From: Mark Rutland <mark.rutland@arm.com>
To: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>,
Alexander Potapenko <glider@google.com>,
Dmitry Vyukov <dvyukov@google.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>,
Christoph Lameter <cl@linux.com>,
Andrew Morton <akpm@linux-foundation.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Marc Zyngier <marc.zyngier@arm.com>,
Dave Martin <dave.martin@arm.com>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
"Eric W . Biederman" <ebiederm@xmission.com>,
Ingo Molnar <mingo@kernel.org>,
Paul Lawrence <paullawrence@google.com>,
Geert Uytterhoeven <geert@linux-m68k.org>,
Arnd Bergmann <arnd@arndb.de>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Kate Stewart <kstewart@linuxfoundation.org>,
Mike Rapoport <rppt@linux.vnet.ibm.com>,
kasan-dev@googlegroups.com, linux-doc@vger.kernel.org,
linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
linux-sparse@vger.kernel.org, linux-mm@kvack.org,
linux-kbuild@vger.kernel.org, Kostya Serebryany <kcc@google.com>,
Evgeniy Stepanov <eugenis@google.com>,
Lee Smith <Lee.Smith@arm.com>,
Ramana Radhakrishnan <Ramana.Radhakrishnan@arm.com>,
Jacob Bramley <Jacob.Bramley@arm.com>,
Ruben Ayrapetyan <Ruben.Ayrapetyan@arm.com>,
Jann Horn <jannh@google.com>, Mark Brand <markbrand@google.com>,
Chintan Pandya <cpandya@codeaurora.org>,
Vishwath Mohan <vishwath@google.com>
Subject: Re: [PATCH v10 12/22] kasan, arm64: fix up fault handling logic
Date: Thu, 8 Nov 2018 12:22:29 +0000 [thread overview]
Message-ID: <20181108122228.xqwhpkjritrvqneq@lakrids.cambridge.arm.com> (raw)
In-Reply-To: <4891a504adf61c0daf1e83642b6f7519328dfd5f.1541525354.git.andreyknvl@google.com>
On Tue, Nov 06, 2018 at 06:30:27PM +0100, Andrey Konovalov wrote:
> show_pte in arm64 fault handling relies on the fact that the top byte of
> a kernel pointer is 0xff, which isn't always the case with tag-based
> KASAN.
That's for the TTBR1 check, right?
i.e. for the following to work:
if (addr >= VA_START)
... we need the tag bits to be an extension of bit 55...
>
> This patch resets the top byte in show_pte.
>
> Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
> Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
> Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
> ---
> arch/arm64/mm/fault.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
> index 7d9571f4ae3d..d9a84d6f3343 100644
> --- a/arch/arm64/mm/fault.c
> +++ b/arch/arm64/mm/fault.c
> @@ -32,6 +32,7 @@
> #include <linux/perf_event.h>
> #include <linux/preempt.h>
> #include <linux/hugetlb.h>
> +#include <linux/kasan.h>
>
> #include <asm/bug.h>
> #include <asm/cmpxchg.h>
> @@ -141,6 +142,8 @@ void show_pte(unsigned long addr)
> pgd_t *pgdp;
> pgd_t pgd;
>
> + addr = (unsigned long)kasan_reset_tag((void *)addr);
... but this ORs in (0xffUL << 56), which is not correct for addresses
which aren't TTBR1 addresses to begin with, where bit 55 is clear, and
throws away useful information.
We could use untagged_addr() here, but that wouldn't be right for
kernels which don't use TBI1, and we'd erroneously report addresses
under the TTBR1 range as being in the TTBR1 range.
I also see that the entry assembly for el{1,0}_{da,ia} clears the tag
for EL0 addresses.
So we could have:
static inline bool is_ttbr0_addr(unsigned long addr)
{
/* entry assembly clears tags for TTBR0 addrs */
return addr < TASK_SIZE_64;
}
static inline bool is_ttbr1_addr(unsigned long addr)
{
/* TTBR1 addresses may have a tag if HWKASAN is in use */
return arch_kasan_reset_tag(addr) >= VA_START;
}
... and use those in the conditionals, leaving the addr as-is for
reporting purposes.
Thanks,
Mark.
next prev parent reply other threads:[~2018-11-08 12:22 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-06 17:30 [PATCH v10 00/22] kasan: add software tag-based mode for arm64 Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 01/22] kasan, mm: change hooks signatures Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 02/22] kasan, slub: handle pointer tags in early_kmem_cache_node_alloc Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 03/22] kasan: move common generic and tag-based code to common.c Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 04/22] kasan: rename source files to reflect the new naming scheme Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 05/22] kasan: add CONFIG_KASAN_GENERIC and CONFIG_KASAN_SW_TAGS Andrey Konovalov
2018-11-07 17:04 ` Mark Rutland
2018-11-12 18:21 ` Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 06/22] kasan, arm64: adjust shadow size for tag-based mode Andrey Konovalov
2018-11-07 16:54 ` Mark Rutland
2018-11-12 17:50 ` Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 07/22] kasan: initialize shadow to 0xff " Andrey Konovalov
2018-11-07 17:08 ` Mark Rutland
2018-11-13 14:13 ` Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 08/22] kasan, arm64: untag address in __kimg_to_phys and _virt_addr_is_linear Andrey Konovalov
2018-11-07 16:52 ` Mark Rutland
2018-11-14 19:23 ` Andrey Konovalov
2018-11-15 13:43 ` Andrey Konovalov
2018-11-07 18:10 ` Catalin Marinas
2018-11-14 19:52 ` Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 09/22] kasan: add tag related helper functions Andrey Konovalov
2018-11-07 17:23 ` Mark Rutland
2018-11-14 19:19 ` Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 10/22] kasan: preassign tags to objects with ctors or SLAB_TYPESAFE_BY_RCU Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 11/22] mm: move obj_to_index to include/linux/slab_def.h Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 12/22] kasan, arm64: fix up fault handling logic Andrey Konovalov
2018-11-07 18:26 ` Catalin Marinas
2018-11-08 12:22 ` Mark Rutland [this message]
2018-11-13 15:01 ` Andrey Konovalov
2018-11-13 22:07 ` Mark Rutland
2018-11-14 20:06 ` Andrey Konovalov
2018-11-14 20:17 ` Mark Rutland
2018-11-15 13:33 ` Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 13/22] kasan, arm64: enable top byte ignore for the kernel Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 14/22] kasan, mm: perform untagged pointers comparison in krealloc Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 15/22] kasan: split out generic_report.c from report.c Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 16/22] kasan: add bug reporting routines for tag-based mode Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 17/22] kasan: add hooks implementation " Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 18/22] kasan, arm64: add brk handler for inline instrumentation Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 19/22] kasan, mm, arm64: tag non slab memory allocated via pagealloc Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 20/22] kasan: add __must_check annotations to kasan hooks Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 21/22] kasan: update documentation Andrey Konovalov
2018-11-06 17:30 ` [PATCH v10 22/22] kasan: add SPDX-License-Identifier mark to source files Andrey Konovalov
2018-11-07 14:56 ` [PATCH v10 00/22] kasan: add software tag-based mode for arm64 Andrey Konovalov
2018-11-07 14:59 ` Will Deacon
2018-11-07 15:11 ` Andrey Konovalov
2018-11-07 15:34 ` Will Deacon
2018-11-07 15:54 ` Andrey Konovalov
2018-11-07 15:56 ` Andrey Konovalov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181108122228.xqwhpkjritrvqneq@lakrids.cambridge.arm.com \
--to=mark.rutland@arm.com \
--cc=Jacob.Bramley@arm.com \
--cc=Lee.Smith@arm.com \
--cc=Ramana.Radhakrishnan@arm.com \
--cc=Ruben.Ayrapetyan@arm.com \
--cc=akpm@linux-foundation.org \
--cc=andreyknvl@google.com \
--cc=ard.biesheuvel@linaro.org \
--cc=arnd@arndb.de \
--cc=aryabinin@virtuozzo.com \
--cc=catalin.marinas@arm.com \
--cc=cl@linux.com \
--cc=cpandya@codeaurora.org \
--cc=dave.martin@arm.com \
--cc=dvyukov@google.com \
--cc=ebiederm@xmission.com \
--cc=eugenis@google.com \
--cc=geert@linux-m68k.org \
--cc=glider@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=kasan-dev@googlegroups.com \
--cc=kcc@google.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=kstewart@linuxfoundation.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-sparse@vger.kernel.org \
--cc=marc.zyngier@arm.com \
--cc=markbrand@google.com \
--cc=mingo@kernel.org \
--cc=ndesaulniers@google.com \
--cc=paullawrence@google.com \
--cc=rppt@linux.vnet.ibm.com \
--cc=vishwath@google.com \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).