* [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-02-26 1:25 ` Andrey Konovalov
0 siblings, 0 replies; 11+ messages in thread
From: Andrey Konovalov @ 2021-02-26 1:25 UTC (permalink / raw)
To: Andrew Morton
Cc: linux-arm-kernel, Marco Elver, Catalin Marinas, Kevin Brodsky,
Will Deacon, Branislav Rankov, kasan-dev, linux-kernel,
Christoph Hellwig, linux-mm, Alexander Potapenko,
Evgenii Stepanov, Andrey Konovalov, Andrey Ryabinin,
Vincenzo Frascino, Peter Collingbourne, Dmitry Vyukov
Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
after debug_pagealloc_unmap_pages(). This causes a crash when
debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
unmapped page.
This patch puts kasan_free_nondeferred_pages() before
debug_pagealloc_unmap_pages().
Besides fixing the crash, this also makes the annotation order consistent
with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
mm/page_alloc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c89e7b107514..54bc237fd319 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1311,10 +1311,14 @@ static __always_inline bool free_pages_prepare(struct page *page,
*/
arch_free_page(page, order);
- debug_pagealloc_unmap_pages(page, 1 << order);
-
+ /*
+ * With hardware tag-based KASAN, memory tags must be set
+ * before unmapping the page with debug_pagealloc.
+ */
kasan_free_nondeferred_pages(page, order, fpi_flags);
+ debug_pagealloc_unmap_pages(page, 1 << order);
+
return true;
}
--
2.30.1.766.gb4fecdf3b7-goog
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply related [flat|nested] 11+ messages in thread
* [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-02-26 1:25 ` Andrey Konovalov
0 siblings, 0 replies; 11+ messages in thread
From: Andrey Konovalov @ 2021-02-26 1:25 UTC (permalink / raw)
To: Andrew Morton
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, linux-arm-kernel,
linux-mm, linux-kernel, Andrey Konovalov
Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
after debug_pagealloc_unmap_pages(). This causes a crash when
debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
unmapped page.
This patch puts kasan_free_nondeferred_pages() before
debug_pagealloc_unmap_pages().
Besides fixing the crash, this also makes the annotation order consistent
with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
mm/page_alloc.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index c89e7b107514..54bc237fd319 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1311,10 +1311,14 @@ static __always_inline bool free_pages_prepare(struct page *page,
*/
arch_free_page(page, order);
- debug_pagealloc_unmap_pages(page, 1 << order);
-
+ /*
+ * With hardware tag-based KASAN, memory tags must be set
+ * before unmapping the page with debug_pagealloc.
+ */
kasan_free_nondeferred_pages(page, order, fpi_flags);
+ debug_pagealloc_unmap_pages(page, 1 << order);
+
return true;
}
--
2.30.1.766.gb4fecdf3b7-goog
^ permalink raw reply related [flat|nested] 11+ messages in thread
* Re: [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
2021-02-26 1:25 ` Andrey Konovalov
@ 2021-03-03 23:23 ` Andrew Morton
-1 siblings, 0 replies; 11+ messages in thread
From: Andrew Morton @ 2021-03-03 23:23 UTC (permalink / raw)
To: Andrey Konovalov
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, linux-arm-kernel,
linux-mm, linux-kernel
On Fri, 26 Feb 2021 02:25:37 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> after debug_pagealloc_unmap_pages(). This causes a crash when
> debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> unmapped page.
>
> This patch puts kasan_free_nondeferred_pages() before
> debug_pagealloc_unmap_pages().
>
> Besides fixing the crash, this also makes the annotation order consistent
> with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
>
This bug exists in 5.12, does it not?
If so, is cc:stable appropriate and if so, do we have a suitable Fixes:
commit?
Thanks.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-03 23:23 ` Andrew Morton
0 siblings, 0 replies; 11+ messages in thread
From: Andrew Morton @ 2021-03-03 23:23 UTC (permalink / raw)
To: Andrey Konovalov
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, linux-arm-kernel,
linux-mm, linux-kernel
On Fri, 26 Feb 2021 02:25:37 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
> Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> after debug_pagealloc_unmap_pages(). This causes a crash when
> debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> unmapped page.
>
> This patch puts kasan_free_nondeferred_pages() before
> debug_pagealloc_unmap_pages().
>
> Besides fixing the crash, this also makes the annotation order consistent
> with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
>
This bug exists in 5.12, does it not?
If so, is cc:stable appropriate and if so, do we have a suitable Fixes:
commit?
Thanks.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
2021-03-03 23:23 ` Andrew Morton
(?)
@ 2021-03-05 15:43 ` Andrey Konovalov
-1 siblings, 0 replies; 11+ messages in thread
From: Andrey Konovalov @ 2021-03-05 15:43 UTC (permalink / raw)
To: Andrew Morton
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Thu, Mar 4, 2021 at 12:23 AM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Fri, 26 Feb 2021 02:25:37 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
>
> > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > after debug_pagealloc_unmap_pages(). This causes a crash when
> > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > unmapped page.
> >
> > This patch puts kasan_free_nondeferred_pages() before
> > debug_pagealloc_unmap_pages().
> >
> > Besides fixing the crash, this also makes the annotation order consistent
> > with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
> >
>
> This bug exists in 5.12, does it not?
>
> If so, is cc:stable appropriate and if so, do we have a suitable Fixes:
> commit?
Sure:
Fixes: 94ab5b61ee16 ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS")
Cc: <stable@vger.kernel.org>
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 15:43 ` Andrey Konovalov
0 siblings, 0 replies; 11+ messages in thread
From: Andrey Konovalov @ 2021-03-05 15:43 UTC (permalink / raw)
To: Andrew Morton
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Thu, Mar 4, 2021 at 12:23 AM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Fri, 26 Feb 2021 02:25:37 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
>
> > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > after debug_pagealloc_unmap_pages(). This causes a crash when
> > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > unmapped page.
> >
> > This patch puts kasan_free_nondeferred_pages() before
> > debug_pagealloc_unmap_pages().
> >
> > Besides fixing the crash, this also makes the annotation order consistent
> > with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
> >
>
> This bug exists in 5.12, does it not?
>
> If so, is cc:stable appropriate and if so, do we have a suitable Fixes:
> commit?
Sure:
Fixes: 94ab5b61ee16 ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS")
Cc: <stable@vger.kernel.org>
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 11+ messages in thread* Re: [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 15:43 ` Andrey Konovalov
0 siblings, 0 replies; 11+ messages in thread
From: Andrey Konovalov @ 2021-03-05 15:43 UTC (permalink / raw)
To: Andrew Morton
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, Linux ARM,
Linux Memory Management List, LKML, stable
On Thu, Mar 4, 2021 at 12:23 AM Andrew Morton <akpm@linux-foundation.org> wrote:
>
> On Fri, 26 Feb 2021 02:25:37 +0100 Andrey Konovalov <andreyknvl@google.com> wrote:
>
> > Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> > after debug_pagealloc_unmap_pages(). This causes a crash when
> > debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> > unmapped page.
> >
> > This patch puts kasan_free_nondeferred_pages() before
> > debug_pagealloc_unmap_pages().
> >
> > Besides fixing the crash, this also makes the annotation order consistent
> > with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
> >
>
> This bug exists in 5.12, does it not?
>
> If so, is cc:stable appropriate and if so, do we have a suitable Fixes:
> commit?
Sure:
Fixes: 94ab5b61ee16 ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS")
Cc: <stable@vger.kernel.org>
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
2021-02-26 1:25 ` Andrey Konovalov
(?)
@ 2021-03-05 17:04 ` Andrey Konovalov
-1 siblings, 0 replies; 11+ messages in thread
From: Andrey Konovalov @ 2021-03-05 17:04 UTC (permalink / raw)
To: Andrew Morton
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, Linux ARM,
Linux Memory Management List, LKML
On Fri, Feb 26, 2021 at 2:25 AM Andrey Konovalov <andreyknvl@google.com> wrote:
>
> Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> after debug_pagealloc_unmap_pages(). This causes a crash when
> debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> unmapped page.
>
> This patch puts kasan_free_nondeferred_pages() before
> debug_pagealloc_unmap_pages().
>
> Besides fixing the crash, this also makes the annotation order consistent
> with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
>
> Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
> ---
> mm/page_alloc.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index c89e7b107514..54bc237fd319 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1311,10 +1311,14 @@ static __always_inline bool free_pages_prepare(struct page *page,
> */
> arch_free_page(page, order);
>
> - debug_pagealloc_unmap_pages(page, 1 << order);
> -
> + /*
> + * With hardware tag-based KASAN, memory tags must be set
> + * before unmapping the page with debug_pagealloc.
> + */
> kasan_free_nondeferred_pages(page, order, fpi_flags);
Looking at this again, I think we need to move kasan_() callback above
arch_free_page(), as that can also make the page unavailable. I'll
send v2.
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 17:04 ` Andrey Konovalov
0 siblings, 0 replies; 11+ messages in thread
From: Andrey Konovalov @ 2021-03-05 17:04 UTC (permalink / raw)
To: Andrew Morton
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, Linux ARM,
Linux Memory Management List, LKML
On Fri, Feb 26, 2021 at 2:25 AM Andrey Konovalov <andreyknvl@google.com> wrote:
>
> Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> after debug_pagealloc_unmap_pages(). This causes a crash when
> debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> unmapped page.
>
> This patch puts kasan_free_nondeferred_pages() before
> debug_pagealloc_unmap_pages().
>
> Besides fixing the crash, this also makes the annotation order consistent
> with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
>
> Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
> ---
> mm/page_alloc.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index c89e7b107514..54bc237fd319 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1311,10 +1311,14 @@ static __always_inline bool free_pages_prepare(struct page *page,
> */
> arch_free_page(page, order);
>
> - debug_pagealloc_unmap_pages(page, 1 << order);
> -
> + /*
> + * With hardware tag-based KASAN, memory tags must be set
> + * before unmapping the page with debug_pagealloc.
> + */
> kasan_free_nondeferred_pages(page, order, fpi_flags);
Looking at this again, I think we need to move kasan_() callback above
arch_free_page(), as that can also make the page unavailable. I'll
send v2.
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH] kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
@ 2021-03-05 17:04 ` Andrey Konovalov
0 siblings, 0 replies; 11+ messages in thread
From: Andrey Konovalov @ 2021-03-05 17:04 UTC (permalink / raw)
To: Andrew Morton
Cc: Catalin Marinas, Will Deacon, Vincenzo Frascino, Dmitry Vyukov,
Andrey Ryabinin, Alexander Potapenko, Marco Elver,
Peter Collingbourne, Evgenii Stepanov, Branislav Rankov,
Kevin Brodsky, Christoph Hellwig, kasan-dev, Linux ARM,
Linux Memory Management List, LKML
On Fri, Feb 26, 2021 at 2:25 AM Andrey Konovalov <andreyknvl@google.com> wrote:
>
> Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
> after debug_pagealloc_unmap_pages(). This causes a crash when
> debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
> unmapped page.
>
> This patch puts kasan_free_nondeferred_pages() before
> debug_pagealloc_unmap_pages().
>
> Besides fixing the crash, this also makes the annotation order consistent
> with debug_pagealloc_map_pages() preceding kasan_alloc_pages().
>
> Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
> ---
> mm/page_alloc.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/mm/page_alloc.c b/mm/page_alloc.c
> index c89e7b107514..54bc237fd319 100644
> --- a/mm/page_alloc.c
> +++ b/mm/page_alloc.c
> @@ -1311,10 +1311,14 @@ static __always_inline bool free_pages_prepare(struct page *page,
> */
> arch_free_page(page, order);
>
> - debug_pagealloc_unmap_pages(page, 1 << order);
> -
> + /*
> + * With hardware tag-based KASAN, memory tags must be set
> + * before unmapping the page with debug_pagealloc.
> + */
> kasan_free_nondeferred_pages(page, order, fpi_flags);
Looking at this again, I think we need to move kasan_() callback above
arch_free_page(), as that can also make the page unavailable. I'll
send v2.
^ permalink raw reply [flat|nested] 11+ messages in thread