From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.3 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,HTML_MESSAGE,INCLUDES_PATCH,MAILING_LIST_MULTI, NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C594C07E96 for ; Tue, 6 Jul 2021 04:07:55 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id ABC6461375 for ; Tue, 6 Jul 2021 04:07:54 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org ABC6461375 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=huawei.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 5627F6B0011; Tue, 6 Jul 2021 00:07:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 512A76B0036; Tue, 6 Jul 2021 00:07:54 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 38CA26B005D; Tue, 6 Jul 2021 00:07:54 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0021.hostedemail.com [216.40.44.21]) by kanga.kvack.org (Postfix) with ESMTP id 0CB706B0011 for ; Tue, 6 Jul 2021 00:07:54 -0400 (EDT) Received: from smtpin15.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 7AA87824999B for ; Tue, 6 Jul 2021 04:07:53 +0000 (UTC) X-FDA: 78330829626.15.BD0B7E9 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by imf03.hostedemail.com (Postfix) with ESMTP id 69C7330000B1 for ; Tue, 6 Jul 2021 04:07:51 +0000 (UTC) Received: from dggemv711-chm.china.huawei.com (unknown [172.30.72.54]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4GJpmD4fXzz1CFhF; Tue, 6 Jul 2021 12:02:20 +0800 (CST) Received: from dggpemm500001.china.huawei.com (7.185.36.107) by dggemv711-chm.china.huawei.com (10.1.198.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 6 Jul 2021 12:07:43 +0800 Received: from [10.174.177.243] (10.174.177.243) by dggpemm500001.china.huawei.com (7.185.36.107) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2176.2; Tue, 6 Jul 2021 12:07:42 +0800 Subject: Re: [PATCH -next 3/3] kasan: arm64: Fix pcpu_page_first_chunk crash with KASAN_VMALLOC To: Marco Elver CC: Catalin Marinas , Will Deacon , Andrey Ryabinin , Andrey Konovalov , Dmitry Vyukov , , , , , Daniel Axtens References: <20210705111453.164230-1-wangkefeng.wang@huawei.com> <20210705111453.164230-4-wangkefeng.wang@huawei.com> From: Kefeng Wang Message-ID: <089f5187-9a4d-72dc-1767-8130434bfb3a@huawei.com> Date: Tue, 6 Jul 2021 12:07:42 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.7.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/alternative; boundary="------------A272B108B4C815A0D985895D" Content-Language: en-US X-Originating-IP: [10.174.177.243] X-ClientProxiedBy: dggems704-chm.china.huawei.com (10.3.19.181) To dggpemm500001.china.huawei.com (7.185.36.107) X-CFilter-Loop: Reflected X-Rspamd-Server: rspam05 X-Rspamd-Queue-Id: 69C7330000B1 X-Stat-Signature: 63uqb54ewgk3bjqiqcoxeaae5g5qn7ik Authentication-Results: imf03.hostedemail.com; dkim=none; spf=pass (imf03.hostedemail.com: domain of wangkefeng.wang@huawei.com designates 45.249.212.255 as permitted sender) smtp.mailfrom=wangkefeng.wang@huawei.com; dmarc=pass (policy=none) header.from=huawei.com X-HE-Tag: 1625544471-467737 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: --------------A272B108B4C815A0D985895D Content-Type: text/plain; charset="utf-8"; format=flowed Content-Transfer-Encoding: quoted-printable Hi Marco and Dmitry, On 2021/7/5 23:04, Marco Elver wrote: > On Mon, Jul 05, 2021 at 07:14PM +0800, Kefeng Wang wrote: > [...] >> +#ifdef CONFIG_KASAN_VMALLOC >> +void __init __weak kasan_populate_early_vm_area_shadow(void *start, >> + unsigned long size) > This should probably not be __weak, otherwise you now have 2 __weak > functions. Indeed, forget it. > >> +{ >> + unsigned long shadow_start, shadow_end; >> + >> + if (!is_vmalloc_or_module_addr(start)) >> + return; >> + >> + shadow_start =3D (unsigned long)kasan_mem_to_shadow(start); >> + shadow_start =3D ALIGN_DOWN(shadow_start, PAGE_SIZE); >> + shadow_end =3D (unsigned long)kasan_mem_to_shadow(start + size); >> + shadow_end =3D ALIGN(shadow_end, PAGE_SIZE); >> + kasan_map_populate(shadow_start, shadow_end, >> + early_pfn_to_nid(virt_to_pfn(start))); >> +} >> +#endif > This function looks quite generic -- would any of this also apply to > other architectures? I see that ppc and sparc at least also define > CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK. I can't try ppc/sparc, but only ppc support KASAN_VMALLOC, I check the x86, it supports CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK, looks this issue is existing on x86 and ppc. > >> void __init kasan_init(void) >> { >> kasan_init_shadow(); >> diff --git a/include/linux/kasan.h b/include/linux/kasan.h >> index 5310e217bd74..79d3895b0240 100644 >> --- a/include/linux/kasan.h >> +++ b/include/linux/kasan.h >> @@ -49,6 +49,8 @@ extern p4d_t kasan_early_shadow_p4d[MAX_PTRS_PER_P4D= ]; >> int kasan_populate_early_shadow(const void *shadow_start, >> const void *shadow_end); >> =20 >> +void kasan_populate_early_vm_area_shadow(void *start, unsigned long s= ize); >> + >> static inline void *kasan_mem_to_shadow(const void *addr) >> { >> return (void *)((unsigned long)addr >> KASAN_SHADOW_SCALE_SHIFT) >> diff --git a/mm/kasan/init.c b/mm/kasan/init.c >> index cc64ed6858c6..d39577d088a1 100644 >> --- a/mm/kasan/init.c >> +++ b/mm/kasan/init.c >> @@ -279,6 +279,11 @@ int __ref kasan_populate_early_shadow(const void = *shadow_start, >> return 0; >> } >> =20 >> +void __init __weak kasan_populate_early_vm_area_shadow(void *start, >> + unsigned long size) >> +{ >> +} > I'm just wondering if this could be a generic function, perhaps with an > appropriate IS_ENABLED() check of a generic Kconfig option > (CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK ?) to short-circuit it, if it's > not only an arm64 problem. kasan_map_populate() is arm64 special function, and the x86 has kasan_sha= llow_populate_pgds(), ppc has kasan_init_shadow_page_tables(), so look those ARCHs should do th= e same way like ARM64, Here we can't use kasan_populate_early_shadow(), this functions will make= the early shadow maps everything to a single page of zeroes=EF=BC=88kasan_early_shadow_page), a= nd set it pte_wrprotect, see zero_pte_populate(), right? Also I try this, it crashs on ARM64 when change kasan_map_populate() to k= asan_populate_early_shadow(), Unable to handle kernel write to read-only memory at virtual address ffff= 700002938000 ... Call trace: __memset+0x16c/0x1c0 kasan_unpoison+0x34/0x6c kasan_unpoison_vmalloc+0x2c/0x3c __get_vm_area_node.constprop.0+0x13c/0x240 __vmalloc_node_range+0xf4/0x4f0 __vmalloc_node+0x80/0x9c init_IRQ+0xe8/0x130 start_kernel+0x188/0x360 __primary_switched+0xc0/0xc8 > > But I haven't looked much further, so would appeal to you to either > confirm or reject this idea. > > Thanks, > -- Marco > . > --------------A272B108B4C815A0D985895D Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Hi Marco and Dmitry,

On 2021/7/5 23:04, Marco Elver wrote:<= br> 
On Mon, Jul 05, 2021 at 07:1=
4PM +0800, Kefeng Wang wrote:
[...]

+#ifdef CONFIG_KASAN_VMALL=
OC
+void __init __weak kasan_populate_early_vm_area_shadow(void *start,
+						       unsigned long size)

This should probably not be __weak, otherwise you now have 2 __weak
functions.
Indeed, forget it.


+{
+	unsigned long shadow_start, shadow_end;
+
+	if (!is_vmalloc_or_module_addr(start))
+		return;
+
+	shadow_start =3D (unsigned long)kasan_mem_to_shadow(start);
+	shadow_start =3D ALIGN_DOWN(shadow_start, PAGE_SIZE);
+	shadow_end =3D (unsigned long)kasan_mem_to_shadow(start + size);
+	shadow_end =3D ALIGN(shadow_end, PAGE_SIZE);
+	kasan_map_populate(shadow_start, shadow_end,
+			   early_pfn_to_nid(virt_to_pfn(start)));
+}
+#endif

This function looks quite generic -- would any of this also apply to
other architectures? I see that ppc and sparc at least also define
CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK.

I can't try ppc/sparc, but only ppc support KASAN_VMALLOC,

I check the x86, it supports CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK,

looks this issue is existing on x86 and ppc.



 void __init kasan_init(vo=
id)
 {
 	kasan_init_shadow();
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 5310e217bd74..79d3895b0240 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -49,6 +49,8 @@ extern p4d_t kasan_early_shadow_p4d[MAX_PTRS_PER_P4D];
 int kasan_populate_early_shadow(const void *shadow_start,
 				const void *shadow_end);
=20
+void kasan_populate_early_vm_area_shadow(void *start, unsigned long size=
);
+
 static inline void *kasan_mem_to_shadow(const void *addr)
 {
 	return (void *)((unsigned long)addr >> KASAN_SHADOW_SCALE_SHIFT)
diff --git a/mm/kasan/init.c b/mm/kasan/init.c
index cc64ed6858c6..d39577d088a1 100644
--- a/mm/kasan/init.c
+++ b/mm/kasan/init.c
@@ -279,6 +279,11 @@ int __ref kasan_populate_early_shadow(const void *sh=
adow_start,
 	return 0;
 }
=20
+void __init __weak kasan_populate_early_vm_area_shadow(void *start,
+						       unsigned long size)
+{
+}

I'm just wondering if this could be a generic function, perhaps with an
appropriate IS_ENABLED() check of a generic Kconfig option
(CONFIG_NEED_PER_CPU_PAGE_FIRST_CHUNK ?) to short-circuit it, if it's
not only an arm64 problem.

kasan_map_populate() is arm64 =
special function, and the x86 has kasan_shallow_populate_pgds(),
ppc has kasan_init_shadow_page_tables(), so look those ARCHs should do th=
e same way like ARM64,

Here we can't use kasan_populate_early_shadow(), this functions will make=
 the early shadow maps
everything to a single page of zeroes=EF=BC=88kas=
an_early_shadow_page), and set it pte_wrprotect, see
zero_pte_populate(), right?=20

Also I try this, it crashs on ARM64 when change kasan_map_populate() to k=
asan_populate_early_shadow(),

Unable to handle kernel write to read-only memory at virtual address ffff=
700002938000
...
Call trace:
 __memset+0x16c/0x1c0
 kasan_unpoison+0x34/0x6c
 kasan_unpoison_vmalloc+0x2c/0x3c
 __get_vm_area_node.constprop.0+0x13c/0x240
 __vmalloc_node_range+0xf4/0x4f0
 __vmalloc_node+0x80/0x9c
 init_IRQ+0xe8/0x130
 start_kernel+0x188/0x360
 __primary_switched+0xc0/0xc8




But I haven't looked much further, so would appeal to you to either
confirm or reject this idea.

Thanks,
-- Marco
.
--------------A272B108B4C815A0D985895D--