google.com> In-Reply-To: <4a5ec956a2666c1f967c9789534a8ac4d4fe26f9.1639432170.git.andreyknvl@google.com> From: Andrey Konovalov Date: Mon, 13 Dec 2021 22:59:35 +0100 Message-ID: Subject: Re: [PATCH mm v3 31/38] kasan, arm64: don't tag executable vmalloc allocations To: Vincenzo Frascino , Catalin Marinas Cc: Marco Elver , Alexander Potapenko , Andrew Morton , Dmitry Vyukov , Andrey Ryabinin , kasan-dev , Linux Memory Management List , Will Deacon , Mark Rutland , Linux ARM , Peter Collingbourne , Evgenii Stepanov , LKML , Andrey Konovalov , andrey.konovalov@linux.dev Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Dec 13, 2021 at 10:55 PM wrote: > > From: Andrey Konovalov > > Besides asking vmalloc memory to be executable via the prot argument > of __vmalloc_node_range() (see the previous patch), the kernel can skip > that bit and instead mark memory as executable via set_memory_x(). > > Once tag-based KASAN modes start tagging vmalloc allocations, executing > code from such allocations will lead to the PC register getting a tag, > which is not tolerated by the kernel. > > Generic kernel code typically allocates memory via module_alloc() if > it intends to mark memory as executable. (On arm64 module_alloc() > uses __vmalloc_node_range() without setting the executable bit). > > Thus, reset pointer tags of pointers returned from module_alloc(). > > However, on arm64 there's an exception: the eBPF subsystem. Instead of > using module_alloc(), it uses vmalloc() (via bpf_jit_alloc_exec()) > to allocate its JIT region. > > Thus, reset pointer tags of pointers returned from bpf_jit_alloc_exec(). > > Signed-off-by: Andrey Konovalov > > --- > > Changes v2->v3: > - Add this patch. > --- > arch/arm64/kernel/module.c | 3 ++- > arch/arm64/net/bpf_jit_comp.c | 3 ++- > 2 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c > index d3a1fa818348..f2d4bb14bfab 100644 > --- a/arch/arm64/kernel/module.c > +++ b/arch/arm64/kernel/module.c > @@ -63,7 +63,8 @@ void *module_alloc(unsigned long size) > return NULL; > } > > - return p; > + /* Memory is intended to be executable, reset the pointer tag. */ > + return kasan_reset_tag(p); > } > > enum aarch64_reloc_op { > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c > index 07aad85848fa..381a67922c2d 100644 > --- a/arch/arm64/net/bpf_jit_comp.c > +++ b/arch/arm64/net/bpf_jit_comp.c > @@ -1147,7 +1147,8 @@ u64 bpf_jit_alloc_exec_limit(void) > > void *bpf_jit_alloc_exec(unsigned long size) > { > - return vmalloc(size); > + /* Memory is intended to be executable, reset the pointer tag. */ > + return kasan_reset_tag(vmalloc(size)); > } > > void bpf_jit_free_exec(void *addr) > -- > 2.25.1 > Catalin, Vincenzo, This is a new patch added in v3. Could you PTAL? Thanks! From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C2363C433F5 for ; Mon, 13 Dec 2021 22:32:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:Subject:Message-ID:Date:From: In-Reply-To:References:MIME-Version:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Q4CV2eHQRegu4KA/swhy2JwV5vukhgIGEzdpHZZFZyg=; b=LTxnIjV484pGt6 kV08ufVG2HXqM4f/1MSt2Bkn8JdHCMA/kUEn+Bu8FkWRsh0LAcyPrXNwO3HxhL9hGfURHT3eVf2Kq rzocQ9QXEiezwVBq1img+Is/PvJHwBohyFtC49y1Ny+pbVvDrRR3VdtQuaeCK4uik0i9s0FEtTJ0M utvIiXklFTzfnOfA8Guz9mt4G6bTFJW6UrnwyvcpGxPyu9wjSRp+VXkaObHAw2wFjiJ8cQhSaJzav Ovgd3WUQd2UN1yp6U2z0sgRbVkVZpeSAGoUcmqAQfWJdpxTt7xweTseFEsEnbWL9CWNMUJmmFdU1c LqPWCa4qd2INuZ7lpcFQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mwtqY-00Bkqj-TQ; Mon, 13 Dec 2021 22:31:04 +0000 Received: from mail-il1-x132.google.com ([2607:f8b0:4864:20::132]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mwtMJ-00BYue-5T for linux-arm-kernel@lists.infradead.org; Mon, 13 Dec 2021 21:59:48 +0000 Received: by mail-il1-x132.google.com with SMTP id v13so2943361ilm.8 for ; Mon, 13 Dec 2021 13:59:46 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=BNW1RvPQZwm1C5HKSe2mnjCE7ya9sQIsxIsz8L3X9Xo=; b=AFw0EAZVYhtZb0kjOzExWi8L294KFToI1Em3urGtFjSQd9JkW7HjFQ4iOp6lcdkTDs s0KIuURm3rHMjTYCFxnzDKQlNvw3GNad4PAvf/7jFd0feQzei3a80L5AQbp4+2nUsdZl jZCgp9p/1Hr6AnkKBZ/OE1bWN7IZ7Gi7ubTdEccmlU882chctjUEhw64P7vq+pjGuqav ubgjskP7/39W6k9MPSe/ZFUrtf+cQ9W0v0CyU3bo8wOW2z6VdIVHpYaRBoAxMkywbiAE 110JqPwMiLmJyFXVjTlD3G9dQZRWEn/fptDxE9Yddf6QBLjRbFg7PPH0dnQswAHxQktH XVhg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=BNW1RvPQZwm1C5HKSe2mnjCE7ya9sQIsxIsz8L3X9Xo=; b=ATnx5DGn+U533oKu4w4p6BJtH+3B5tppCptma9FICk6dg72aozsTY5+36dNbE8g/Up wxtajypl73HF36GR8CQ2VVm7OvIvOAiF0ICCImlgR0Q/pDBhepN92CwcPjwfyIcL5orc F2CBJMWKbfE5j7xjKtoPMQpPbuvOfLPg9XEeh0pQnocne4DGiLp7YlNp9i3/PtViKGkl QwpAeqSZy6BWtg7uhDQtpoU4YEAQ9LsPj7NEb3NjXdFVqlD8+ZABSN8DBCwWgeLPyUrE 4PtNk9jKH3CvJqDbdF/4GxXBJTbrLn59e5tC8lEb+bol1uexr97sNPAFow5ukeFZvu43 6j/g== X-Gm-Message-State: AOAM531ZtOkMuisdjNGSbcHeTIJtLx/7+SwrhNEwikcY2d0KB0DF0NnJ jD0UCjJzxbSilaXUdK86LGFuDFrPnw7meOaJ1Q8= X-Google-Smtp-Source: ABdhPJw/1rN4lq8DuEoGuVwsZabrwHwTtkKTIszhbJcLxpcHOEkIJwhJK1EKrYh44rTOBDgVCMPkoPzceaTP/CJTLBA= X-Received: by 2002:a05:6e02:f07:: with SMTP id x7mr921673ilj.28.1639432785937; Mon, 13 Dec 2021 13:59:45 -0800 (PST) MIME-Version: 1.0 References: <4a5ec956a2666c1f967c9789534a8ac4d4fe26f9.1639432170.git.andreyknvl@google.com> In-Reply-To: <4a5ec956a2666c1f967c9789534a8ac4d4fe26f9.1639432170.git.andreyknvl@google.com> From: Andrey Konovalov Date: Mon, 13 Dec 2021 22:59:35 +0100 Message-ID: Subject: Re: [PATCH mm v3 31/38] kasan, arm64: don't tag executable vmalloc allocations To: Vincenzo Frascino , Catalin Marinas Cc: Marco Elver , Alexander Potapenko , Andrew Morton , Dmitry Vyukov , Andrey Ryabinin , kasan-dev , Linux Memory Management List , Will Deacon , Mark Rutland , Linux ARM , Peter Collingbourne , Evgenii Stepanov , LKML , Andrey Konovalov , andrey.konovalov@linux.dev X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211213_135947_254305_C84DB280 X-CRM114-Status: GOOD ( 21.99 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Dec 13, 2021 at 10:55 PM wrote: > > From: Andrey Konovalov > > Besides asking vmalloc memory to be executable via the prot argument > of __vmalloc_node_range() (see the previous patch), the kernel can skip > that bit and instead mark memory as executable via set_memory_x(). > > Once tag-based KASAN modes start tagging vmalloc allocations, executing > code from such allocations will lead to the PC register getting a tag, > which is not tolerated by the kernel. > > Generic kernel code typically allocates memory via module_alloc() if > it intends to mark memory as executable. (On arm64 module_alloc() > uses __vmalloc_node_range() without setting the executable bit). > > Thus, reset pointer tags of pointers returned from module_alloc(). > > However, on arm64 there's an exception: the eBPF subsystem. Instead of > using module_alloc(), it uses vmalloc() (via bpf_jit_alloc_exec()) > to allocate its JIT region. > > Thus, reset pointer tags of pointers returned from bpf_jit_alloc_exec(). > > Signed-off-by: Andrey Konovalov > > --- > > Changes v2->v3: > - Add this patch. > --- > arch/arm64/kernel/module.c | 3 ++- > arch/arm64/net/bpf_jit_comp.c | 3 ++- > 2 files changed, 4 insertions(+), 2 deletions(-) > > diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c > index d3a1fa818348..f2d4bb14bfab 100644 > --- a/arch/arm64/kernel/module.c > +++ b/arch/arm64/kernel/module.c > @@ -63,7 +63,8 @@ void *module_alloc(unsigned long size) > return NULL; > } > > - return p; > + /* Memory is intended to be executable, reset the pointer tag. */ > + return kasan_reset_tag(p); > } > > enum aarch64_reloc_op { > diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c > index 07aad85848fa..381a67922c2d 100644 > --- a/arch/arm64/net/bpf_jit_comp.c > +++ b/arch/arm64/net/bpf_jit_comp.c > @@ -1147,7 +1147,8 @@ u64 bpf_jit_alloc_exec_limit(void) > > void *bpf_jit_alloc_exec(unsigned long size) > { > - return vmalloc(size); > + /* Memory is intended to be executable, reset the pointer tag. */ > + return kasan_reset_tag(vmalloc(size)); > } > > void bpf_jit_free_exec(void *addr) > -- > 2.25.1 > Catalin, Vincenzo, This is a new patch added in v3. Could you PTAL? Thanks! _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel