From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E0ABC2D0A3 for ; Thu, 12 Nov 2020 16:10:16 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 61D5F20825 for ; Thu, 12 Nov 2020 16:10:15 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="K9N+LydT" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 61D5F20825 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D25C96B0078; Thu, 12 Nov 2020 11:10:14 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id CD51D6B007D; Thu, 12 Nov 2020 11:10:14 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B9D426B007E; Thu, 12 Nov 2020 11:10:14 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0002.hostedemail.com [216.40.44.2]) by kanga.kvack.org (Postfix) with ESMTP id 8C5D36B0078 for ; Thu, 12 Nov 2020 11:10:14 -0500 (EST) Received: from smtpin17.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 15C9E8249980 for ; Thu, 12 Nov 2020 16:10:14 +0000 (UTC) X-FDA: 77476253148.17.sleet36_500d9e327307 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin17.hostedemail.com (Postfix) with ESMTP id E79E8180D0181 for ; Thu, 12 Nov 2020 16:10:13 +0000 (UTC) X-HE-Tag: sleet36_500d9e327307 X-Filterd-Recvd-Size: 11523 Received: from mail-qk1-f194.google.com (mail-qk1-f194.google.com [209.85.222.194]) by imf50.hostedemail.com (Postfix) with ESMTP for ; Thu, 12 Nov 2020 16:10:13 +0000 (UTC) Received: by mail-qk1-f194.google.com with SMTP id 11so5726001qkd.5 for ; Thu, 12 Nov 2020 08:10:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc:content-transfer-encoding; bh=+3ppqmizYm8DpeBPL8i/N6SBpHLSBfkZuqB8tufUogw=; b=K9N+LydTs0kBOblpwDKh9mZ1qGhKQtnb7uvKuT6MmVyp+HQ1bKNNPHVFkpWmwxbg97 XQ5Xv+8EQXl+W6nT3yrm+yZHkeuEFsj0le62/9dUItHsJm0pUaCcrJsBA2OKnz589IJU nvRM5poEdyHkpIMwvAyJ8RG7c3dMBGaCY1Y6QqZxMTq9SHDD4ul3HmJith96U2avjcdn /eEESFGMYakyBDXWEdVQ9hTN4sBvLDLE/XcGxkwKNYLWYj1wu1GEmDd226v7YqOAl6Kx D3eh8toITDf6jiQfZgajYp7NhWcwwBIu5G6E14l1caYq8xjAcoEeDDjxdL8XsNpPQuc3 jt5A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc:content-transfer-encoding; bh=+3ppqmizYm8DpeBPL8i/N6SBpHLSBfkZuqB8tufUogw=; b=NmzLVE3Bpa9Fs53lHTJeUlvqDL/wJ+oCkrkKdmW5SS6ovBoSeShXapS0MWaoA+8yd8 oe0JH0Hg1ls5z9c7xhk/yiysqBusxvUf/LojDKiOwSCi6f21gXGmoAGrpzx4ABcih0/7 F+tIOSvkDsDan7rVyVuPU8qArXGqmKhXb98KKE/Ouopymh/BawKAQI3UWw8LXukctYBx agGtHbz0o2GaRpSAJ6VM6mXol4MpQ2ekGGwduT2d5cLxKNI3l1Zr3Sd8C3vvqpL6gZI4 o+eAuKK8Equ4VqHJ6vPijQkrE72tICdggeijOlRueNr3oBiS8rgZtRDubIZV0uR9w1eo /ozA== X-Gm-Message-State: AOAM530N6PJslraNypF0lOl6lRDBZ4T02AWBvCzKQOVBa2PcHA2ZNzph HnpiH295UWDysoVtHNaOupNmfWm5QKjoHPnEashcKA== X-Google-Smtp-Source: ABdhPJyNngKXEw8Eg5rU2fPzQTn4/pPGWxfQYeQ8gc7roGY7nCwBwDcgO8PnYOzeXDAgfb5tJj0WLVVVHu0HqmCQixI= X-Received: by 2002:a37:bf04:: with SMTP id p4mr506714qkf.326.1605197412318; Thu, 12 Nov 2020 08:10:12 -0800 (PST) MIME-Version: 1.0 References: In-Reply-To: From: Alexander Potapenko Date: Thu, 12 Nov 2020 17:10:00 +0100 Message-ID: Subject: Re: [PATCH v9 41/44] kasan, mm: reset tags when accessing metadata To: Andrey Konovalov Cc: Catalin Marinas , Will Deacon , Vincenzo Frascino , Dmitry Vyukov , Andrey Ryabinin , Marco Elver , Evgenii Stepanov , Branislav Rankov , Kevin Brodsky , Andrew Morton , kasan-dev , Linux ARM , Linux Memory Management List , LKML Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Nov 10, 2020 at 11:12 PM Andrey Konovalov w= rote: > > Kernel allocator code accesses metadata for slab objects, that may lie > out-of-bounds of the object itself, or be accessed when an object is free= d. > Such accesses trigger tag faults and lead to false-positive reports with > hardware tag-based KASAN. > > Software KASAN modes disable instrumentation for allocator code via > KASAN_SANITIZE Makefile macro, and rely on kasan_enable/disable_current() > annotations which are used to ignore KASAN reports. > > With hardware tag-based KASAN neither of those options are available, as > it doesn't use compiler instrumetation, no tag faults are ignored, and MT= E > is disabled after the first one. > > Instead, reset tags when accessing metadata (currently only for SLUB). > > Signed-off-by: Andrey Konovalov > Signed-off-by: Vincenzo Frascino > Acked-by: Marco Elver Reviewed-by: Alexander Potapenko > --- > Change-Id: I39f3c4d4f29299d4fbbda039bedf230db1c746fb > --- > mm/page_alloc.c | 4 +++- > mm/page_poison.c | 2 +- > mm/slub.c | 29 ++++++++++++++++------------- > 3 files changed, 20 insertions(+), 15 deletions(-) > > diff --git a/mm/page_alloc.c b/mm/page_alloc.c > index 24b45261e2bd..f1648aee8d88 100644 > --- a/mm/page_alloc.c > +++ b/mm/page_alloc.c > @@ -1195,8 +1195,10 @@ static void kernel_init_free_pages(struct page *pa= ge, int numpages) > > /* s390's use of memset() could override KASAN redzones. */ > kasan_disable_current(); > - for (i =3D 0; i < numpages; i++) > + for (i =3D 0; i < numpages; i++) { > + page_kasan_tag_reset(page + i); > clear_highpage(page + i); > + } > kasan_enable_current(); > } > > diff --git a/mm/page_poison.c b/mm/page_poison.c > index ae0482cded87..e6c994af7518 100644 > --- a/mm/page_poison.c > +++ b/mm/page_poison.c > @@ -53,7 +53,7 @@ static void poison_page(struct page *page) > > /* KASAN still think the page is in-use, so skip it. */ > kasan_disable_current(); > - memset(addr, PAGE_POISON, PAGE_SIZE); > + memset(kasan_reset_tag(addr), PAGE_POISON, PAGE_SIZE); > kasan_enable_current(); > kunmap_atomic(addr); > } > diff --git a/mm/slub.c b/mm/slub.c > index b30be2385d1c..df2fd5b57df1 100644 > --- a/mm/slub.c > +++ b/mm/slub.c > @@ -249,7 +249,7 @@ static inline void *freelist_ptr(const struct kmem_ca= che *s, void *ptr, > { > #ifdef CONFIG_SLAB_FREELIST_HARDENED > /* > - * When CONFIG_KASAN_SW_TAGS is enabled, ptr_addr might be tagged= . > + * When CONFIG_KASAN_SW/HW_TAGS is enabled, ptr_addr might be tag= ged. > * Normally, this doesn't cause any issues, as both set_freepoint= er() > * and get_freepointer() are called with a pointer with the same = tag. > * However, there are some issues with CONFIG_SLUB_DEBUG code. Fo= r > @@ -275,6 +275,7 @@ static inline void *freelist_dereference(const struct= kmem_cache *s, > > static inline void *get_freepointer(struct kmem_cache *s, void *object) > { > + object =3D kasan_reset_tag(object); > return freelist_dereference(s, object + s->offset); > } > > @@ -304,6 +305,7 @@ static inline void set_freepointer(struct kmem_cache = *s, void *object, void *fp) > BUG_ON(object =3D=3D fp); /* naive detection of double free or co= rruption */ > #endif > > + freeptr_addr =3D (unsigned long)kasan_reset_tag((void *)freeptr_a= ddr); > *(void **)freeptr_addr =3D freelist_ptr(s, fp, freeptr_addr); > } > > @@ -538,8 +540,8 @@ static void print_section(char *level, char *text, u8= *addr, > unsigned int length) > { > metadata_access_enable(); > - print_hex_dump(level, text, DUMP_PREFIX_ADDRESS, 16, 1, addr, > - length, 1); > + print_hex_dump(level, kasan_reset_tag(text), DUMP_PREFIX_ADDRESS, > + 16, 1, addr, length, 1); > metadata_access_disable(); > } > > @@ -570,7 +572,7 @@ static struct track *get_track(struct kmem_cache *s, = void *object, > > p =3D object + get_info_end(s); > > - return p + alloc; > + return kasan_reset_tag(p + alloc); > } > > static void set_track(struct kmem_cache *s, void *object, > @@ -583,7 +585,8 @@ static void set_track(struct kmem_cache *s, void *obj= ect, > unsigned int nr_entries; > > metadata_access_enable(); > - nr_entries =3D stack_trace_save(p->addrs, TRACK_ADDRS_COU= NT, 3); > + nr_entries =3D stack_trace_save(kasan_reset_tag(p->addrs)= , > + TRACK_ADDRS_COUNT, 3); > metadata_access_disable(); > > if (nr_entries < TRACK_ADDRS_COUNT) > @@ -747,7 +750,7 @@ static __printf(3, 4) void slab_err(struct kmem_cache= *s, struct page *page, > > static void init_object(struct kmem_cache *s, void *object, u8 val) > { > - u8 *p =3D object; > + u8 *p =3D kasan_reset_tag(object); > > if (s->flags & SLAB_RED_ZONE) > memset(p - s->red_left_pad, val, s->red_left_pad); > @@ -777,7 +780,7 @@ static int check_bytes_and_report(struct kmem_cache *= s, struct page *page, > u8 *addr =3D page_address(page); > > metadata_access_enable(); > - fault =3D memchr_inv(start, value, bytes); > + fault =3D memchr_inv(kasan_reset_tag(start), value, bytes); > metadata_access_disable(); > if (!fault) > return 1; > @@ -873,7 +876,7 @@ static int slab_pad_check(struct kmem_cache *s, struc= t page *page) > > pad =3D end - remainder; > metadata_access_enable(); > - fault =3D memchr_inv(pad, POISON_INUSE, remainder); > + fault =3D memchr_inv(kasan_reset_tag(pad), POISON_INUSE, remainde= r); > metadata_access_disable(); > if (!fault) > return 1; > @@ -1118,7 +1121,7 @@ void setup_page_debug(struct kmem_cache *s, struct = page *page, void *addr) > return; > > metadata_access_enable(); > - memset(addr, POISON_INUSE, page_size(page)); > + memset(kasan_reset_tag(addr), POISON_INUSE, page_size(page)); > metadata_access_disable(); > } > > @@ -1566,10 +1569,10 @@ static inline bool slab_free_freelist_hook(struct= kmem_cache *s, > * Clear the object and the metadata, but don't t= ouch > * the redzone. > */ > - memset(object, 0, s->object_size); > + memset(kasan_reset_tag(object), 0, s->object_size= ); > rsize =3D (s->flags & SLAB_RED_ZONE) ? s->red_lef= t_pad > : 0; > - memset((char *)object + s->inuse, 0, > + memset((char *)kasan_reset_tag(object) + s->inuse= , 0, > s->size - s->inuse - rsize); > > } > @@ -2883,10 +2886,10 @@ static __always_inline void *slab_alloc_node(stru= ct kmem_cache *s, > stat(s, ALLOC_FASTPATH); > } > > - maybe_wipe_obj_freeptr(s, object); > + maybe_wipe_obj_freeptr(s, kasan_reset_tag(object)); > > if (unlikely(slab_want_init_on_alloc(gfpflags, s)) && object) > - memset(object, 0, s->object_size); > + memset(kasan_reset_tag(object), 0, s->object_size); > > slab_post_alloc_hook(s, objcg, gfpflags, 1, &object); > > -- > 2.29.2.222.g5d2a92d10f8-goog > --=20 Alexander Potapenko Software Engineer Google Germany GmbH Erika-Mann-Stra=C3=9Fe, 33 80636 M=C3=BCnchen Gesch=C3=A4ftsf=C3=BChrer: Paul Manicle, Halimah DeLaine Prado Registergericht und -nummer: Hamburg, HRB 86891 Sitz der Gesellschaft: Hamburg