From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9637BE7716E for ; Wed, 4 Dec 2024 14:40:01 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 018DD6B0083; Wed, 4 Dec 2024 09:40:01 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id F0A366B0085; Wed, 4 Dec 2024 09:40:00 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id DD2B76B0089; Wed, 4 Dec 2024 09:40:00 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id C07CC6B0083 for ; Wed, 4 Dec 2024 09:40:00 -0500 (EST) Received: from smtpin24.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 7A1F7AED9B for ; Wed, 4 Dec 2024 14:40:00 +0000 (UTC) X-FDA: 82857535740.24.5D7F9B6 Received: from mail-qt1-f170.google.com (mail-qt1-f170.google.com [209.85.160.170]) by imf24.hostedemail.com (Postfix) with ESMTP id DAA03180015 for ; Wed, 4 Dec 2024 14:39:56 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=3A0tdOWq; spf=pass (imf24.hostedemail.com: domain of surenb@google.com designates 209.85.160.170 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1733323188; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=T5oqqzwviB0cnruZZagLfTt+wkZgmhV4OxTYeK6vdMg=; b=4CkGWR19ESxH+jV0TONMKJUHgKcrk8ZBxS3cby4LfdJRFLdU/SqeXROPq0uzICJWdIut2q TAP/6xSb5rRQe6vLFx1xXtx6PDU9yEFC1n7kIDKWe4wfu7Dg/akRPPFWyCl5AA6Re8HSBn NiEO4HYRo02SSsyvEDgYDHWfZ7xqEv4= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=google.com header.s=20230601 header.b=3A0tdOWq; spf=pass (imf24.hostedemail.com: domain of surenb@google.com designates 209.85.160.170 as permitted sender) smtp.mailfrom=surenb@google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1733323188; a=rsa-sha256; cv=none; b=trMCkKlWmGEloSdsoGPCPbF6W24QH8ufgZjBVYtlKZtsxchvRoHELB/bLrx2m+nrtjVnuB a7A75hpFAAoD44TZkHZqv7HDwVvePRHhDogDT6rzcFHatIFYsNjW2X/U6N/eUq0yDpc/2v WkGer+M0w5974QNUSGLLFnVfgMC+Lx8= Received: by mail-qt1-f170.google.com with SMTP id d75a77b69052e-466ab386254so217231cf.1 for ; Wed, 04 Dec 2024 06:39:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1733323198; x=1733927998; darn=kvack.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=T5oqqzwviB0cnruZZagLfTt+wkZgmhV4OxTYeK6vdMg=; b=3A0tdOWqXE9xfw+finf4fN2afLMYUPRQk429B0hNKhzHtb7ZD0v10hmUFDbVKmS/cq +4iDgOIc9cOm1Aj5juQot4IZMV6DMi+pbU8uAx7QXpdZyH68G2/Wi1dzd5HTL+TEB2Od /PzaSYZVNG7D130NMDes5Mdw1Hmp1OFAe5icbcRSIkQ+Hvy/TI02iQ70rSrRCm3G1HBe ckkKXhlfX1pf2l2hZuKR0laUVj4IDMQlkTNt7m8S7xd+VoxFvVD1NvRH3MGWabpsHxUA R3+bGy9nxCP12lE4vRn64XnqO4WAmxEhnaGfXPOZSNIs2bQS4WCPIo12cFDOVh7YGObr 5IjQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1733323198; x=1733927998; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=T5oqqzwviB0cnruZZagLfTt+wkZgmhV4OxTYeK6vdMg=; b=PG2x7H9q05tMtrwMWJp2H2sZpNHRMVl0sw53Mq0FBBPC+HY8q9X5d/d9V+J1x4XmiH wAh4JzDTuSmceoPkG3xJvkenPCrI0YmWtlajD+Atpc1esEEjQBCLpvHYtRJHppQsV6qf ClpnETqmXR7/5GzlUImq7G6DFrLuMv4eHb4eeRbYw6xUqFSNDRt7PpTDZRgG7NAO/qjs 6Bj/UNZfJsVoJrWd5aBULlffL+tQMTJed8IEUeuFXT+VHcaQpUer1Gbehabk2mk+3Q5m e+mS8Utfx4J6N8+CRNRJJ/DPi1+IzsAy3vmbZbLqM7c1UdpJGBJXADrLyR6sJnLcRnza 0n6g== X-Forwarded-Encrypted: i=1; AJvYcCVqiYVU8Yu60OgRwfP14P1x199Y4b/FbOfhc0h0yOR3iru6OC5EJeQa6vKrnp2LEAwQUIFZ2xlu4w==@kvack.org X-Gm-Message-State: AOJu0YwJJj80OgIXBO17gMeRbwaq7BwZjmmk5gvHCF95Sl/YJoel75U4 TDrx4wxGBu+8ot9ZHBmzqWUibQc1AsibUZihlgnFw+1zTzDYK28EJgE6CbcgNMArgQFUAr6Lcup Eydco/mSLy3oBs0qhgn5CiIk9pqVoy9mHc/UH X-Gm-Gg: ASbGncucHyAJPTorSJZfdYbabOgF8IVBpJsRHnqCO78+tUGfsg8spsMVU1cYrFGnM5y thKo2YmKLl0gZ69xLgm+dzLitXFD7bgWY6Q== X-Google-Smtp-Source: AGHT+IHHcJyaltbbRC8sOLBrsWMRfccYEJo0D3YMqc1idj70Se9R3/ZjO6oXwM3ktDa3CJtR6gIawpRyVSY4a8lNXvU= X-Received: by 2002:a05:622a:5191:b0:466:9b73:8e3c with SMTP id d75a77b69052e-4671b76615cmr3039611cf.13.1733323197413; Wed, 04 Dec 2024 06:39:57 -0800 (PST) MIME-Version: 1.0 References: <20241204075248.384215-1-hao.ge@linux.dev> <20241204083448.387862-1-hao.ge@linux.dev> In-Reply-To: <20241204083448.387862-1-hao.ge@linux.dev> From: Suren Baghdasaryan Date: Wed, 4 Dec 2024 06:39:45 -0800 Message-ID: Subject: Re: [PATCH v2] mm/alloc_tag: fix vm_module_tags_populate's KASAN poisoning logic To: Hao Ge Cc: kent.overstreet@linux.dev, akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Hao Ge Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Rspamd-Server: rspam05 X-Stat-Signature: c4byhotcy6udxayprk4c6z9qxf35tj9n X-Rspamd-Queue-Id: DAA03180015 X-Rspam-User: X-HE-Tag: 1733323196-137957 X-HE-Meta: U2FsdGVkX1/uI/LcuwnCP39DTN4qeaF7Y7RNlqw/nWL1sPZuu1U4LPsUMxgov5qlmx6ZN/Krb6XjpbbFObxZn3aolgm/0LsTnPYSgJIF3Q3mycxuYk/iDqpj3u7C6B7JvyAwWNZwddD0Jbfl5OHXvUDjPm12Ktl2AsoptDiqK9N6FXvNzikqjBKOn8TXfvDFH5g9T+jP0WsHiNFvIk8az8Fnw1LiRaJCyG0/p3CrDdg/KU7mgFMWP2EbxzyW+77U3sWNDSAKqclmSS2yV4I5ZCnQd3wY8e2nH9vkAs82smS9DWYqv4hlnEBSb39BN8kkhg6YO/jBgW1K2bhThdhCeurmIx3lw/8MKQHCTZ8mt3dtXdNhAjH14IHc4KvJsKsbFhefQkAD6dDSH0Gjkr80IKVQNyojxLEGmvvN4DLwT1XnGld2ooRMTWLbWR7gs8g1KdLjSnV35O3xg73kxQB5WZ03kVDq2Ibop+jdWKDOhKa5bgbSfF2EeSeWED06oGUVpfCEpTEIFpRymeWy5UO6vd/dTGxzjXN3qvBGjN5D5vmvXMKe8d+DAQNOR+rj54Vb0+FgmIa5Wd6W4gx2mVByXk3+XJZ29y71SrIdafE5wdXxeDQbhVNX4XEYyoF7I4qOZ5d5MZtNucTpuHMAnaAEpNnK5Ezsb1IATAX4yh0bQjoa8zfc7ragQq3B8AtvLTjMG4yUErY8v67Mtup+HF66K8mZ2ZIzBUB8bHj9LdqedpoCtAnlULtMFOb8WC9coU5dzlixlo8yqsN4EX76l2pg+qUw+FvWi4r5jqCGiHTLhndrTL1GvghqTEwEHYXog7YBlZH4zz1ndEssD6+pLJYmBKiBkilqO0GBNyvg5pSC8qhPY4ULkLYEIeZTcNkLjV5zvrgWsOGJP5odpNHoYnWFDw5GsvW10eAh9mTfatvnQHFuVADKIOIIseyn6iBFLS/ZVthRGOu2Wh6zwRzJlZu kRhknCBY bwX5GI/5lEZpvIrqEXr7z1xrxWmmnIUoz56I86QZxjnZ7P8kOez2cUliE2aKWNsZCGQcZENXKjSJfynip/2ZYJPo28+CxwAp2yRySm+bJ3n0Z2Dp/GyBMCr9sgJOP+MD39pm/T4sEpsiZP4yQoWv3Yl0KXA0o1I8VlScoBDjz/kXOVNhIsKVWtmNj2jWoTH9hiwAkgqKjnxq8XPtxZgWHMU2CXypkMi6uCevnBkDEGxB/MGI= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000007, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Wed, Dec 4, 2024 at 12:35=E2=80=AFAM Hao Ge wrote: > > From: Hao Ge > > After merge commit 233e89322cbe ("alloc_tag: > fix module allocation tags populated area calculation"), > We still encountered a KASAN bug. > > This is because we have only actually performed > page allocation and address mapping here. > we need to unpoisoned portions of underlying memory. > > Because we have a change in the size here,we need to > re-annotate poisoned and unpoisoned portions of underlying memory > according to the new size. > > Here is the log for KASAN: > > [ 5.041171][ T1] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D > [ 5.042047][ T1] BUG: KASAN: vmalloc-out-of-bounds in move_module+0= x2c0/0x708 > [ 5.042723][ T1] Write of size 240 at addr ffff80007e510000 by task= systemd/1 > [ 5.043412][ T1] > [ 5.043523][ T72] input: QEMU QEMU USB Tablet as /devices/pci0000:00= /0000:00:01.1/0000:02:001 > [ 5.043614][ T1] CPU: 0 UID: 0 PID: 1 Comm: systemd Not tainted 6.1= 3.0-rc1+ #28 > [ 5.045560][ T1] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.= 0 02/06/2015 > [ 5.046328][ T1] Call trace: > [ 5.046670][ T1] show_stack+0x20/0x38 (C) > [ 5.047127][ T1] dump_stack_lvl+0x80/0xf8 > [ 5.047533][ T1] print_address_description.constprop.0+0x58/0x358 > [ 5.048092][ T72] hid-generic 0003:0627:0001.0001: input,hidraw0: US= B HID v0.01 Mouse [QEMU 0 > [ 5.048126][ T1] print_report+0xb0/0x280 > [ 5.049682][ T1] kasan_report+0xb8/0x108 > [ 5.050170][ T1] kasan_check_range+0xe8/0x190 > [ 5.050685][ T1] memcpy+0x58/0xa0 > [ 5.051135][ T1] move_module+0x2c0/0x708 > [ 5.051586][ T1] layout_and_allocate.constprop.0+0x308/0x5b8 > [ 5.052219][ T1] load_module+0x134/0x16c8 > [ 5.052671][ T1] init_module_from_file+0xdc/0x138 > [ 5.053193][ T1] idempotent_init_module+0x344/0x600 > [ 5.053742][ T1] __arm64_sys_finit_module+0xbc/0x150 > [ 5.054289][ T1] invoke_syscall+0xd4/0x258 > [ 5.054749][ T1] el0_svc_common.constprop.0+0xb4/0x240 > [ 5.055319][ T1] do_el0_svc+0x48/0x68 > [ 5.055743][ T1] el0_svc+0x40/0xe0 > [ 5.056142][ T1] el0t_64_sync_handler+0x10c/0x138 > [ 5.056658][ T1] el0t_64_sync+0x1ac/0x1b0 > > Fixes: 233e89322cbe ("alloc_tag: fix module allocation tags populated are= a calculation") > Signed-off-by: Hao Ge Thanks for the fix! > > --- > v2: Add comments to kasan_unpoison_vmalloc like other places. > > commit 233e89322cbe ("alloc_tag: fix module allocation > tags populated area calculation") is currently in the > mm-hotfixes-unstable branch, so this patch is > developed based on the mm-hotfixes-unstable branch. > --- > lib/alloc_tag.c | 13 +++++++++++++ > 1 file changed, 13 insertions(+) > > diff --git a/lib/alloc_tag.c b/lib/alloc_tag.c > index 4ee6caa6d2da..f885b3f3af0e 100644 > --- a/lib/alloc_tag.c > +++ b/lib/alloc_tag.c > @@ -421,7 +421,20 @@ static int vm_module_tags_populate(void) > __free_page(next_page[i]); > return -ENOMEM; > } > + > + kasan_poison_vmalloc((void *)module_tags.start_addr, > + vm_module_tags->nr_pages << PAGE_SHI= FT); > + > vm_module_tags->nr_pages +=3D nr; > + > + /* > + * Mark the pages as accessible, now that they are mapped= . > + * With hardware tag-based KASAN, marking is skipped for > + * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc(). > + */ > + kasan_unpoison_vmalloc((void *)module_tags.start_addr, > + vm_module_tags->nr_pages << PAGE_S= HIFT, > + KASAN_VMALLOC_PROT_NORMAL); Instead of poisoning [module_tags.start_addr, vm_module_tags->nr_pages], incrementing vm_module_tags->nr_pages and the unpoisoning [module_tags.start_addr, vm_module_tags->nr_pages] could we simply poisons the additional area like this: kasan_unpoison_vmalloc((void *)module_tags.start_addr + (vm_module_tags->nr_pages << PAGE_SH= IFT), nr << PAGE_SHIFT, KASAN_VMALLOC_PROT_NORMAL); vm_module_tags->nr_pages +=3D nr; ? > } > > return 0; > -- > 2.25.1 >