From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.4 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E13CC4363A for ; Fri, 30 Oct 2020 13:00:28 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 57E01206FA for ; Fri, 30 Oct 2020 13:00:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="EcnjjxiP" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 57E01206FA Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 38B3C6B005C; Fri, 30 Oct 2020 09:00:26 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 33B796B005D; Fri, 30 Oct 2020 09:00:26 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 229716B0062; Fri, 30 Oct 2020 09:00:26 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0155.hostedemail.com [216.40.44.155]) by kanga.kvack.org (Postfix) with ESMTP id E51156B005C for ; Fri, 30 Oct 2020 09:00:25 -0400 (EDT) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 70703180AD817 for ; Fri, 30 Oct 2020 13:00:25 +0000 (UTC) X-FDA: 77428600410.28.pie97_29151dd27296 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin28.hostedemail.com (Postfix) with ESMTP id A6E586D7D for ; Fri, 30 Oct 2020 13:00:23 +0000 (UTC) X-HE-Tag: pie97_29151dd27296 X-Filterd-Recvd-Size: 7108 Received: from mail-ot1-f67.google.com (mail-ot1-f67.google.com [209.85.210.67]) by imf34.hostedemail.com (Postfix) with ESMTP for ; Fri, 30 Oct 2020 13:00:22 +0000 (UTC) Received: by mail-ot1-f67.google.com with SMTP id i18so732755ots.0 for ; Fri, 30 Oct 2020 06:00:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=6fvLoA2ACGsw9h6fUs2eRqYp5Vxv5mvJOqpZ7bS2dDQ=; b=EcnjjxiP6NX5FOHbnvNYmhlYHqWJtONYAPuq8+BRYNiuIp2YO2/sOS9Osbx/2Z8fds cavi4AMu92psgd64iFC5tpy/7TL45oFgxjicTtltEsKFVUt6JXV7p81kQyb3ejUqk/EZ BlY3uE1nOqTBTw7LncwS2dhHg3Wxa2kxCH5MYvtBdvp2960pONdBmb/43b2Jd5fu6jCL PI2m8wzHjpVcycrn2PKUUwJ4Jv4DGkEDw+gaz8pqzhGls/nj8/37bYUnvxGLUdJWy4Hl PEqSbyNGilparldS8VWKLveX96xtr9BDYwGalBxqK2owNxr2aqbxS0yZ5FG4yrq3UV7S AaoQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=6fvLoA2ACGsw9h6fUs2eRqYp5Vxv5mvJOqpZ7bS2dDQ=; b=KfKB/qQLyvb2DxC0PjmFGh0dpvD9ySKINQ4PbxLbeHVWzeO/9d2NcNSfskPTvdSTIB 7Z2FcGkH7OH1IFgKzGxoW22LlY/jzAL1HzfBXsGASwQgb7mhKJgK+trrNmbiZUPFDpLc WhaCgRqIasEUuwlDvLo2FgKyQzbOq7nQZSOaJlbSOi+WERem/1Gb7ufELeZ0v1IvULdT /YgtV2SgdUMD4qCdLgB65gz7KgGDSHeqjRo9xVUcu7+Rub6JQLEl64x4MEFJxKEHLayd LQLZZvv20WmmAWT171PtgCLsQxqCbS9meJgTrFWtwGMhfFiTzF00LKUmJ6+zretyidQ6 KETg== X-Gm-Message-State: AOAM532ytVLGArSeQnhbslw+ADBPvcQJfn2bx6oAPrspAPTXcsenK0ok r10D1OXG3Z8E+lhqOfQRGOJg7siipBSjJKj3SiplJQ== X-Google-Smtp-Source: ABdhPJxj4Rs5DNTy+vw/V05OM5YDz/tZETESyDNcoLpIRJD7NMZYysv3LfHiHlF2FEKmKL84lRszy3dIgD1ASah43lM= X-Received: by 2002:a9d:34d:: with SMTP id 71mr1421371otv.251.1604062821578; Fri, 30 Oct 2020 06:00:21 -0700 (PDT) MIME-Version: 1.0 References: <20201029131649.182037-1-elver@google.com> <20201029131649.182037-3-elver@google.com> In-Reply-To: From: Marco Elver Date: Fri, 30 Oct 2020 14:00:09 +0100 Message-ID: Subject: Re: [PATCH v6 2/9] x86, kfence: enable KFENCE for x86 To: Jann Horn Cc: Andrew Morton , Alexander Potapenko , "H . Peter Anvin" , "Paul E . McKenney" , Andrey Konovalov , Andrey Ryabinin , Andy Lutomirski , Borislav Petkov , Catalin Marinas , Christoph Lameter , Dave Hansen , David Rientjes , Dmitry Vyukov , Eric Dumazet , Greg Kroah-Hartman , Hillf Danton , Ingo Molnar , Jonathan Cameron , Jonathan Corbet , Joonsoo Kim , =?UTF-8?Q?J=C3=B6rn_Engel?= , Kees Cook , Mark Rutland , Pekka Enberg , Peter Zijlstra , SeongJae Park , Thomas Gleixner , Vlastimil Babka , Will Deacon , "the arch/x86 maintainers" , "open list:DOCUMENTATION" , kernel list , kasan-dev , Linux ARM , Linux-MM Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, 30 Oct 2020 at 03:49, Jann Horn wrote: > On Thu, Oct 29, 2020 at 2:17 PM Marco Elver wrote: > > Add architecture specific implementation details for KFENCE and enable > > KFENCE for the x86 architecture. In particular, this implements the > > required interface in for setting up the pool and > > providing helper functions for protecting and unprotecting pages. > > > > For x86, we need to ensure that the pool uses 4K pages, which is done > > using the set_memory_4k() helper function. > > > > Reviewed-by: Dmitry Vyukov > > Co-developed-by: Marco Elver > > Signed-off-by: Marco Elver > > Signed-off-by: Alexander Potapenko > [...] > > diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c > [...] > > @@ -725,6 +726,9 @@ no_context(struct pt_regs *regs, unsigned long error_code, > > if (IS_ENABLED(CONFIG_EFI)) > > efi_recover_from_page_fault(address); > > > > + if (kfence_handle_page_fault(address)) > > + return; > > We can also get to this point due to an attempt to execute a data > page. That's very unlikely (given that the same thing would also crash > if you tried to do it with normal heap memory, and KFENCE allocations > are extremely rare); but we might want to try to avoid handling such > faults as KFENCE faults, since KFENCE will assume that it has resolved > the fault and retry execution of the faulting instruction. Once kernel > protection keys are introduced, those might cause the same kind of > trouble. > > So we might want to gate this on a check like "if ((error_code & > X86_PF_PROT) == 0)" (meaning "only handle the fault if the fault was > caused by no page being present", see enum x86_pf_error_code). Good point. Will fix in v7. > Unrelated sidenote: Since we're hooking after exception fixup > handling, the debug-only KFENCE_STRESS_TEST_FAULTS can probably still > cause some behavioral differences through spurious faults in places > like copy_user_enhanced_fast_string (where the exception table entries > are used even if the *kernel* pointer, not the user pointer, causes a > fault). But since KFENCE_STRESS_TEST_FAULTS is exclusively for KFENCE > development, the difference might not matter. And ordering them the > other way around definitely isn't possible, because the kernel relies > on being able to fixup OOB reads. So there probably isn't really > anything we can do better here; it's just something to keep in mind. > Maybe you can add a little warning to the help text for that Kconfig > entry that warns people about this? Thanks for pointing it out, but that option really is *only* to stress kfence with concurrent allocations/frees/page faults. If anybody enables this option for anything other than testing kfence, it's their own fault. ;-) I'll try to add a generic note to the Kconfig entry, but what you mention here seems quite x86-specific. Thanks, -- Marco