Re: [PATCH v2] arm64: Reset KASAN tag in copy_highpage with HW tags only

[Andrey Konovalov <andreyknvl@gmail.com>]

On Wed, Feb 15, 2023 at 6:09 AM Peter Collingbourne <pcc@google.com> wrote:
>
> During page migration, the copy_highpage function is used to copy the
> page data to the target page. If the source page is a userspace page
> with MTE tags, the KASAN tag of the target page must have the match-all
> tag in order to avoid tag check faults during subsequent accesses to the
> page by the kernel. However, the target page may have been allocated in
> a number of ways, some of which will use the KASAN allocator and will
> therefore end up setting the KASAN tag to a non-match-all tag. Therefore,
> update the target page's KASAN tag to match the source page.
>
> We ended up unintentionally fixing this issue as a result of a bad
> merge conflict resolution between commit e059853d14ca ("arm64: mte:
> Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64:
> kasan: Revert "arm64: mte: reset the page tag in page->flags""), which
> preserved a tag reset for PG_mte_tagged pages which was considered to be
> unnecessary at the time. Because SW tags KASAN uses separate tag storage,
> update the code to only reset the tags when HW tags KASAN is enabled.
>
> Signed-off-by: Peter Collingbourne <pcc@google.com>
> Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830f52e0c
> Reported-by: "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee@mediatek.com>
> Cc: <stable@vger.kernel.org> # 6.1
> Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"")
> ---
> v2:
> - added Fixes tag
>
> For the stable branch, e059853d14ca needs to be cherry-picked and the following
> merge conflict resolution is needed:
>
> -               page_kasan_tag_reset(to);
> +               if (kasan_hw_tags_enabled())
> +                       page_kasan_tag_reset(to);
>  -              /* It's a new page, shouldn't have been tagged yet */
>  -              WARN_ON_ONCE(!try_page_mte_tagging(to));
>
>  arch/arm64/mm/copypage.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c
> index 8dd5a8fe64b4..4aadcfb01754 100644
> --- a/arch/arm64/mm/copypage.c
> +++ b/arch/arm64/mm/copypage.c
> @@ -22,7 +22,8 @@ void copy_highpage(struct page *to, struct page *from)
>         copy_page(kto, kfrom);
>
>         if (system_supports_mte() && page_mte_tagged(from)) {
> -               page_kasan_tag_reset(to);
> +               if (kasan_hw_tags_enabled())
> +                       page_kasan_tag_reset(to);
>                 /* It's a new page, shouldn't have been tagged yet */
>                 WARN_ON_ONCE(!try_page_mte_tagging(to));
>                 mte_copy_page_tags(kto, kfrom);
> --
> 2.39.1.581.gbfd45094c4-goog
>

Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>

Thank you, Peter!