From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 785F1C55ABD for ; Fri, 13 Nov 2020 22:17:52 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id CD91F206F9 for ; Fri, 13 Nov 2020 22:17:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="BJZUmVzJ" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CD91F206F9 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 504CA6B00BF; Fri, 13 Nov 2020 17:17:51 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 48C176B00C0; Fri, 13 Nov 2020 17:17:51 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 32EF06B00C1; Fri, 13 Nov 2020 17:17:51 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0005.hostedemail.com [216.40.44.5]) by kanga.kvack.org (Postfix) with ESMTP id 05EEB6B00BF for ; Fri, 13 Nov 2020 17:17:50 -0500 (EST) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 9A4F4824999B for ; Fri, 13 Nov 2020 22:17:50 +0000 (UTC) X-FDA: 77480808300.17.tooth96_0409ad627312 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin17.hostedemail.com (Postfix) with ESMTP id 82366180D0181 for ; Fri, 13 Nov 2020 22:17:50 +0000 (UTC) X-HE-Tag: tooth96_0409ad627312 X-Filterd-Recvd-Size: 9904 Received: from mail-wr1-f73.google.com (mail-wr1-f73.google.com [209.85.221.73]) by imf24.hostedemail.com (Postfix) with ESMTP for ; Fri, 13 Nov 2020 22:17:50 +0000 (UTC) Received: by mail-wr1-f73.google.com with SMTP id f4so4677334wru.21 for ; Fri, 13 Nov 2020 14:17:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:in-reply-to:message-id:mime-version:references:subject :from:to:cc; bh=Tgw0dhLMRnQraTF3rqRf/qE5jEFH9XeoJKKtJul5g6o=; b=BJZUmVzJKsLcxs5yrNlreBSWLH8n5/rBczpCaTaxoJZ3yrVJdREz+O7lA/RoRHQRBu SSRAE4XOEQTggLrp1vxIXkt910OGWEiGOxVR/cTasNJbfLCOUV3H0VOuETSAvOznUdC4 3pd2YBW9FFRsP5J7+DpDOpegH6ch1GTSj/1eeLMnNJmkGjn9zSMlQV/uSel7IjQTveH7 C8Y3rStiHBqjxlAsqTMP3Te8v8xSxuApcm3DGwimpyYBAziSJh7rw4Ncab+3dPbk4asc lb9aAKc8BoKm7KEvy7LvKVf362KR4NqZOAN2SYddabRTJT1DkV+zfU8LLSqIcPRBnntF NPbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=Tgw0dhLMRnQraTF3rqRf/qE5jEFH9XeoJKKtJul5g6o=; b=FEQewLyIr8OdHsDxNVNLr+ugES2L08Uvm2Em9lAhRbaroLMvRJL4DcpnF62rBqHj0d cV8jBEoxO0W1DfQomBQjZHVrsiBPN+ewdk5kYj/QQ7fqsbvCmhuxpMVGKI2MH+1DPoIq XGHa+2FIl1dwjzDw9hXnWTR29bKMieMmTz2qY3ynIprAEHyYdNBi6cQgnhzrKvrtswIJ 4VPBjGBiHrn+1KXLmpiS8QZdisEQqrklR+wjZdX6ku/QWX8BtaR+zDPHfi0uSR1H44kN ijMdyNrKvs2CmFvYFE8Mqk55yyob96o0pMxxnTerzJ05fYmp8Wn5C21z5d9+ZoNoz783 bJNg== X-Gm-Message-State: AOAM530lkt9t2OblJ469YwbZ/U7osyJAHO6Lda4uEiFjbuoEyvdWNBmm UzE5IOilhJHvaEGNRF88n+W8imikP/YXRkdj X-Google-Smtp-Source: ABdhPJzokMP5hixxGIpySZfV2WAybsk+hLaHN/viZgZd6Kb98h2xZC984rl8++IGk0ws/qZo8MQggfE00ANc2nWt X-Received: from andreyknvl3.muc.corp.google.com ([2a00:79e0:15:13:7220:84ff:fe09:7e9d]) (user=andreyknvl job=sendgmr) by 2002:a7b:c195:: with SMTP id y21mr4592763wmi.138.1605305868954; Fri, 13 Nov 2020 14:17:48 -0800 (PST) Date: Fri, 13 Nov 2020 23:16:07 +0100 In-Reply-To: Message-Id: <623f0aa1265c65f4477f09f7b830fd3cd91a23a9.1605305705.git.andreyknvl@google.com> Mime-Version: 1.0 References: X-Mailer: git-send-email 2.29.2.299.gdc1121823c-goog Subject: [PATCH mm v10 39/42] kasan, mm: reset tags when accessing metadata From: Andrey Konovalov To: Andrew Morton Cc: Catalin Marinas , Will Deacon , Vincenzo Frascino , Dmitry Vyukov , Andrey Ryabinin , Alexander Potapenko , Marco Elver , Evgenii Stepanov , Branislav Rankov , Kevin Brodsky , kasan-dev@googlegroups.com, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Kernel allocator code accesses metadata for slab objects, that may lie out-of-bounds of the object itself, or be accessed when an object is freed. Such accesses trigger tag faults and lead to false-positive reports with hardware tag-based KASAN. Software KASAN modes disable instrumentation for allocator code via KASAN_SANITIZE Makefile macro, and rely on kasan_enable/disable_current() annotations which are used to ignore KASAN reports. With hardware tag-based KASAN neither of those options are available, as it doesn't use compiler instrumetation, no tag faults are ignored, and MTE is disabled after the first one. Instead, reset tags when accessing metadata (currently only for SLUB). Signed-off-by: Andrey Konovalov Signed-off-by: Vincenzo Frascino Acked-by: Marco Elver Reviewed-by: Alexander Potapenko --- Change-Id: I39f3c4d4f29299d4fbbda039bedf230db1c746fb --- mm/page_alloc.c | 4 +++- mm/page_poison.c | 2 +- mm/slub.c | 29 ++++++++++++++++------------- 3 files changed, 20 insertions(+), 15 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 4a69fef13ac7..63d8d8b72c10 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -1195,8 +1195,10 @@ static void kernel_init_free_pages(struct page *page, int numpages) /* s390's use of memset() could override KASAN redzones. */ kasan_disable_current(); - for (i = 0; i < numpages; i++) + for (i = 0; i < numpages; i++) { + page_kasan_tag_reset(page + i); clear_highpage(page + i); + } kasan_enable_current(); } diff --git a/mm/page_poison.c b/mm/page_poison.c index ae0482cded87..e6c994af7518 100644 --- a/mm/page_poison.c +++ b/mm/page_poison.c @@ -53,7 +53,7 @@ static void poison_page(struct page *page) /* KASAN still think the page is in-use, so skip it. */ kasan_disable_current(); - memset(addr, PAGE_POISON, PAGE_SIZE); + memset(kasan_reset_tag(addr), PAGE_POISON, PAGE_SIZE); kasan_enable_current(); kunmap_atomic(addr); } diff --git a/mm/slub.c b/mm/slub.c index ccdbb62e025d..4148235ba554 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -250,7 +250,7 @@ static inline void *freelist_ptr(const struct kmem_cache *s, void *ptr, { #ifdef CONFIG_SLAB_FREELIST_HARDENED /* - * When CONFIG_KASAN_SW_TAGS is enabled, ptr_addr might be tagged. + * When CONFIG_KASAN_SW/HW_TAGS is enabled, ptr_addr might be tagged. * Normally, this doesn't cause any issues, as both set_freepointer() * and get_freepointer() are called with a pointer with the same tag. * However, there are some issues with CONFIG_SLUB_DEBUG code. For @@ -276,6 +276,7 @@ static inline void *freelist_dereference(const struct kmem_cache *s, static inline void *get_freepointer(struct kmem_cache *s, void *object) { + object = kasan_reset_tag(object); return freelist_dereference(s, object + s->offset); } @@ -305,6 +306,7 @@ static inline void set_freepointer(struct kmem_cache *s, void *object, void *fp) BUG_ON(object == fp); /* naive detection of double free or corruption */ #endif + freeptr_addr = (unsigned long)kasan_reset_tag((void *)freeptr_addr); *(void **)freeptr_addr = freelist_ptr(s, fp, freeptr_addr); } @@ -539,8 +541,8 @@ static void print_section(char *level, char *text, u8 *addr, unsigned int length) { metadata_access_enable(); - print_hex_dump(level, text, DUMP_PREFIX_ADDRESS, 16, 1, addr, - length, 1); + print_hex_dump(level, kasan_reset_tag(text), DUMP_PREFIX_ADDRESS, + 16, 1, addr, length, 1); metadata_access_disable(); } @@ -571,7 +573,7 @@ static struct track *get_track(struct kmem_cache *s, void *object, p = object + get_info_end(s); - return p + alloc; + return kasan_reset_tag(p + alloc); } static void set_track(struct kmem_cache *s, void *object, @@ -584,7 +586,8 @@ static void set_track(struct kmem_cache *s, void *object, unsigned int nr_entries; metadata_access_enable(); - nr_entries = stack_trace_save(p->addrs, TRACK_ADDRS_COUNT, 3); + nr_entries = stack_trace_save(kasan_reset_tag(p->addrs), + TRACK_ADDRS_COUNT, 3); metadata_access_disable(); if (nr_entries < TRACK_ADDRS_COUNT) @@ -748,7 +751,7 @@ static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page, static void init_object(struct kmem_cache *s, void *object, u8 val) { - u8 *p = object; + u8 *p = kasan_reset_tag(object); if (s->flags & SLAB_RED_ZONE) memset(p - s->red_left_pad, val, s->red_left_pad); @@ -778,7 +781,7 @@ static int check_bytes_and_report(struct kmem_cache *s, struct page *page, u8 *addr = page_address(page); metadata_access_enable(); - fault = memchr_inv(start, value, bytes); + fault = memchr_inv(kasan_reset_tag(start), value, bytes); metadata_access_disable(); if (!fault) return 1; @@ -874,7 +877,7 @@ static int slab_pad_check(struct kmem_cache *s, struct page *page) pad = end - remainder; metadata_access_enable(); - fault = memchr_inv(pad, POISON_INUSE, remainder); + fault = memchr_inv(kasan_reset_tag(pad), POISON_INUSE, remainder); metadata_access_disable(); if (!fault) return 1; @@ -1119,7 +1122,7 @@ void setup_page_debug(struct kmem_cache *s, struct page *page, void *addr) return; metadata_access_enable(); - memset(addr, POISON_INUSE, page_size(page)); + memset(kasan_reset_tag(addr), POISON_INUSE, page_size(page)); metadata_access_disable(); } @@ -1572,10 +1575,10 @@ static inline bool slab_free_freelist_hook(struct kmem_cache *s, * Clear the object and the metadata, but don't touch * the redzone. */ - memset(object, 0, s->object_size); + memset(kasan_reset_tag(object), 0, s->object_size); rsize = (s->flags & SLAB_RED_ZONE) ? s->red_left_pad : 0; - memset((char *)object + s->inuse, 0, + memset((char *)kasan_reset_tag(object) + s->inuse, 0, s->size - s->inuse - rsize); } @@ -2891,10 +2894,10 @@ static __always_inline void *slab_alloc_node(struct kmem_cache *s, stat(s, ALLOC_FASTPATH); } - maybe_wipe_obj_freeptr(s, object); + maybe_wipe_obj_freeptr(s, kasan_reset_tag(object)); if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object) - memset(object, 0, s->object_size); + memset(kasan_reset_tag(object), 0, s->object_size); out: slab_post_alloc_hook(s, objcg, gfpflags, 1, &object); -- 2.29.2.299.gdc1121823c-goog