From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2EC97C433FE for ; Wed, 22 Dec 2021 11:11:16 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 32D146B0072; Wed, 22 Dec 2021 06:11:16 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 2DCB06B0073; Wed, 22 Dec 2021 06:11:16 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1F3626B0074; Wed, 22 Dec 2021 06:11:16 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0167.hostedemail.com [216.40.44.167]) by kanga.kvack.org (Postfix) with ESMTP id 127FA6B0072 for ; Wed, 22 Dec 2021 06:11:16 -0500 (EST) Received: from smtpin01.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id BA065181AC9C6 for ; Wed, 22 Dec 2021 11:11:15 +0000 (UTC) X-FDA: 78945163710.01.52BC1D5 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by imf17.hostedemail.com (Postfix) with ESMTP id 9806640024 for ; Wed, 22 Dec 2021 11:11:03 +0000 (UTC) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A55E061947; Wed, 22 Dec 2021 11:11:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 30E0CC36AE5; Wed, 22 Dec 2021 11:11:10 +0000 (UTC) Date: Wed, 22 Dec 2021 11:11:07 +0000 From: Catalin Marinas To: andrey.konovalov@linux.dev Cc: Marco Elver , Alexander Potapenko , Andrew Morton , Andrey Konovalov , Dmitry Vyukov , Andrey Ryabinin , kasan-dev@googlegroups.com, linux-mm@kvack.org, Vincenzo Frascino , Will Deacon , Mark Rutland , linux-arm-kernel@lists.infradead.org, Peter Collingbourne , Evgenii Stepanov , linux-kernel@vger.kernel.org, Andrey Konovalov Subject: Re: [PATCH mm v4 32/39] kasan, arm64: don't tag executable vmalloc allocations Message-ID: References: <85ecef50788a3915a9a8fb52e97207901f27b057.1640036051.git.andreyknvl@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <85ecef50788a3915a9a8fb52e97207901f27b057.1640036051.git.andreyknvl@google.com> X-Rspamd-Queue-Id: 9806640024 X-Stat-Signature: fujp6n3c61d61eykyxebj3yu1suk1ngj Authentication-Results: imf17.hostedemail.com; dkim=none; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=arm.com (policy=none); spf=pass (imf17.hostedemail.com: domain of cmarinas@kernel.org designates 139.178.84.217 as permitted sender) smtp.mailfrom=cmarinas@kernel.org X-Rspamd-Server: rspam11 X-HE-Tag: 1640171463-478583 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Dec 20, 2021 at 11:02:04PM +0100, andrey.konovalov@linux.dev wrote: > From: Andrey Konovalov > > Besides asking vmalloc memory to be executable via the prot argument > of __vmalloc_node_range() (see the previous patch), the kernel can skip > that bit and instead mark memory as executable via set_memory_x(). > > Once tag-based KASAN modes start tagging vmalloc allocations, executing > code from such allocations will lead to the PC register getting a tag, > which is not tolerated by the kernel. > > Generic kernel code typically allocates memory via module_alloc() if > it intends to mark memory as executable. (On arm64 module_alloc() > uses __vmalloc_node_range() without setting the executable bit). > > Thus, reset pointer tags of pointers returned from module_alloc(). > > However, on arm64 there's an exception: the eBPF subsystem. Instead of > using module_alloc(), it uses vmalloc() (via bpf_jit_alloc_exec()) > to allocate its JIT region. > > Thus, reset pointer tags of pointers returned from bpf_jit_alloc_exec(). > > Resetting tags for these pointers results in untagged pointers being > passed to set_memory_x(). This causes conflicts in arithmetic checks > in change_memory_common(), as vm_struct->addr pointer returned by > find_vm_area() is tagged. > > Reset pointer tag of find_vm_area(addr)->addr in change_memory_common(). > > Signed-off-by: Andrey Konovalov > Acked-by: Catalin Marinas