From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.5 required=3.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED,DKIM_INVALID,DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 47D36C433E2 for ; Tue, 15 Sep 2020 22:00:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id D2B562064B for ; Tue, 15 Sep 2020 22:00:08 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=google.com header.i=@google.com header.b="eGUywzkx" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728066AbgIOWAF (ORCPT ); Tue, 15 Sep 2020 18:00:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728092AbgIOV3Y (ORCPT ); Tue, 15 Sep 2020 17:29:24 -0400 Received: from mail-qk1-x749.google.com (mail-qk1-x749.google.com [IPv6:2607:f8b0:4864:20::749]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2B81DC0611BC for ; Tue, 15 Sep 2020 14:17:44 -0700 (PDT) Received: by mail-qk1-x749.google.com with SMTP id u23so4067982qku.17 for ; Tue, 15 Sep 2020 14:17:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=sender:date:in-reply-to:message-id:mime-version:references:subject :from:to:cc; bh=GS63ueuB4la1O7X0K9617yAQx4ln+SDXx/Ooc+f8eKM=; b=eGUywzkx6pQSB6MB14SdSSZHwENYdnE2dovxVA2CNCAaJIPmrGwaMepZ/GkSHH8mbZ FjuVEYhgJF5gPBD2NyWvpmhsF/UdK93iIQjKmXKhAp4LB1vTgNoMglvZQDAVBolO3WaB BkcMTkab/KVnLbb0Ym6OvxIk/gzF4M0Vg0C7dTTlJDYywSeGoo/lzRDupg2db6yq8MnE 7/J2VtEOl1etcOONWSj6no5s9WCAL4uvx2rflJqbtgfm1W5apOZPs+E75mEg0gc23ue2 03vNlqM1du3fvGyyZHUVoOQBFuJy/pCoNRd1ftRtyM5HI3HMUTlAOhX3qjEX7oYjqhZO 5mkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:sender:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=GS63ueuB4la1O7X0K9617yAQx4ln+SDXx/Ooc+f8eKM=; b=S2Jp1NjvE85S2RBGyf/3/JF18Os6vVSVFUNHlabfjRA8lsm7CtBR0VtWwkTGOW6OGR ljKEzJCq0jETOh6+SDCednZjlJ9mRmgMuZ/hd2grC8lJl5IBaYmVhiZtoT0xrr0A6lfz tlfSE+Qv8h5mLMhSVYfLwjOgvTFG51uTXZ6NaMRGsFQ6/LJh5fvva9zDD4pSjXNQRvSE BM+0/2q9KosH9/FIijBcZ0MG/JiNT+l1MpoDHEJmEgCAmFxHdB2tMFsGMz1byomd/PjE VWt7n25RMhwj/Q5ArVIzdfe0PEP4s+S78DT83sxTFclSA2Dvf93Cmy8zgxhClnDIgzz2 0tKw== X-Gm-Message-State: AOAM531qHq/j1wwlIaKEI8xxTXuy5KrCt/dw4H+8zie3zmYjw7LrDy7U t6R07pp430IqYWwYFVz/f0xzQsfn3Cpb+Y65 X-Google-Smtp-Source: ABdhPJwjAVnhesWjxwBJtc9dtwgII6LSMyBmQtEiC1DsYXdw5HZxd+M1R+meLCNr2dgUBGKj+8j44Sq1rftM9PRY X-Received: from andreyknvl3.muc.corp.google.com ([2a00:79e0:15:13:7220:84ff:fe09:7e9d]) (user=andreyknvl job=sendgmr) by 2002:a0c:9d04:: with SMTP id m4mr3781463qvf.50.1600204663244; Tue, 15 Sep 2020 14:17:43 -0700 (PDT) Date: Tue, 15 Sep 2020 23:16:15 +0200 In-Reply-To: Message-Id: <74133d1a57c47cb8fec791dd5d1e6417b0579fc3.1600204505.git.andreyknvl@google.com> Mime-Version: 1.0 References: X-Mailer: git-send-email 2.28.0.618.gf4bc123cb7-goog Subject: [PATCH v2 33/37] kasan, arm64: implement HW_TAGS runtime From: Andrey Konovalov To: Dmitry Vyukov , Vincenzo Frascino , Catalin Marinas , kasan-dev@googlegroups.com Cc: Andrey Ryabinin , Alexander Potapenko , Marco Elver , Evgenii Stepanov , Elena Petrova , Branislav Rankov , Kevin Brodsky , Will Deacon , Andrew Morton , linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrey Konovalov Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Provide implementation of KASAN functions required for the hardware tag-based mode. Those include core functions for memory and pointer tagging (tags_hw.c) and bug reporting (report_tags_hw.c). Also adapt common KASAN code to support the new mode. Signed-off-by: Andrey Konovalov Signed-off-by: Vincenzo Frascino --- Change-Id: I8a8689ba098174a4d0ef3f1d008178387c80ee1c --- arch/arm64/include/asm/memory.h | 4 +- arch/arm64/kernel/setup.c | 1 - include/linux/kasan.h | 6 +-- include/linux/mm.h | 2 +- include/linux/page-flags-layout.h | 2 +- mm/kasan/Makefile | 5 ++ mm/kasan/common.c | 14 +++--- mm/kasan/kasan.h | 17 +++++-- mm/kasan/report_tags_hw.c | 47 +++++++++++++++++++ mm/kasan/report_tags_sw.c | 2 +- mm/kasan/shadow.c | 2 +- mm/kasan/tags_hw.c | 78 +++++++++++++++++++++++++++++++ mm/kasan/tags_sw.c | 2 +- 13 files changed, 162 insertions(+), 20 deletions(-) create mode 100644 mm/kasan/report_tags_hw.c create mode 100644 mm/kasan/tags_hw.c diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h index de9af7bea90d..b5d6b824c21c 100644 --- a/arch/arm64/include/asm/memory.h +++ b/arch/arm64/include/asm/memory.h @@ -215,7 +215,7 @@ static inline unsigned long kaslr_offset(void) (__force __typeof__(addr))__addr; \ }) -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) #define __tag_shifted(tag) ((u64)(tag) << 56) #define __tag_reset(addr) __untagged_addr(addr) #define __tag_get(addr) (__u8)((u64)(addr) >> 56) @@ -223,7 +223,7 @@ static inline unsigned long kaslr_offset(void) #define __tag_shifted(tag) 0UL #define __tag_reset(addr) (addr) #define __tag_get(addr) 0 -#endif /* CONFIG_KASAN_SW_TAGS */ +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */ static inline const void *__tag_set(const void *addr, u8 tag) { diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index 77c4c9bad1b8..5985be8af2c6 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -358,7 +358,6 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) smp_init_cpus(); smp_build_mpidr_hash(); - /* Init percpu seeds for random tags after cpus are set up. */ kasan_init_tags(); #ifdef CONFIG_ARM64_SW_TTBR0_PAN diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 875bbcedd994..613c9d38eee5 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -184,7 +184,7 @@ static inline void kasan_record_aux_stack(void *ptr) {} #endif /* CONFIG_KASAN_GENERIC */ -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) void kasan_init_tags(void); @@ -193,7 +193,7 @@ void *kasan_reset_tag(const void *addr); bool kasan_report(unsigned long addr, size_t size, bool is_write, unsigned long ip); -#else /* CONFIG_KASAN_SW_TAGS */ +#else /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS */ static inline void kasan_init_tags(void) { } @@ -202,7 +202,7 @@ static inline void *kasan_reset_tag(const void *addr) return (void *)addr; } -#endif /* CONFIG_KASAN_SW_TAGS */ +#endif /* CONFIG_KASAN_SW_TAGS || CONFIG_KASAN_HW_TAGS*/ #ifdef CONFIG_KASAN_VMALLOC diff --git a/include/linux/mm.h b/include/linux/mm.h index 4312c6c808e9..a3cac68c737c 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -1411,7 +1411,7 @@ static inline bool cpupid_match_pid(struct task_struct *task, int cpupid) } #endif /* CONFIG_NUMA_BALANCING */ -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) static inline u8 page_kasan_tag(const struct page *page) { return (page->flags >> KASAN_TAG_PGSHIFT) & KASAN_TAG_MASK; diff --git a/include/linux/page-flags-layout.h b/include/linux/page-flags-layout.h index e200eef6a7fd..7d4ec26d8a3e 100644 --- a/include/linux/page-flags-layout.h +++ b/include/linux/page-flags-layout.h @@ -77,7 +77,7 @@ #define LAST_CPUPID_SHIFT 0 #endif -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) #define KASAN_TAG_WIDTH 8 #else #define KASAN_TAG_WIDTH 0 diff --git a/mm/kasan/Makefile b/mm/kasan/Makefile index 0789f9023884..f8cf9ba674a1 100644 --- a/mm/kasan/Makefile +++ b/mm/kasan/Makefile @@ -10,9 +10,11 @@ CFLAGS_REMOVE_init.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_quarantine.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report_generic.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_report_tags_hw.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_report_tags_sw.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_shadow.o = $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_tags_sw.o = $(CC_FLAGS_FTRACE) +CFLAGS_REMOVE_tags_hw.o = $(CC_FLAGS_FTRACE) # Function splitter causes unnecessary splits in __asan_load1/__asan_store1 # see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533 @@ -27,10 +29,13 @@ CFLAGS_init.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_quarantine.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report_generic.o := $(CC_FLAGS_KASAN_RUNTIME) +CFLAGS_report_tags_hw.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_report_tags_sw.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_shadow.o := $(CC_FLAGS_KASAN_RUNTIME) +CFLAGS_tags_hw.o := $(CC_FLAGS_KASAN_RUNTIME) CFLAGS_tags_sw.o := $(CC_FLAGS_KASAN_RUNTIME) obj-$(CONFIG_KASAN) := common.o report.o obj-$(CONFIG_KASAN_GENERIC) += init.o generic.o report_generic.o shadow.o quarantine.o obj-$(CONFIG_KASAN_SW_TAGS) += init.o report_tags_sw.o shadow.o tags_sw.o +obj-$(CONFIG_KASAN_HW_TAGS) += tags_hw.o report_tags_hw.o diff --git a/mm/kasan/common.c b/mm/kasan/common.c index 41c7f1105eaa..412a23d1546b 100644 --- a/mm/kasan/common.c +++ b/mm/kasan/common.c @@ -118,7 +118,7 @@ void kasan_free_pages(struct page *page, unsigned int order) */ static inline unsigned int optimal_redzone(unsigned int object_size) { - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) + if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) return 0; return @@ -183,14 +183,14 @@ size_t kasan_metadata_size(struct kmem_cache *cache) struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache, const void *object) { - return (void *)object + cache->kasan_info.alloc_meta_offset; + return (void *)reset_tag(object) + cache->kasan_info.alloc_meta_offset; } struct kasan_free_meta *get_free_info(struct kmem_cache *cache, const void *object) { BUILD_BUG_ON(sizeof(struct kasan_free_meta) > 32); - return (void *)object + cache->kasan_info.free_meta_offset; + return (void *)reset_tag(object) + cache->kasan_info.free_meta_offset; } void kasan_poison_slab(struct page *page) @@ -272,7 +272,8 @@ void * __must_check kasan_init_slab_obj(struct kmem_cache *cache, alloc_info = get_alloc_info(cache, object); __memset(alloc_info, 0, sizeof(*alloc_info)); - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || + IS_ENABLED(CONFIG_KASAN_HW_TAGS)) object = set_tag(object, assign_tag(cache, object, true, false)); @@ -342,10 +343,11 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object, redzone_end = round_up((unsigned long)object + cache->object_size, KASAN_GRANULE_SIZE); - if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) + if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) || + IS_ENABLED(CONFIG_KASAN_HW_TAGS)) tag = assign_tag(cache, object, false, keep_tag); - /* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */ + /* Tag is ignored in set_tag without CONFIG_KASAN_SW/HW_TAGS */ kasan_unpoison_memory(set_tag(object, tag), size); kasan_poison_memory((void *)redzone_start, redzone_end - redzone_start, KASAN_KMALLOC_REDZONE); diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h index ba63d8a62968..1e9eda217be7 100644 --- a/mm/kasan/kasan.h +++ b/mm/kasan/kasan.h @@ -152,6 +152,10 @@ struct kasan_alloc_meta *get_alloc_info(struct kmem_cache *cache, struct kasan_free_meta *get_free_info(struct kmem_cache *cache, const void *object); +void kasan_poison_memory(const void *address, size_t size, u8 value); + +#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS) + static inline const void *kasan_shadow_to_mem(const void *shadow_addr) { return (void *)(((unsigned long)shadow_addr - KASAN_SHADOW_OFFSET) @@ -163,8 +167,6 @@ static inline bool addr_has_metadata(const void *addr) return (addr >= kasan_shadow_to_mem((void *)KASAN_SHADOW_START)); } -void kasan_poison_memory(const void *address, size_t size, u8 value); - /** * check_memory_region - Check memory region, and report if invalid access. * @addr: the accessed address @@ -176,6 +178,15 @@ void kasan_poison_memory(const void *address, size_t size, u8 value); bool check_memory_region(unsigned long addr, size_t size, bool write, unsigned long ret_ip); +#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ + +static inline bool addr_has_metadata(const void *addr) +{ + return true; +} + +#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */ + bool check_invalid_free(void *addr); void *find_first_bad_addr(void *addr, size_t size); @@ -212,7 +223,7 @@ static inline void quarantine_reduce(void) { } static inline void quarantine_remove_cache(struct kmem_cache *cache) { } #endif -#ifdef CONFIG_KASAN_SW_TAGS +#if defined(CONFIG_KASAN_SW_TAGS) || defined(CONFIG_KASAN_HW_TAGS) void print_tags(u8 addr_tag, const void *addr); diff --git a/mm/kasan/report_tags_hw.c b/mm/kasan/report_tags_hw.c new file mode 100644 index 000000000000..c2f73c46279a --- /dev/null +++ b/mm/kasan/report_tags_hw.c @@ -0,0 +1,47 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * This file contains hardware tag-based KASAN specific error reporting code. + * + * Copyright (c) 2020 Google, Inc. + * Author: Andrey Konovalov + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#include +#include +#include +#include +#include +#include + +#include "kasan.h" + +const char *get_bug_type(struct kasan_access_info *info) +{ + return "invalid-access"; +} + +void *find_first_bad_addr(void *addr, size_t size) +{ + return reset_tag(addr); +} + +void metadata_fetch_row(char *buffer, void *row) +{ + int i; + + for (i = 0; i < META_BYTES_PER_ROW; i++) + buffer[i] = mte_get_mem_tag(row + i * KASAN_GRANULE_SIZE); +} + +void print_tags(u8 addr_tag, const void *addr) +{ + u8 memory_tag = mte_get_mem_tag((void *)addr); + + pr_err("Pointer tag: [%02x], memory tag: [%02x]\n", + addr_tag, memory_tag); +} diff --git a/mm/kasan/report_tags_sw.c b/mm/kasan/report_tags_sw.c index 4060d0503462..b2894902bc47 100644 --- a/mm/kasan/report_tags_sw.c +++ b/mm/kasan/report_tags_sw.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 /* - * This file contains tag-based KASAN specific error reporting code. + * This file contains software tag-based KASAN specific error reporting code. * * Copyright (c) 2014 Samsung Electronics Co., Ltd. * Author: Andrey Ryabinin diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c index 4888084ecdfc..ca69726adf8f 100644 --- a/mm/kasan/shadow.c +++ b/mm/kasan/shadow.c @@ -111,7 +111,7 @@ void kasan_unpoison_memory(const void *address, size_t size) if (IS_ENABLED(CONFIG_KASAN_SW_TAGS)) *shadow = tag; - else + else /* CONFIG_KASAN_GENERIC */ *shadow = size & KASAN_GRANULE_MASK; } } diff --git a/mm/kasan/tags_hw.c b/mm/kasan/tags_hw.c new file mode 100644 index 000000000000..c93d43379e39 --- /dev/null +++ b/mm/kasan/tags_hw.c @@ -0,0 +1,78 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * This file contains core hardware tag-based KASAN code. + * + * Copyright (c) 2020 Google, Inc. + * Author: Andrey Konovalov + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ + +#include +#include +#include +#include +#include +#include + +#include "kasan.h" + +void kasan_init_tags(void) +{ + init_tags(KASAN_TAG_MAX); +} + +void *kasan_reset_tag(const void *addr) +{ + return reset_tag(addr); +} + +void kasan_poison_memory(const void *address, size_t size, u8 value) +{ + set_mem_tag_range(reset_tag(address), + round_up(size, KASAN_GRANULE_SIZE), value); +} + +void kasan_unpoison_memory(const void *address, size_t size) +{ + set_mem_tag_range(reset_tag(address), + round_up(size, KASAN_GRANULE_SIZE), get_tag(address)); +} + +u8 random_tag(void) +{ + return get_random_tag(); +} + +bool check_invalid_free(void *addr) +{ + u8 ptr_tag = get_tag(addr); + u8 mem_tag = get_mem_tag(addr); + + if (mem_tag == KASAN_TAG_INVALID) + return true; + if (ptr_tag != KASAN_TAG_KERNEL && ptr_tag != mem_tag) + return true; + return false; +} + +void kasan_set_free_info(struct kmem_cache *cache, + void *object, u8 tag) +{ + struct kasan_alloc_meta *alloc_meta; + + alloc_meta = get_alloc_info(cache, object); + kasan_set_track(&alloc_meta->free_track[0], GFP_NOWAIT); +} + +struct kasan_track *kasan_get_free_track(struct kmem_cache *cache, + void *object, u8 tag) +{ + struct kasan_alloc_meta *alloc_meta; + + alloc_meta = get_alloc_info(cache, object); + return &alloc_meta->free_track[0]; +} diff --git a/mm/kasan/tags_sw.c b/mm/kasan/tags_sw.c index feb42c1763b8..3df978b8d1d9 100644 --- a/mm/kasan/tags_sw.c +++ b/mm/kasan/tags_sw.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0 /* - * This file contains core tag-based KASAN code. + * This file contains core software tag-based KASAN code. * * Copyright (c) 2018 Google, Inc. * Author: Andrey Konovalov -- 2.28.0.618.gf4bc123cb7-goog