From: Peter Collingbourne <pcc@google.com> To: catalin.marinas@arm.com, andreyknvl@gmail.com Cc: "Peter Collingbourne" <pcc@google.com>, "Qun-wei Lin (林群崴)" <Qun-wei.Lin@mediatek.com>, "Guangye Yang (杨光业)" <guangye.yang@mediatek.com>, linux-mm@kvack.org, "Chinwen Chang (張錦文)" <chinwen.chang@mediatek.com>, kasan-dev@googlegroups.com, ryabinin.a.a@gmail.com, linux-arm-kernel@lists.infradead.org, vincenzo.frascino@arm.com, will@kernel.org, eugenis@google.com, "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee@mediatek.com>, stable@vger.kernel.org Subject: [PATCH v2] arm64: Reset KASAN tag in copy_highpage with HW tags only Date: Tue, 14 Feb 2023 21:09:11 -0800 [thread overview] Message-ID: <20230215050911.1433132-1-pcc@google.com> (raw) During page migration, the copy_highpage function is used to copy the page data to the target page. If the source page is a userspace page with MTE tags, the KASAN tag of the target page must have the match-all tag in order to avoid tag check faults during subsequent accesses to the page by the kernel. However, the target page may have been allocated in a number of ways, some of which will use the KASAN allocator and will therefore end up setting the KASAN tag to a non-match-all tag. Therefore, update the target page's KASAN tag to match the source page. We ended up unintentionally fixing this issue as a result of a bad merge conflict resolution between commit e059853d14ca ("arm64: mte: Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags""), which preserved a tag reset for PG_mte_tagged pages which was considered to be unnecessary at the time. Because SW tags KASAN uses separate tag storage, update the code to only reset the tags when HW tags KASAN is enabled. Signed-off-by: Peter Collingbourne <pcc@google.com> Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830f52e0c Reported-by: "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee@mediatek.com> Cc: <stable@vger.kernel.org> # 6.1 Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"") --- v2: - added Fixes tag For the stable branch, e059853d14ca needs to be cherry-picked and the following merge conflict resolution is needed: - page_kasan_tag_reset(to); + if (kasan_hw_tags_enabled()) + page_kasan_tag_reset(to); - /* It's a new page, shouldn't have been tagged yet */ - WARN_ON_ONCE(!try_page_mte_tagging(to)); arch/arm64/mm/copypage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c index 8dd5a8fe64b4..4aadcfb01754 100644 --- a/arch/arm64/mm/copypage.c +++ b/arch/arm64/mm/copypage.c @@ -22,7 +22,8 @@ void copy_highpage(struct page *to, struct page *from) copy_page(kto, kfrom); if (system_supports_mte() && page_mte_tagged(from)) { - page_kasan_tag_reset(to); + if (kasan_hw_tags_enabled()) + page_kasan_tag_reset(to); /* It's a new page, shouldn't have been tagged yet */ WARN_ON_ONCE(!try_page_mte_tagging(to)); mte_copy_page_tags(kto, kfrom); -- 2.39.1.581.gbfd45094c4-goog
WARNING: multiple messages have this Message-ID (diff)
From: Peter Collingbourne <pcc@google.com> To: catalin.marinas@arm.com, andreyknvl@gmail.com Cc: "Peter Collingbourne" <pcc@google.com>, "Qun-wei Lin (林群崴)" <Qun-wei.Lin@mediatek.com>, "Guangye Yang (杨光业)" <guangye.yang@mediatek.com>, linux-mm@kvack.org, "Chinwen Chang (張錦文)" <chinwen.chang@mediatek.com>, kasan-dev@googlegroups.com, ryabinin.a.a@gmail.com, linux-arm-kernel@lists.infradead.org, vincenzo.frascino@arm.com, will@kernel.org, eugenis@google.com, "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee@mediatek.com>, stable@vger.kernel.org Subject: [PATCH v2] arm64: Reset KASAN tag in copy_highpage with HW tags only Date: Tue, 14 Feb 2023 21:09:11 -0800 [thread overview] Message-ID: <20230215050911.1433132-1-pcc@google.com> (raw) During page migration, the copy_highpage function is used to copy the page data to the target page. If the source page is a userspace page with MTE tags, the KASAN tag of the target page must have the match-all tag in order to avoid tag check faults during subsequent accesses to the page by the kernel. However, the target page may have been allocated in a number of ways, some of which will use the KASAN allocator and will therefore end up setting the KASAN tag to a non-match-all tag. Therefore, update the target page's KASAN tag to match the source page. We ended up unintentionally fixing this issue as a result of a bad merge conflict resolution between commit e059853d14ca ("arm64: mte: Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags""), which preserved a tag reset for PG_mte_tagged pages which was considered to be unnecessary at the time. Because SW tags KASAN uses separate tag storage, update the code to only reset the tags when HW tags KASAN is enabled. Signed-off-by: Peter Collingbourne <pcc@google.com> Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830f52e0c Reported-by: "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee@mediatek.com> Cc: <stable@vger.kernel.org> # 6.1 Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"") --- v2: - added Fixes tag For the stable branch, e059853d14ca needs to be cherry-picked and the following merge conflict resolution is needed: - page_kasan_tag_reset(to); + if (kasan_hw_tags_enabled()) + page_kasan_tag_reset(to); - /* It's a new page, shouldn't have been tagged yet */ - WARN_ON_ONCE(!try_page_mte_tagging(to)); arch/arm64/mm/copypage.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c index 8dd5a8fe64b4..4aadcfb01754 100644 --- a/arch/arm64/mm/copypage.c +++ b/arch/arm64/mm/copypage.c @@ -22,7 +22,8 @@ void copy_highpage(struct page *to, struct page *from) copy_page(kto, kfrom); if (system_supports_mte() && page_mte_tagged(from)) { - page_kasan_tag_reset(to); + if (kasan_hw_tags_enabled()) + page_kasan_tag_reset(to); /* It's a new page, shouldn't have been tagged yet */ WARN_ON_ONCE(!try_page_mte_tagging(to)); mte_copy_page_tags(kto, kfrom); -- 2.39.1.581.gbfd45094c4-goog _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2023-02-15 5:09 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-02-15 5:09 Peter Collingbourne [this message] 2023-02-15 5:09 ` [PATCH v2] arm64: Reset KASAN tag in copy_highpage with HW tags only Peter Collingbourne 2023-02-17 10:05 ` Andrey Konovalov 2023-02-17 10:05 ` Andrey Konovalov 2023-02-22 16:46 ` Catalin Marinas 2023-02-22 16:46 ` Catalin Marinas
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20230215050911.1433132-1-pcc@google.com \ --to=pcc@google.com \ --cc=Kuan-Ying.Lee@mediatek.com \ --cc=Qun-wei.Lin@mediatek.com \ --cc=andreyknvl@gmail.com \ --cc=catalin.marinas@arm.com \ --cc=chinwen.chang@mediatek.com \ --cc=eugenis@google.com \ --cc=guangye.yang@mediatek.com \ --cc=kasan-dev@googlegroups.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-mm@kvack.org \ --cc=ryabinin.a.a@gmail.com \ --cc=stable@vger.kernel.org \ --cc=vincenzo.frascino@arm.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.