[PATCH] arm64: Reset KASAN tag in copy_highpage with HW tags only

[PATCH] arm64: Reset KASAN tag in copy_highpage with HW tags only

[Peter Collingbourne]

During page migration, the copy_highpage function is used to copy the
page data to the target page. If the source page is a userspace page
with MTE tags, the KASAN tag of the target page must have the match-all
tag in order to avoid tag check faults during subsequent accesses to the
page by the kernel. However, the target page may have been allocated in
a number of ways, some of which will use the KASAN allocator and will
therefore end up setting the KASAN tag to a non-match-all tag. Therefore,
update the target page's KASAN tag to match the source page.

We ended up unintentionally fixing this issue as a result of a bad
merge conflict resolution between commit e059853d14ca ("arm64: mte:
Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64:
kasan: Revert "arm64: mte: reset the page tag in page->flags""), which
preserved a tag reset for PG_mte_tagged pages which was considered to be
unnecessary at the time. Because SW tags KASAN uses separate tag storage,
update the code to only reset the tags when HW tags KASAN is enabled.

Signed-off-by: Peter Collingbourne <pcc@google.com>
Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830f52e0c
Reported-by: "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee@mediatek.com>
Cc: <stable@vger.kernel.org> # 6.1
---
For the stable branch, e059853d14ca needs to be cherry-picked and the following
merge conflict resolution is needed:

-               page_kasan_tag_reset(to);
+               if (kasan_hw_tags_enabled())
+                       page_kasan_tag_reset(to);
 -              /* It's a new page, shouldn't have been tagged yet */
 -              WARN_ON_ONCE(!try_page_mte_tagging(to));

 arch/arm64/mm/copypage.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c
index 8dd5a8fe64b4..4aadcfb01754 100644
--- a/arch/arm64/mm/copypage.c
+++ b/arch/arm64/mm/copypage.c
@@ -22,7 +22,8 @@ void copy_highpage(struct page *to, struct page *from)
 	copy_page(kto, kfrom);
 
 	if (system_supports_mte() && page_mte_tagged(from)) {
-		page_kasan_tag_reset(to);
+		if (kasan_hw_tags_enabled())
+			page_kasan_tag_reset(to);
 		/* It's a new page, shouldn't have been tagged yet */
 		WARN_ON_ONCE(!try_page_mte_tagging(to));
 		mte_copy_page_tags(kto, kfrom);
-- 
2.39.1.581.gbfd45094c4-goog

Re: [PATCH] arm64: Reset KASAN tag in copy_highpage with HW tags only

[Catalin Marinas]

On Mon, Feb 13, 2023 at 05:52:14PM -0800, Peter Collingbourne wrote:
> During page migration, the copy_highpage function is used to copy the
> page data to the target page. If the source page is a userspace page
> with MTE tags, the KASAN tag of the target page must have the match-all
> tag in order to avoid tag check faults during subsequent accesses to the
> page by the kernel. However, the target page may have been allocated in
> a number of ways, some of which will use the KASAN allocator and will
> therefore end up setting the KASAN tag to a non-match-all tag. Therefore,
> update the target page's KASAN tag to match the source page.
> 
> We ended up unintentionally fixing this issue as a result of a bad
> merge conflict resolution between commit e059853d14ca ("arm64: mte:
> Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64:
> kasan: Revert "arm64: mte: reset the page tag in page->flags""), which
> preserved a tag reset for PG_mte_tagged pages which was considered to be
> unnecessary at the time. Because SW tags KASAN uses separate tag storage,
> update the code to only reset the tags when HW tags KASAN is enabled.

Does KASAN_SW_TAGS work together with MTE? In theory they should but I
wonder whether we have other places calling page_kasan_tag_reset()
without the kasan_hw_tags_enabled() check.

> Signed-off-by: Peter Collingbourne <pcc@google.com>
> Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830f52e0c
> Reported-by: "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee@mediatek.com>
> Cc: <stable@vger.kernel.org> # 6.1

What are we trying to fix? The removal of page_kasan_tag_reset() in
copy_highpage()? If yes, I think we should use:

Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"")
Cc: <stable@vger.kernel.org> # 6.0.x

-- 
Catalin

Re: [PATCH] arm64: Reset KASAN tag in copy_highpage with HW tags only

[Peter Collingbourne]

On Tue, Feb 14, 2023 at 9:54 AM Catalin Marinas <catalin.marinas@arm.com> wrote:
>
> On Mon, Feb 13, 2023 at 05:52:14PM -0800, Peter Collingbourne wrote:
> > During page migration, the copy_highpage function is used to copy the
> > page data to the target page. If the source page is a userspace page
> > with MTE tags, the KASAN tag of the target page must have the match-all
> > tag in order to avoid tag check faults during subsequent accesses to the
> > page by the kernel. However, the target page may have been allocated in
> > a number of ways, some of which will use the KASAN allocator and will
> > therefore end up setting the KASAN tag to a non-match-all tag. Therefore,
> > update the target page's KASAN tag to match the source page.
> >
> > We ended up unintentionally fixing this issue as a result of a bad
> > merge conflict resolution between commit e059853d14ca ("arm64: mte:
> > Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64:
> > kasan: Revert "arm64: mte: reset the page tag in page->flags""), which
> > preserved a tag reset for PG_mte_tagged pages which was considered to be
> > unnecessary at the time. Because SW tags KASAN uses separate tag storage,
> > update the code to only reset the tags when HW tags KASAN is enabled.
>
> Does KASAN_SW_TAGS work together with MTE?

Yes, it works fine. One of my usual kernel patch tests runs an
MTE-utilizing userspace program under a kernel with KASAN_SW_TAGS.

> In theory they should but I
> wonder whether we have other places calling page_kasan_tag_reset()
> without the kasan_hw_tags_enabled() check.

It's unclear to me whether any of the other references are
specifically related to KASAN_HW_TAGS or not. Because KASAN_SW_TAGS
also uses all-ones as a match-all tag, I wouldn't expect calling
page_kasan_tag_reset() to cause any problems aside from false
negatives.

> > Signed-off-by: Peter Collingbourne <pcc@google.com>
> > Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830f52e0c
> > Reported-by: "Kuan-Ying Lee (李冠穎)" <Kuan-Ying.Lee@mediatek.com>
> > Cc: <stable@vger.kernel.org> # 6.1
>
> What are we trying to fix? The removal of page_kasan_tag_reset() in
> copy_highpage()?

Yes.

> If yes, I think we should use:
>
> Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"")
> Cc: <stable@vger.kernel.org> # 6.0.x

I agree with the Fixes tag, but are you sure that 6.0.y is still
supported as a stable kernel release? kernel.org only lists 6.1, and I
don't see any updates to Greg's linux-6.0.y branch since January 12.

I'm having some email trouble at the moment so I can't send a v2, so
please feel free to add the Fixes tag yourself.

Peter

Re: [PATCH] arm64: Reset KASAN tag in copy_highpage with HW tags only

[Catalin Marinas]

On Tue, Feb 14, 2023 at 08:44:36PM -0800, Peter Collingbourne wrote:
> On Tue, Feb 14, 2023 at 9:54 AM Catalin Marinas <catalin.marinas@arm.com> wrote:
> > If yes, I think we should use:
> >
> > Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"")
> > Cc: <stable@vger.kernel.org> # 6.0.x
> 
> I agree with the Fixes tag, but are you sure that 6.0.y is still
> supported as a stable kernel release? kernel.org only lists 6.1, and I
> don't see any updates to Greg's linux-6.0.y branch since January 12.

Yeah, that doesn't matter. I normally generate this with a git alias and
it matches the release containing the commit. I don't have to think
about which stable kernels are still maintained.

> I'm having some email trouble at the moment so I can't send a v2, so
> please feel free to add the Fixes tag yourself.

I can add the fixes tag.

-- 
Catalin

Re: [PATCH] arm64: Reset KASAN tag in copy_highpage with HW tags only

[Andrey Konovalov]

On Wed, Feb 15, 2023 at 5:44 AM Peter Collingbourne <pcc@google.com> wrote:
>
> On Tue, Feb 14, 2023 at 9:54 AM Catalin Marinas <catalin.marinas@arm.com> wrote:
> >
> > On Mon, Feb 13, 2023 at 05:52:14PM -0800, Peter Collingbourne wrote:
> > > During page migration, the copy_highpage function is used to copy the
> > > page data to the target page. If the source page is a userspace page
> > > with MTE tags, the KASAN tag of the target page must have the match-all
> > > tag in order to avoid tag check faults during subsequent accesses to the
> > > page by the kernel. However, the target page may have been allocated in
> > > a number of ways, some of which will use the KASAN allocator and will
> > > therefore end up setting the KASAN tag to a non-match-all tag. Therefore,
> > > update the target page's KASAN tag to match the source page.
> > >
> > > We ended up unintentionally fixing this issue as a result of a bad
> > > merge conflict resolution between commit e059853d14ca ("arm64: mte:
> > > Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64:
> > > kasan: Revert "arm64: mte: reset the page tag in page->flags""), which
> > > preserved a tag reset for PG_mte_tagged pages which was considered to be
> > > unnecessary at the time. Because SW tags KASAN uses separate tag storage,
> > > update the code to only reset the tags when HW tags KASAN is enabled.
> >
> > Does KASAN_SW_TAGS work together with MTE?
>
> Yes, it works fine. One of my usual kernel patch tests runs an
> MTE-utilizing userspace program under a kernel with KASAN_SW_TAGS.
>
> > In theory they should but I
> > wonder whether we have other places calling page_kasan_tag_reset()
> > without the kasan_hw_tags_enabled() check.
>
> It's unclear to me whether any of the other references are
> specifically related to KASAN_HW_TAGS or not. Because KASAN_SW_TAGS
> also uses all-ones as a match-all tag, I wouldn't expect calling
> page_kasan_tag_reset() to cause any problems aside from false
> negatives.

All the other page_kasan_tag_reset() are related to both SW and HW_TAGS.