From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 91E28C433F5 for ; Tue, 14 Dec 2021 19:28:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237418AbhLNT2A (ORCPT ); Tue, 14 Dec 2021 14:28:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232135AbhLNT17 (ORCPT ); Tue, 14 Dec 2021 14:27:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF47AC061574 for ; Tue, 14 Dec 2021 11:27:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7B519616C2 for ; Tue, 14 Dec 2021 19:27:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 174C0C34604; Tue, 14 Dec 2021 19:27:54 +0000 (UTC) Date: Tue, 14 Dec 2021 19:27:51 +0000 From: Catalin Marinas To: Andrey Konovalov Cc: andrey.konovalov@linux.dev, Marco Elver , Alexander Potapenko , Andrew Morton , Dmitry Vyukov , Andrey Ryabinin , kasan-dev , Linux Memory Management List , Vincenzo Frascino , Will Deacon , Mark Rutland , Linux ARM , Peter Collingbourne , Evgenii Stepanov , LKML , Andrey Konovalov Subject: Re: [PATCH mm v3 25/38] kasan, vmalloc, arm64: mark vmalloc mappings as pgprot_tagged Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Dec 14, 2021 at 07:27:09PM +0100, Andrey Konovalov wrote: > On Tue, Dec 14, 2021 at 6:11 PM Catalin Marinas wrote: > > On Mon, Dec 13, 2021 at 10:54:21PM +0100, andrey.konovalov@linux.dev wrote: > > > diff --git a/arch/arm64/include/asm/vmalloc.h b/arch/arm64/include/asm/vmalloc.h > > > index b9185503feae..3d35adf365bf 100644 > > > --- a/arch/arm64/include/asm/vmalloc.h > > > +++ b/arch/arm64/include/asm/vmalloc.h > > > @@ -25,4 +25,14 @@ static inline bool arch_vmap_pmd_supported(pgprot_t prot) > > > > > > #endif > > > > > > +#define arch_vmalloc_pgprot_modify arch_vmalloc_pgprot_modify > > > +static inline pgprot_t arch_vmalloc_pgprot_modify(pgprot_t prot) > > > +{ > > > + if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && > > > + (pgprot_val(prot) == pgprot_val(PAGE_KERNEL))) > > > + prot = pgprot_tagged(prot); > > > + > > > + return prot; > > > +} > > > + > > > #endif /* _ASM_ARM64_VMALLOC_H */ > > > diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h > > > index 28becb10d013..760caeedd749 100644 > > > --- a/include/linux/vmalloc.h > > > +++ b/include/linux/vmalloc.h > > > @@ -115,6 +115,13 @@ static inline int arch_vmap_pte_supported_shift(unsigned long size) > > > } > > > #endif > > > > > > +#ifndef arch_vmalloc_pgprot_modify > > > +static inline pgprot_t arch_vmalloc_pgprot_modify(pgprot_t prot) > > > +{ > > > + return prot; > > > +} > > > +#endif > > > + > > > /* > > > * Highlevel APIs for driver use > > > */ > > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > > > index 837ed355bfc6..58bd2f7f86d7 100644 > > > --- a/mm/vmalloc.c > > > +++ b/mm/vmalloc.c > > > @@ -3060,6 +3060,8 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, > > > return NULL; > > > } > > > > > > + prot = arch_vmalloc_pgprot_modify(prot); > > > + > > > if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP)) { > > > unsigned long size_per_node; > > > > I wonder whether we could fix the prot bits in the caller instead and we > > won't need to worry about the exec or the module_alloc() case. Something > > like: > > > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > > index d2a00ad4e1dd..4e8c61255b92 100644 > > --- a/mm/vmalloc.c > > +++ b/mm/vmalloc.c > > @@ -3112,7 +3112,7 @@ void *__vmalloc_node(unsigned long size, unsigned long align, > > gfp_t gfp_mask, int node, const void *caller) > > { > > return __vmalloc_node_range(size, align, VMALLOC_START, VMALLOC_END, > > - gfp_mask, PAGE_KERNEL, 0, node, caller); > > + gfp_mask, pgprot_hwasan(PAGE_KERNEL), 0, node, caller); > > } > > /* > > * This is only for performance analysis of vmalloc and stress purpose. > > @@ -3161,7 +3161,7 @@ EXPORT_SYMBOL(vmalloc); > > void *vmalloc_no_huge(unsigned long size) > > { > > return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END, > > - GFP_KERNEL, PAGE_KERNEL, VM_NO_HUGE_VMAP, > > + GFP_KERNEL, pgprot_hwasan(PAGE_KERNEL), VM_NO_HUGE_VMAP, > > NUMA_NO_NODE, __builtin_return_address(0)); > > } > > EXPORT_SYMBOL(vmalloc_no_huge); > > > > with pgprot_hwasan() defined to pgprot_tagged() only if KASAN_HW_TAGS is > > enabled. > > And also change kasan_unpoison_vmalloc() to tag only if > pgprot_tagged() has been applied, I assume. > > Hm. Then __vmalloc_node_range() callers will never get tagged memory > unless requested. I suppose that's OK, most of them untag the pointer > anyway. > > But this won't work for SW_TAGS mode, which is also affected by the > exec issue and needs those kasan_reset_tag()s in module_alloc()/BPF. > We could invent some virtual protection bit for it and reuse > pgprot_hwasan(). Not sure if this would be acceptable. Ah, a pgprot_hwasan() for the sw tags is probably not acceptable as this requires an unnecessary pte bit. An alternative could be a GFP flag that gets passed only from __vmalloc_node() etc. Otherwise your original approach works as well. -- Catalin From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 4249BC433F5 for ; Tue, 14 Dec 2021 19:29:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=GoKWitQCKmkMmnBsqyk7IFL/7X9pPEUVc6yHER5OlSc=; b=vXpI82uqS87jrZ 5NtWNksnQ5cJi2HdQmz4wQ+1g8VSbPxKsPb/o7Rdi937a0zR0DdpMQ123B9fZ0tFKV+WrZduYp/I9 VHFpr1eNAR3px4O+Yc6l1atbrqXd8UoO+O1r48cvLOwV28u0Q5T90N/T0Vc8F4zVdvdaNqURPAatn CePZalJnBbTL42WByJlCKo3L/ciYRUROsbn1ackx2WtwmqW414YzhV6VpxTJnLWwtmwIWxpZEBFXk d+NUj53cgdYTIfZRAV0l8A6AuIepLqo31Dks/vHxW5s/tVYy9ww3+MGXh/kTYtPit4nc+d38+8E6e Qgyi84N9rr+tllLckYCA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1mxDT3-00FbaI-Uh; Tue, 14 Dec 2021 19:28:06 +0000 Received: from dfw.source.kernel.org ([2604:1380:4641:c500::1]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1mxDSz-00FbYg-T0 for linux-arm-kernel@lists.infradead.org; Tue, 14 Dec 2021 19:28:03 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 79707616BD; Tue, 14 Dec 2021 19:27:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 174C0C34604; Tue, 14 Dec 2021 19:27:54 +0000 (UTC) Date: Tue, 14 Dec 2021 19:27:51 +0000 From: Catalin Marinas To: Andrey Konovalov Cc: andrey.konovalov@linux.dev, Marco Elver , Alexander Potapenko , Andrew Morton , Dmitry Vyukov , Andrey Ryabinin , kasan-dev , Linux Memory Management List , Vincenzo Frascino , Will Deacon , Mark Rutland , Linux ARM , Peter Collingbourne , Evgenii Stepanov , LKML , Andrey Konovalov Subject: Re: [PATCH mm v3 25/38] kasan, vmalloc, arm64: mark vmalloc mappings as pgprot_tagged Message-ID: References: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20211214_112802_038074_96174B20 X-CRM114-Status: GOOD ( 28.40 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Tue, Dec 14, 2021 at 07:27:09PM +0100, Andrey Konovalov wrote: > On Tue, Dec 14, 2021 at 6:11 PM Catalin Marinas wrote: > > On Mon, Dec 13, 2021 at 10:54:21PM +0100, andrey.konovalov@linux.dev wrote: > > > diff --git a/arch/arm64/include/asm/vmalloc.h b/arch/arm64/include/asm/vmalloc.h > > > index b9185503feae..3d35adf365bf 100644 > > > --- a/arch/arm64/include/asm/vmalloc.h > > > +++ b/arch/arm64/include/asm/vmalloc.h > > > @@ -25,4 +25,14 @@ static inline bool arch_vmap_pmd_supported(pgprot_t prot) > > > > > > #endif > > > > > > +#define arch_vmalloc_pgprot_modify arch_vmalloc_pgprot_modify > > > +static inline pgprot_t arch_vmalloc_pgprot_modify(pgprot_t prot) > > > +{ > > > + if (IS_ENABLED(CONFIG_KASAN_HW_TAGS) && > > > + (pgprot_val(prot) == pgprot_val(PAGE_KERNEL))) > > > + prot = pgprot_tagged(prot); > > > + > > > + return prot; > > > +} > > > + > > > #endif /* _ASM_ARM64_VMALLOC_H */ > > > diff --git a/include/linux/vmalloc.h b/include/linux/vmalloc.h > > > index 28becb10d013..760caeedd749 100644 > > > --- a/include/linux/vmalloc.h > > > +++ b/include/linux/vmalloc.h > > > @@ -115,6 +115,13 @@ static inline int arch_vmap_pte_supported_shift(unsigned long size) > > > } > > > #endif > > > > > > +#ifndef arch_vmalloc_pgprot_modify > > > +static inline pgprot_t arch_vmalloc_pgprot_modify(pgprot_t prot) > > > +{ > > > + return prot; > > > +} > > > +#endif > > > + > > > /* > > > * Highlevel APIs for driver use > > > */ > > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > > > index 837ed355bfc6..58bd2f7f86d7 100644 > > > --- a/mm/vmalloc.c > > > +++ b/mm/vmalloc.c > > > @@ -3060,6 +3060,8 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, > > > return NULL; > > > } > > > > > > + prot = arch_vmalloc_pgprot_modify(prot); > > > + > > > if (vmap_allow_huge && !(vm_flags & VM_NO_HUGE_VMAP)) { > > > unsigned long size_per_node; > > > > I wonder whether we could fix the prot bits in the caller instead and we > > won't need to worry about the exec or the module_alloc() case. Something > > like: > > > > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > > index d2a00ad4e1dd..4e8c61255b92 100644 > > --- a/mm/vmalloc.c > > +++ b/mm/vmalloc.c > > @@ -3112,7 +3112,7 @@ void *__vmalloc_node(unsigned long size, unsigned long align, > > gfp_t gfp_mask, int node, const void *caller) > > { > > return __vmalloc_node_range(size, align, VMALLOC_START, VMALLOC_END, > > - gfp_mask, PAGE_KERNEL, 0, node, caller); > > + gfp_mask, pgprot_hwasan(PAGE_KERNEL), 0, node, caller); > > } > > /* > > * This is only for performance analysis of vmalloc and stress purpose. > > @@ -3161,7 +3161,7 @@ EXPORT_SYMBOL(vmalloc); > > void *vmalloc_no_huge(unsigned long size) > > { > > return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END, > > - GFP_KERNEL, PAGE_KERNEL, VM_NO_HUGE_VMAP, > > + GFP_KERNEL, pgprot_hwasan(PAGE_KERNEL), VM_NO_HUGE_VMAP, > > NUMA_NO_NODE, __builtin_return_address(0)); > > } > > EXPORT_SYMBOL(vmalloc_no_huge); > > > > with pgprot_hwasan() defined to pgprot_tagged() only if KASAN_HW_TAGS is > > enabled. > > And also change kasan_unpoison_vmalloc() to tag only if > pgprot_tagged() has been applied, I assume. > > Hm. Then __vmalloc_node_range() callers will never get tagged memory > unless requested. I suppose that's OK, most of them untag the pointer > anyway. > > But this won't work for SW_TAGS mode, which is also affected by the > exec issue and needs those kasan_reset_tag()s in module_alloc()/BPF. > We could invent some virtual protection bit for it and reuse > pgprot_hwasan(). Not sure if this would be acceptable. Ah, a pgprot_hwasan() for the sw tags is probably not acceptable as this requires an unnecessary pte bit. An alternative could be a GFP flag that gets passed only from __vmalloc_node() etc. Otherwise your original approach works as well. -- Catalin _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel