From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3332E95A8E for ; Mon, 9 Oct 2023 07:38:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5A8826B00A0; Mon, 9 Oct 2023 03:38:04 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 530756B00A2; Mon, 9 Oct 2023 03:38:04 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3AB4F6B00A3; Mon, 9 Oct 2023 03:38:04 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0017.hostedemail.com [216.40.44.17]) by kanga.kvack.org (Postfix) with ESMTP id 216686B00A0 for ; Mon, 9 Oct 2023 03:38:04 -0400 (EDT) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id EBDF81CA47B for ; Mon, 9 Oct 2023 07:38:03 +0000 (UTC) X-FDA: 81325119246.26.B067502 Received: from mailgw02.mediatek.com (mailgw02.mediatek.com [216.200.240.185]) by imf30.hostedemail.com (Postfix) with ESMTP id E1BD580004 for ; Mon, 9 Oct 2023 07:38:00 +0000 (UTC) Authentication-Results: imf30.hostedemail.com; dkim=pass header.d=mediatek.com header.s=dk header.b=CVKhhfHi; dmarc=pass (policy=quarantine) header.from=mediatek.com; spf=pass (imf30.hostedemail.com: domain of haibo.li@mediatek.com designates 216.200.240.185 as permitted sender) smtp.mailfrom=haibo.li@mediatek.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1696837081; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=Pvei1ks/khlX8BXIzq4Y8G7n7B36rJvutKNZiv35fU8=; b=8aKjePaFEYLZ9V7bkVr4MACrvj3CJ1rZVISzeSvI9a3yQcV0xW+vFNE6JtsQ/PQM/MOyXn nfap2DijddrPT5NxZXbP40a0S+wEnR679ZpSoJrweDaBBprnRkSOYlEE+LDaLuEFGDX6Bz uY+rNxv294CBxdOdApMPRcAi7YKFMBo= ARC-Authentication-Results: i=1; imf30.hostedemail.com; dkim=pass header.d=mediatek.com header.s=dk header.b=CVKhhfHi; dmarc=pass (policy=quarantine) header.from=mediatek.com; spf=pass (imf30.hostedemail.com: domain of haibo.li@mediatek.com designates 216.200.240.185 as permitted sender) smtp.mailfrom=haibo.li@mediatek.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1696837081; a=rsa-sha256; cv=none; b=dcosFQxNlQfFKS7Y17E3ZKyjbcswn44P5Z4FMf0q4vsNMQiTGL+x+SfzxsYs4/Y/f+LWZK 2QzBlhmBhgci87yJt4VZNc9bOMJk9g7N489z2NaTrAJ4NwGx/2D/JAW5Rzghfg1dbT56rK OU9ly7ryfmXBA7KyWE22PjNQb/aBElA= X-UUID: c1ae73e0667611ee86758d4a7c00f3a0-20231009 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=mediatek.com; s=dk; h=Content-Type:Content-Transfer-Encoding:MIME-Version:Message-ID:Date:Subject:CC:To:From; bh=Pvei1ks/khlX8BXIzq4Y8G7n7B36rJvutKNZiv35fU8=; b=CVKhhfHi9bd2XgA/z1z17yMtTqoLB6cjoeywu+9/JD29PMECgRRlB4HErEP+jZ2bV0czL9NJCGAHOEJGzqjNO/9/H0mqDOu55IIYHxpBkUhL887FlnFFdk49ys4AGwDP1MQeNzBH2K4qsJCMs2dCVJBZUldOw6WgXdEvs3KaCYQ=; X-CID-P-RULE: Release_Ham X-CID-O-INFO: VERSION:1.1.32,REQID:da29afdf-0303-4bfd-9743-a167875a0e11,IP:0,U RL:0,TC:0,Content:0,EDM:0,RT:0,SF:0,FILE:0,BULK:0,RULE:Release_Ham,ACTION: release,TS:0 X-CID-META: VersionHash:5f78ec9,CLOUDID:b178ebc3-1e57-4345-9d31-31ad9818b39f,B ulkID:nil,BulkQuantity:0,Recheck:0,SF:102,TC:nil,Content:0,EDM:-3,IP:nil,U RL:11|1,File:nil,Bulk:nil,QS:nil,BEC:nil,COL:0,OSI:0,OSA:0,AV:0,LES:1,SPR: NO,DKR:0,DKP:0,BRR:0,BRE:0 X-CID-BVR: 0,NGT X-CID-BAS: 0,NGT,0,_ X-CID-FACTOR: TF_CID_SPAM_ULN,TF_CID_SPAM_SNR X-UUID: c1ae73e0667611ee86758d4a7c00f3a0-20231009 Received: from mtkmbs11n1.mediatek.inc [(172.21.101.185)] by mailgw02.mediatek.com (envelope-from ) (musrelay.mediatek.com ESMTP with TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384 256/256) with ESMTP id 1059083868; Mon, 09 Oct 2023 00:37:53 -0700 Received: from mtkmbs13n2.mediatek.inc (172.21.101.108) by mtkmbs10n1.mediatek.inc (172.21.101.34) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1118.26; Mon, 9 Oct 2023 15:37:50 +0800 Received: from mszsdtlt102.gcn.mediatek.inc (10.16.4.142) by mtkmbs13n2.mediatek.inc (172.21.101.73) with Microsoft SMTP Server id 15.2.1118.26 via Frontend Transport; Mon, 9 Oct 2023 15:37:50 +0800 From: Haibo Li To: CC: Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , "Andrew Morton" , Matthias Brugger , AngeloGioacchino Del Regno , , , , , , Haibo Li Subject: [PATCH v2] kasan:print the original fault addr when access invalid shadow Date: Mon, 9 Oct 2023 15:37:48 +0800 Message-ID: <20231009073748.159228-1-haibo.li@mediatek.com> X-Mailer: git-send-email 2.34.3 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-TM-AS-Product-Ver: SMEX-14.0.0.3152-9.1.1006-23728.005 X-TM-AS-Result: No-10--11.043300-8.000000 X-TMASE-MatchedRID: vb/S/ihWjLk3hN8xy8q7MnQIOMndeKgEMApqy5cfknVXPwnnY5XL5Mla v/so0mjiO51tDCZfaDqmvurnuvPUoT9WWWmKWtUYSHCU59h5KrEBmf/gD11vZI9x3aMQAmDtFTf B1yBPlPICwWUI3NaNHbRCpOgpqZeg9BhkkEGgXxGzI1v7J4hECko8jH4wkX2j31GU/N5W5BC4Nj 3Kc7xHIlgw2yKNObv1gO92fqQQImpcPJ5MOmncJgwfhKwa9GwDfS0Ip2eEHnz3IzXlXlpamPoLR 4+zsDTtviI7BBDiM2KwfWryaaWDXBKZmjqY1lnK7Ipy5jxIfwR5XDkPsW+gWg== X-TM-AS-User-Approved-Sender: No X-TM-AS-User-Blocked-Sender: No X-TMASE-Result: 10--11.043300-8.000000 X-TMASE-Version: SMEX-14.0.0.3152-9.1.1006-23728.005 X-TM-SNTS-SMTP: EE42831E05BD0403DB997D7B3FD28C9A3D60B62DA7DC7C0632785B74A443CFC22000:8 X-MTK: N X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: E1BD580004 X-Stat-Signature: ak1fygefub7tf59fadkrbxxts9ppg9z1 X-HE-Tag: 1696837080-265790 X-HE-Meta: U2FsdGVkX19XXPqt9Hz4CiHNND05Aq30jz6OFmh6Nvwk5YmU+SnZw0kL5+jKsR9cerRcUf0sy5Z01cVfbOnMPvPGINObL3VoqAwWEVUOD3PGmiI8duv/c3gkPk4Bskrm5VAPSb6MlImgzb56q9+4TtVNmbOHYC0h7EZuxSY+wF+4txXx+uoS7nMlMg2yu2oJluyWz2y2A0dWL2EWcsk083pYGO5Zt6WLL6mq543pYOkILqeDzdzRsq4/1PfJycD+7SM13nezT9UQBW5XLZ7D4uEc2gzNH8hNStBeN8GWNGOOPgAUSof22d2yB8FgSUBdFEezMYGdeBmov4EQf42Ce/ehGRVhytvvKDCQI6YLnW4XbTsOD90JMubixh/knfxq0hoAedvfmRc5AAt+2om3T4wa7ah2B+TiU6zkZryCGGQJqAFGknDH9uGdbDSuLtRvW6ljBDtq+OHUx2HBGMXuXdpImPgNtBeS7pd/1OyGi1m5WHN4ZtNv/9ofZlUo0SYDplxy6pL0KbqM/2DeQU1J8JPfUS2GtfIdJwGzBrCLOCDpV+xQ/6RhWPN+gKBe3/6hRhx0WIgJVdvvL7xvhFEJNa0JZ5F3KUsIr38QGZI5mlfOTQoZgrAG8Z9btcD3wdDjFggNTnoQYh2/kLWhlhVy4bakTJ2CO3bbOrxahvD8FZylL0pKfyBvqj9RUIfMPPARGmaRtzMEICI+2ByIz5sPZ4Z8QeiCs99vWBJiI4RNB9F6MS71jcv/Y4RlKDAtFjiuS5yEkSuv0m7vWDOcxx4IleVVQSey+qte6i/F1BDoDQg1aKYHlIHiZ68AYuGm4zWPC2Yv3sEmlw4CQpwD42h8OhE+JlCckB8Fi4zlPPYdIe+7TV20UwOAieDydTr1u4LJqWjU6/t+zIOH5Esobw11UuYGEEIVn2bOWHamoOJCssIFL31fVNkw4FWFp5Be8AJXc2vXL8UVw64hQyLXUHh ARwpVhr+ 6UElRGfwStFVdiVGGoxxZkjSH8/NucnvnBsqAYr/RQ48RD5JM0eFVXx81lG/V0O+k8ZoALmCdMBCxvPLUPXNS/IyIDFFAkUVPKJvsRqMvCm3o0JTwUYjmSYKh9RD3yW+RypQGTamXrcsaXaXKzGJwJcj451r/9woianuDoQQpwkb7a696NUbkKjpaBZ54puUfKWMAb9MHH0hPWDlYFSOEVcrOOkbPTE9YnISv8GKrHHMrA6xVYjc6teNENwZy7Ff34c7GXaZpOV3Q38F0+Nd++fzq7U+/biZrW2PH X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: when the checked address is illegal,the corresponding shadow address from kasan_mem_to_shadow may have no mapping in mmu table. Access such shadow address causes kernel oops. Here is a sample about oops on arm64(VA 39bit) with KASAN_SW_TAGS and KASAN_OUTLINE on: [ffffffb80aaaaaaa] pgd=000000005d3ce003, p4d=000000005d3ce003, pud=000000005d3ce003, pmd=0000000000000000 Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 3 PID: 100 Comm: sh Not tainted 6.6.0-rc1-dirty #43 Hardware name: linux,dummy-virt (DT) pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __hwasan_load8_noabort+0x5c/0x90 lr : do_ib_ob+0xf4/0x110 ffffffb80aaaaaaa is the shadow address for efffff80aaaaaaaa. The problem is reading invalid shadow in kasan_check_range. The generic kasan also has similar oops. It only reports the shadow address which causes oops but not the original address. Commit 2f004eea0fc8("x86/kasan: Print original address on #GP") introduce to kasan_non_canonical_hook but limit it to KASAN_INLINE. This patch extends it to KASAN_OUTLINE mode. Signed-off-by: Haibo Li --- v2: - In view of the possible perf impact by checking shadow address,change to use kasan_non_canonical_hook as it works after oops. --- include/linux/kasan.h | 6 +++--- mm/kasan/report.c | 4 +--- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 3df5499f7936..a707ee8b19ce 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -466,10 +466,10 @@ static inline void kasan_free_module_shadow(const struct vm_struct *vm) {} #endif /* (CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS) && !CONFIG_KASAN_VMALLOC */ -#ifdef CONFIG_KASAN_INLINE +#ifdef CONFIG_KASAN void kasan_non_canonical_hook(unsigned long addr); -#else /* CONFIG_KASAN_INLINE */ +#else /* CONFIG_KASAN */ static inline void kasan_non_canonical_hook(unsigned long addr) { } -#endif /* CONFIG_KASAN_INLINE */ +#endif /* CONFIG_KASAN */ #endif /* LINUX_KASAN_H */ diff --git a/mm/kasan/report.c b/mm/kasan/report.c index ca4b6ff080a6..3974e4549c3e 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -621,9 +621,8 @@ void kasan_report_async(void) } #endif /* CONFIG_KASAN_HW_TAGS */ -#ifdef CONFIG_KASAN_INLINE /* - * With CONFIG_KASAN_INLINE, accesses to bogus pointers (outside the high + * With CONFIG_KASAN, accesses to bogus pointers (outside the high * canonical half of the address space) cause out-of-bounds shadow memory reads * before the actual access. For addresses in the low canonical half of the * address space, as well as most non-canonical addresses, that out-of-bounds @@ -659,4 +658,3 @@ void kasan_non_canonical_hook(unsigned long addr) pr_alert("KASAN: %s in range [0x%016lx-0x%016lx]\n", bug_type, orig_addr, orig_addr + KASAN_GRANULE_SIZE - 1); } -#endif -- 2.18.0