From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75313E7716E for ; Wed, 4 Dec 2024 15:08:32 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9A1956B007B; Wed, 4 Dec 2024 10:08:31 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 950256B0083; Wed, 4 Dec 2024 10:08:31 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 83F436B0085; Wed, 4 Dec 2024 10:08:31 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 657D56B007B for ; Wed, 4 Dec 2024 10:08:31 -0500 (EST) Received: from smtpin17.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id D1FEA1C7E06 for ; Wed, 4 Dec 2024 15:08:30 +0000 (UTC) X-FDA: 82857606930.17.CD7311F Received: from out-188.mta0.migadu.com (out-188.mta0.migadu.com [91.218.175.188]) by imf12.hostedemail.com (Postfix) with ESMTP id 9633A4000E for ; Wed, 4 Dec 2024 15:08:22 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=L5qS+xXK; spf=pass (imf12.hostedemail.com: domain of hao.ge@linux.dev designates 91.218.175.188 as permitted sender) smtp.mailfrom=hao.ge@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1733324893; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=UeqDwe7OfzX6pXC9ysM09lnzx5uDn8pHvrsJtH2QnXA=; b=vQ9KvEO/d1VVMX5Z+T3gXg49ZN8ouo76osLeTnJi5T63dwPEXd+s9PgNMfQH7OoOnv9Vip ZHZLDiFayzGsrdfBEzTMSAOKbBxMtl6L3k6PSpb5sODmP0Pu2m38WrPXReNpIBNaziYRew Lg4M7N4iVqUkKWpDYFF7mJwIXKDynaU= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=pass header.d=linux.dev header.s=key1 header.b=L5qS+xXK; spf=pass (imf12.hostedemail.com: domain of hao.ge@linux.dev designates 91.218.175.188 as permitted sender) smtp.mailfrom=hao.ge@linux.dev; dmarc=pass (policy=none) header.from=linux.dev ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1733324893; a=rsa-sha256; cv=none; b=3TLofIeYVehQNyd7RZYmg+pRVjDpN+IPMdWhomoPCfNovwjce++SjIWX42wo8XEwanQH2v vg9YtkM8FhEXife5lm9xjb46aJJp2tmiGYkTUxJf78icyCZto9ZP/BiUdy1XecwnBCHxS2 Nto3esTRLNwLE/W1o4fiYZGJn9/J7Vg= Message-ID: DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1733324906; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=UeqDwe7OfzX6pXC9ysM09lnzx5uDn8pHvrsJtH2QnXA=; b=L5qS+xXKRvEZygB5GjsCTkhYyYlvZEItOvISPIf+yQZl0ICxWVNAhOyLsfAAvXD//B6gV1 rB3hbV0Dqmr0xY9hWUPiZz90UAi0a3knBmMZB1HNy0OIC2ofZKtNvsnyhHnu1MiIbcbIrL z9tcW2YbG138sGzRQwd7Cbf30Yswgao= Date: Wed, 4 Dec 2024 23:07:35 +0800 MIME-Version: 1.0 Subject: Re: [PATCH v2] mm/alloc_tag: fix vm_module_tags_populate's KASAN poisoning logic To: Suren Baghdasaryan Cc: kent.overstreet@linux.dev, akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, Hao Ge References: <20241204075248.384215-1-hao.ge@linux.dev> <20241204083448.387862-1-hao.ge@linux.dev> X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Hao Ge In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT X-Rspamd-Server: rspam06 X-Rspamd-Queue-Id: 9633A4000E X-Rspam-User: X-Stat-Signature: kr4idkko17zxbiz6kadiuu183ftx999j X-HE-Tag: 1733324902-5092 X-HE-Meta: U2FsdGVkX1/+pycOHzohUfjUkAiIAjpCLnWv8sKALSa/s89O7BWLt0SJyYiJGlidZH09qIC5kCFA14WVtEetQrCw+w6Z0Sip7seONXdqB6r9TG4jOArNBOlq2kQzDbRBs0Z6vm1moKZd4WVZoJluCdbr2pzzJ/L372ZwMe5HDMq1vY38Zu8BfF7zn9bSvEohuA1KQmxLFiI8mqH+hL5rPML8FT9EcQf+Yf3qMKQNWyQr0Ham6UfkzKEsj/+ybhL3aDcdd+QAYkMeXdH9/O+I7eB9GwHMLFMvj/YApO/TV2aeRGZnhz+GtXlwYsqg/IXAevAo0JiLJdJchbskYuLw5ZDfxv+bp88qLWMw2q0n38RExJD5JKS2wm46BTFKn9g5W4SBiStu2zPWLnVt64NQ3W9can3OA3tTASvmTasY6JT5J6vSc08zPXJSCaWBKI4wZ8rgYd6sT3/qD/cfnSC1/qOGXA//+pPrCdFwPAnXjwSFVSiU6HnNYIPFGdEbUdjr1YR57MC3Elgh0lJMkK/vbqWM0ld6kKdXpXwCa8n1BwT4D3VTqH8mpg5FADGaDOTRSn+b5ntR5IllR0DLS4BuzbHceHixNWwJLXPxG0cMaZcjv+VstxJXEFo5gEJPp4n8t+3dPr+0NN6mXmuyls4E9hDuoqjDR5VACYxUYWkcJSprU2Fc4ZrbKT3DgbJJ0AtPpmGmd6PHQP3ONa8G/wllof8coScKQH9ab7bsRpSUGXzJdb5qXgGubBm5jALAh6tTfvTTb9WyjYwa85XwVsa5f9KE7pS5rBZMJ4SeZcss79IQQ8h7NM+BHu9pK/avOugioKKsUsrvRkpolvIOOTNNx+1AqEvTjzrcXmDRegtUb4b9zfM6HKECES4RDICZgzJ+HLoQMVzEtAvI/AB0lFXtAVMfJ5pqSDW7NTan1Cx/wUUckIG9ujwllOsgTCoW46qqngAyxC/T6NHpLOlLhq+ Ijf49OxT lLnvfURd0GfjDUTJtd4ElYuphkdaBwanUD+YNwS3F1kx8Z9rpndkJJfSUMaaeuGz61ODQmTruthq/nM1Ftv5TCsT6Pdz774EpZ9C+mHfP4sqtRwYJU1snx7fOtmYXmv8Oen+F62Ff2l+mje/neJRKwCUZkCXB9L03qqTvWQ624q8YZsinUIhisJiEUeeP6mS9aoglafJnQqHOC5P87I/yRoB464aZZZRwVKn2 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi Suren Thank you for your review. On 12/4/24 22:39, Suren Baghdasaryan wrote: > On Wed, Dec 4, 2024 at 12:35 AM Hao Ge wrote: >> From: Hao Ge >> >> After merge commit 233e89322cbe ("alloc_tag: >> fix module allocation tags populated area calculation"), >> We still encountered a KASAN bug. >> >> This is because we have only actually performed >> page allocation and address mapping here. >> we need to unpoisoned portions of underlying memory. >> >> Because we have a change in the size here,we need to >> re-annotate poisoned and unpoisoned portions of underlying memory >> according to the new size. >> >> Here is the log for KASAN: >> >> [ 5.041171][ T1] ================================================================== >> [ 5.042047][ T1] BUG: KASAN: vmalloc-out-of-bounds in move_module+0x2c0/0x708 >> [ 5.042723][ T1] Write of size 240 at addr ffff80007e510000 by task systemd/1 >> [ 5.043412][ T1] >> [ 5.043523][ T72] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:01.1/0000:02:001 >> [ 5.043614][ T1] CPU: 0 UID: 0 PID: 1 Comm: systemd Not tainted 6.13.0-rc1+ #28 >> [ 5.045560][ T1] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 >> [ 5.046328][ T1] Call trace: >> [ 5.046670][ T1] show_stack+0x20/0x38 (C) >> [ 5.047127][ T1] dump_stack_lvl+0x80/0xf8 >> [ 5.047533][ T1] print_address_description.constprop.0+0x58/0x358 >> [ 5.048092][ T72] hid-generic 0003:0627:0001.0001: input,hidraw0: USB HID v0.01 Mouse [QEMU 0 >> [ 5.048126][ T1] print_report+0xb0/0x280 >> [ 5.049682][ T1] kasan_report+0xb8/0x108 >> [ 5.050170][ T1] kasan_check_range+0xe8/0x190 >> [ 5.050685][ T1] memcpy+0x58/0xa0 >> [ 5.051135][ T1] move_module+0x2c0/0x708 >> [ 5.051586][ T1] layout_and_allocate.constprop.0+0x308/0x5b8 >> [ 5.052219][ T1] load_module+0x134/0x16c8 >> [ 5.052671][ T1] init_module_from_file+0xdc/0x138 >> [ 5.053193][ T1] idempotent_init_module+0x344/0x600 >> [ 5.053742][ T1] __arm64_sys_finit_module+0xbc/0x150 >> [ 5.054289][ T1] invoke_syscall+0xd4/0x258 >> [ 5.054749][ T1] el0_svc_common.constprop.0+0xb4/0x240 >> [ 5.055319][ T1] do_el0_svc+0x48/0x68 >> [ 5.055743][ T1] el0_svc+0x40/0xe0 >> [ 5.056142][ T1] el0t_64_sync_handler+0x10c/0x138 >> [ 5.056658][ T1] el0t_64_sync+0x1ac/0x1b0 >> >> Fixes: 233e89322cbe ("alloc_tag: fix module allocation tags populated area calculation") >> Signed-off-by: Hao Ge > Thanks for the fix! > >> --- >> v2: Add comments to kasan_unpoison_vmalloc like other places. >> >> commit 233e89322cbe ("alloc_tag: fix module allocation >> tags populated area calculation") is currently in the >> mm-hotfixes-unstable branch, so this patch is >> developed based on the mm-hotfixes-unstable branch. >> --- >> lib/alloc_tag.c | 13 +++++++++++++ >> 1 file changed, 13 insertions(+) >> >> diff --git a/lib/alloc_tag.c b/lib/alloc_tag.c >> index 4ee6caa6d2da..f885b3f3af0e 100644 >> --- a/lib/alloc_tag.c >> +++ b/lib/alloc_tag.c >> @@ -421,7 +421,20 @@ static int vm_module_tags_populate(void) >> __free_page(next_page[i]); >> return -ENOMEM; >> } >> + >> + kasan_poison_vmalloc((void *)module_tags.start_addr, >> + vm_module_tags->nr_pages << PAGE_SHIFT); >> + >> vm_module_tags->nr_pages += nr; >> + >> + /* >> + * Mark the pages as accessible, now that they are mapped. >> + * With hardware tag-based KASAN, marking is skipped for >> + * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc(). >> + */ >> + kasan_unpoison_vmalloc((void *)module_tags.start_addr, >> + vm_module_tags->nr_pages << PAGE_SHIFT, >> + KASAN_VMALLOC_PROT_NORMAL); > Instead of poisoning [module_tags.start_addr, > vm_module_tags->nr_pages], incrementing vm_module_tags->nr_pages and > the unpoisoning [module_tags.start_addr, vm_module_tags->nr_pages] > could we simply poisons the additional area like this: > > kasan_unpoison_vmalloc((void *)module_tags.start_addr + > (vm_module_tags->nr_pages << PAGE_SHIFT), > nr << PAGE_SHIFT, > KASAN_VMALLOC_PROT_NORMAL); > vm_module_tags->nr_pages += nr; > ? I had considered making such modifications earlier. But considering the following situation, A module tags spans across the regions of [module_tags.start_addr, vm_module_tags->nr_pages] and [module_tags.start_addr + vm_module_tags->nr_pages, ...]. It may result in false positives for out-of-bounds errors. >> } >> >> return 0; >> -- >> 2.25.1 >>