From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6660EC433EF for ; Sat, 21 May 2022 22:16:25 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C562F8D0003; Sat, 21 May 2022 18:16:24 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id BDF418D0001; Sat, 21 May 2022 18:16:24 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A89CA8D0003; Sat, 21 May 2022 18:16:24 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 97A9D8D0001 for ; Sat, 21 May 2022 18:16:24 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay13.hostedemail.com (Postfix) with ESMTP id 5BB0E60847 for ; Sat, 21 May 2022 22:16:24 +0000 (UTC) X-FDA: 79491159888.06.511145D Received: from mail-io1-f49.google.com (mail-io1-f49.google.com [209.85.166.49]) by imf09.hostedemail.com (Postfix) with ESMTP id 4086014001E for ; Sat, 21 May 2022 22:16:12 +0000 (UTC) Received: by mail-io1-f49.google.com with SMTP id s23so11938436iog.13 for ; Sat, 21 May 2022 15:16:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=qYdob3aQ7jNkxWqVlbfUqmdutai3OIv6tnI9DeVJxnw=; b=grKmiARWHkmf7FcvfJJEohurb0gW4YLDXn4M/eDg6QwK0+azjCST4fLm6KZo/iNU+g czc7SZg1a5ihO6REQ6hmKoQ+RECsx2755dy+S9ZdIFOFydrmleSnhUJrQkjToc7+hqpd dCskVQ4nvD73kYJSYAu+I4F9BdLslzqhY3cZ+iTAvUEDJK9DN2IOt1EsicoXhAEijXtw 6GFEDyxMMdDCjTGEk5q4gl9x9WafPoEkR5dkiFSUvUh2uf+UEevIcyJfoqXznQ07e36l dUCIyoohlrWtPYZshzM/hPbNv4V/7vv1jCePLkC5AcYg14pnxkYcLohaVLfvJnKbKsIC CzEA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=qYdob3aQ7jNkxWqVlbfUqmdutai3OIv6tnI9DeVJxnw=; b=v2nXbA0Dk3Dg2+1+yI4kBHhmhkceGxerxqje+GqRedLQKJ8EQ9zTXmEjpqbQFXfx3R EA+/1u3gENWsAJCNJpRu9IfJL/WeD+OFcpjztN/T7hHrtH93ReHHKLceHMbMR7sZEpXr BmudVw5uFZIZwnVgNQJtz8yloBKxRU5S6nsYjxDnYtme6SNGpluCTIJUBt/4tNFLR/ky Qc0br+jNlPaSmhI28RPma7CSjTkG/k59hre19gCv9zVWiycqzNpaprv67GTKLZTrhvtW 24szu7Dy/Px4VOzCA5Y3P/fIyaP7D96OP1BDj4iaJS9A4uissFN5II8WD7FmJe5/UgMk chRQ== X-Gm-Message-State: AOAM532cUmOxVsgTISsMHOhyyKDRx+G8AP77IjPA6K/7yYIlAQ0Vn4e9 ho21bLNzGYogrbc0zQnYRkucgAckDofeyWxuzec= X-Google-Smtp-Source: ABdhPJzNfVO8MygmOgTVfc/0yo7S6hxVoaMnROzHpQIQOYh0hNZlsic7TJE5Qqg0cmMeSiiLNDVQNDTJP0EtusmmrDg= X-Received: by 2002:a6b:3115:0:b0:660:d5f1:e3b6 with SMTP id j21-20020a6b3115000000b00660d5f1e3b6mr1815101ioa.99.1653171383147; Sat, 21 May 2022 15:16:23 -0700 (PDT) MIME-Version: 1.0 References: <20220517180945.756303-1-catalin.marinas@arm.com> <20220517180945.756303-4-catalin.marinas@arm.com> In-Reply-To: <20220517180945.756303-4-catalin.marinas@arm.com> From: Andrey Konovalov Date: Sun, 22 May 2022 00:16:12 +0200 Message-ID: Subject: Re: [PATCH 3/3] arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags" To: Catalin Marinas Cc: Andrey Ryabinin , Will Deacon , Vincenzo Frascino , Peter Collingbourne , kasan-dev , Linux Memory Management List , Linux ARM Content-Type: text/plain; charset="UTF-8" X-Rspamd-Server: rspam11 X-Rspamd-Queue-Id: 4086014001E X-Stat-Signature: hk9yxw5z81um375qsu9inxr91fo1bej5 X-Rspam-User: Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=grKmiARW; dmarc=pass (policy=none) header.from=gmail.com; spf=pass (imf09.hostedemail.com: domain of andreyknvl@gmail.com designates 209.85.166.49 as permitted sender) smtp.mailfrom=andreyknvl@gmail.com X-HE-Tag: 1653171372-50551 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, May 17, 2022 at 8:09 PM Catalin Marinas wrote: > > This reverts commit e5b8d9218951e59df986f627ec93569a0d22149b. > > On a system with MTE and KASAN_HW_TAGS enabled, when a page is allocated > kasan_unpoison_pages() sets a random tag and saves it in page->flags. > page_to_virt() re-creates the correct tagged pointer. > > If such page is mapped in user-space with PROT_MTE, the architecture > code will set the tag to 0 and a subsequent page_to_virt() dereference > will fault. The reverted commit aimed to fix this by resetting the tag > in page->flags so that it is 0xff (match-all, not faulting). However, > setting the tags and flags can race with another CPU reading the flags > (page_to_virt()) and barriers can't help: > > P0 (mte_sync_page_tags): P1 (memcpy from virt_to_page): > Rflags!=0xff > Wflags=0xff > DMB (doesn't help) > Wtags=0 > Rtags=0 // fault > > Since clearing the flags in the arch code doesn't help, revert the patch > altogether. In addition, remove the page_kasan_tag_reset() call in > tag_clear_highpage() since the core kasan code should take care of > resetting the page tag. > > Signed-off-by: Catalin Marinas > Cc: Will Deacon > Cc: Vincenzo Frascino > Cc: Andrey Konovalov > Cc: Peter Collingbourne > --- > arch/arm64/kernel/hibernate.c | 5 ----- > arch/arm64/kernel/mte.c | 9 --------- > arch/arm64/mm/copypage.c | 9 --------- > arch/arm64/mm/fault.c | 1 - > arch/arm64/mm/mteswap.c | 9 --------- > 5 files changed, 33 deletions(-) > > diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c > index 6328308be272..7754ef328657 100644 > --- a/arch/arm64/kernel/hibernate.c > +++ b/arch/arm64/kernel/hibernate.c > @@ -300,11 +300,6 @@ static void swsusp_mte_restore_tags(void) > unsigned long pfn = xa_state.xa_index; > struct page *page = pfn_to_online_page(pfn); > > - /* > - * It is not required to invoke page_kasan_tag_reset(page) > - * at this point since the tags stored in page->flags are > - * already restored. > - */ > mte_restore_page_tags(page_address(page), tags); > > mte_free_tag_storage(tags); > diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c > index 78b3e0f8e997..90994aca54f3 100644 > --- a/arch/arm64/kernel/mte.c > +++ b/arch/arm64/kernel/mte.c > @@ -47,15 +47,6 @@ static void mte_sync_page_tags(struct page *page, pte_t old_pte, > if (!pte_is_tagged) > return; > > - page_kasan_tag_reset(page); > - /* > - * We need smp_wmb() in between setting the flags and clearing the > - * tags because if another thread reads page->flags and builds a > - * tagged address out of it, there is an actual dependency to the > - * memory access, but on the current thread we do not guarantee that > - * the new page->flags are visible before the tags were updated. > - */ > - smp_wmb(); > mte_clear_page_tags(page_address(page)); > } > > diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c > index b5447e53cd73..70a71f38b6a9 100644 > --- a/arch/arm64/mm/copypage.c > +++ b/arch/arm64/mm/copypage.c > @@ -23,15 +23,6 @@ void copy_highpage(struct page *to, struct page *from) > > if (system_supports_mte() && test_bit(PG_mte_tagged, &from->flags)) { > set_bit(PG_mte_tagged, &to->flags); > - page_kasan_tag_reset(to); > - /* > - * We need smp_wmb() in between setting the flags and clearing the > - * tags because if another thread reads page->flags and builds a > - * tagged address out of it, there is an actual dependency to the > - * memory access, but on the current thread we do not guarantee that > - * the new page->flags are visible before the tags were updated. > - */ > - smp_wmb(); > mte_copy_page_tags(kto, kfrom); > } > } > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > index 77341b160aca..f2f21cd6d43f 100644 > --- a/arch/arm64/mm/fault.c > +++ b/arch/arm64/mm/fault.c > @@ -926,6 +926,5 @@ struct page *alloc_zeroed_user_highpage_movable(struct vm_area_struct *vma, > void tag_clear_highpage(struct page *page) > { > mte_zero_clear_page_tags(page_address(page)); > - page_kasan_tag_reset(page); This change is not a part of e5b8d9218951e59df986f627ec93569a0d22149b revert. I think it should go into a separate commit. > set_bit(PG_mte_tagged, &page->flags); > } > diff --git a/arch/arm64/mm/mteswap.c b/arch/arm64/mm/mteswap.c > index a9e50e930484..4334dec93bd4 100644 > --- a/arch/arm64/mm/mteswap.c > +++ b/arch/arm64/mm/mteswap.c > @@ -53,15 +53,6 @@ bool mte_restore_tags(swp_entry_t entry, struct page *page) > if (!tags) > return false; > > - page_kasan_tag_reset(page); > - /* > - * We need smp_wmb() in between setting the flags and clearing the > - * tags because if another thread reads page->flags and builds a > - * tagged address out of it, there is an actual dependency to the > - * memory access, but on the current thread we do not guarantee that > - * the new page->flags are visible before the tags were updated. > - */ > - smp_wmb(); > mte_restore_page_tags(page_address(page), tags); > > return true;