Re: [PATCH] arm64: Reset KASAN tag in copy_highpage with HW tags only

[Andrey Konovalov <andreyknvl@gmail.com>]

On Wed, Feb 15, 2023 at 5:44 AM Peter Collingbourne <pcc@google.com> wrote:
>
> On Tue, Feb 14, 2023 at 9:54 AM Catalin Marinas <catalin.marinas@arm.com> wrote:
> >
> > On Mon, Feb 13, 2023 at 05:52:14PM -0800, Peter Collingbourne wrote:
> > > During page migration, the copy_highpage function is used to copy the
> > > page data to the target page. If the source page is a userspace page
> > > with MTE tags, the KASAN tag of the target page must have the match-all
> > > tag in order to avoid tag check faults during subsequent accesses to the
> > > page by the kernel. However, the target page may have been allocated in
> > > a number of ways, some of which will use the KASAN allocator and will
> > > therefore end up setting the KASAN tag to a non-match-all tag. Therefore,
> > > update the target page's KASAN tag to match the source page.
> > >
> > > We ended up unintentionally fixing this issue as a result of a bad
> > > merge conflict resolution between commit e059853d14ca ("arm64: mte:
> > > Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64:
> > > kasan: Revert "arm64: mte: reset the page tag in page->flags""), which
> > > preserved a tag reset for PG_mte_tagged pages which was considered to be
> > > unnecessary at the time. Because SW tags KASAN uses separate tag storage,
> > > update the code to only reset the tags when HW tags KASAN is enabled.
> >
> > Does KASAN_SW_TAGS work together with MTE?
>
> Yes, it works fine. One of my usual kernel patch tests runs an
> MTE-utilizing userspace program under a kernel with KASAN_SW_TAGS.
>
> > In theory they should but I
> > wonder whether we have other places calling page_kasan_tag_reset()
> > without the kasan_hw_tags_enabled() check.
>
> It's unclear to me whether any of the other references are
> specifically related to KASAN_HW_TAGS or not. Because KASAN_SW_TAGS
> also uses all-ones as a match-all tag, I wouldn't expect calling
> page_kasan_tag_reset() to cause any problems aside from false
> negatives.

All the other page_kasan_tag_reset() are related to both SW and HW_TAGS.