| Message ID | 1965508bcbec62699715d32bef91628ef55b4b44.1610553774.git.andreyknvl@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | kasan: fixes for 5.11-rc | expand |
On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > Fix up the pointer tag before calling kasan_report. > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > --- > arch/arm64/mm/fault.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > index 3c40da479899..a218f6f2fdc8 100644 > --- a/arch/arm64/mm/fault.c > +++ b/arch/arm64/mm/fault.c > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > { > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > + /* The format of KASAN tags is 0xF<x>. */ > + addr |= (0xF0UL << MTE_TAG_SHIFT); Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this was added, the only tag faults were generated for user addresses. Anyway, I'd rather fix it in there based on bit 55, something like (only compile-tested): diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 3c40da479899..2b71079d2d32 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, struct pt_regs *regs) { /* - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag - * check faults. Mask them out now so that userspace doesn't see them. + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN + * for tag check faults. Set them to the corresponding bits in the + * untagged address. */ - far &= (1UL << 60) - 1; + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; do_bad_area(far, esr, regs); return 0; }
On Wed, Jan 13, 2021 at 5:54 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > Fix up the pointer tag before calling kasan_report. > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > --- > > arch/arm64/mm/fault.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > index 3c40da479899..a218f6f2fdc8 100644 > > --- a/arch/arm64/mm/fault.c > > +++ b/arch/arm64/mm/fault.c > > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > > { > > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > > > + /* The format of KASAN tags is 0xF<x>. */ > > + addr |= (0xF0UL << MTE_TAG_SHIFT); > > Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this > was added, the only tag faults were generated for user addresses. > > Anyway, I'd rather fix it in there based on bit 55, something like (only > compile-tested): > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > index 3c40da479899..2b71079d2d32 100644 > --- a/arch/arm64/mm/fault.c > +++ b/arch/arm64/mm/fault.c > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > struct pt_regs *regs) > { > /* > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > - * check faults. Mask them out now so that userspace doesn't see them. > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > + * for tag check faults. Set them to the corresponding bits in the > + * untagged address. > */ > - far &= (1UL << 60) - 1; > + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; > do_bad_area(far, esr, regs); > return 0; > } Sounds good, will do in v3, thanks!
On Fri, Jan 15, 2021 at 02:12:24PM +0100, Andrey Konovalov wrote: > On Wed, Jan 13, 2021 at 5:54 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > > > Fix up the pointer tag before calling kasan_report. > > > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > > > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > > --- > > > arch/arm64/mm/fault.c | 2 ++ > > > 1 file changed, 2 insertions(+) > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > index 3c40da479899..a218f6f2fdc8 100644 > > > --- a/arch/arm64/mm/fault.c > > > +++ b/arch/arm64/mm/fault.c > > > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > > > { > > > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > > > > > + /* The format of KASAN tags is 0xF<x>. */ > > > + addr |= (0xF0UL << MTE_TAG_SHIFT); > > > > Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this > > was added, the only tag faults were generated for user addresses. > > > > Anyway, I'd rather fix it in there based on bit 55, something like (only > > compile-tested): > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > index 3c40da479899..2b71079d2d32 100644 > > --- a/arch/arm64/mm/fault.c > > +++ b/arch/arm64/mm/fault.c > > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > > struct pt_regs *regs) > > { > > /* > > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > > - * check faults. Mask them out now so that userspace doesn't see them. > > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > > + * for tag check faults. Set them to the corresponding bits in the > > + * untagged address. > > */ > > - far &= (1UL << 60) - 1; > > + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; > > do_bad_area(far, esr, regs); > > return 0; > > } > > Sounds good, will do in v3, thanks! I wonder if this one gives the same result (so please check): far = u64_replace_bits(untagged_addr(far), far, MTE_TAG_MASK); (defined in linux/bitfield.h)
On Fri, Jan 15, 2021 at 4:07 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Fri, Jan 15, 2021 at 02:12:24PM +0100, Andrey Konovalov wrote: > > On Wed, Jan 13, 2021 at 5:54 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > > > On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > > > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > > > > > Fix up the pointer tag before calling kasan_report. > > > > > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > > > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > > > > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > > > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > > > --- > > > > arch/arm64/mm/fault.c | 2 ++ > > > > 1 file changed, 2 insertions(+) > > > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > > index 3c40da479899..a218f6f2fdc8 100644 > > > > --- a/arch/arm64/mm/fault.c > > > > +++ b/arch/arm64/mm/fault.c > > > > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > > > > { > > > > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > > > > > > > + /* The format of KASAN tags is 0xF<x>. */ > > > > + addr |= (0xF0UL << MTE_TAG_SHIFT); > > > > > > Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this > > > was added, the only tag faults were generated for user addresses. > > > > > > Anyway, I'd rather fix it in there based on bit 55, something like (only > > > compile-tested): > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > index 3c40da479899..2b71079d2d32 100644 > > > --- a/arch/arm64/mm/fault.c > > > +++ b/arch/arm64/mm/fault.c > > > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > > > struct pt_regs *regs) > > > { > > > /* > > > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > > > - * check faults. Mask them out now so that userspace doesn't see them. > > > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > > > + * for tag check faults. Set them to the corresponding bits in the > > > + * untagged address. > > > */ > > > - far &= (1UL << 60) - 1; > > > + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; > > > do_bad_area(far, esr, regs); > > > return 0; > > > } > > > > Sounds good, will do in v3, thanks! > > I wonder if this one gives the same result (so please check): > > far = u64_replace_bits(untagged_addr(far), far, MTE_TAG_MASK); > > (defined in linux/bitfield.h) No, it zeroes out the tag. Not sure why. I took a brief look at the implementation and didn't get how it's supposed to work - too much bit trickery.
On Wed, Jan 13, 2021 at 5:54 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > Fix up the pointer tag before calling kasan_report. > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > --- > > arch/arm64/mm/fault.c | 2 ++ > > 1 file changed, 2 insertions(+) > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > index 3c40da479899..a218f6f2fdc8 100644 > > --- a/arch/arm64/mm/fault.c > > +++ b/arch/arm64/mm/fault.c > > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > > { > > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > > > + /* The format of KASAN tags is 0xF<x>. */ > > + addr |= (0xF0UL << MTE_TAG_SHIFT); > > Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this > was added, the only tag faults were generated for user addresses. > > Anyway, I'd rather fix it in there based on bit 55, something like (only > compile-tested): > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > index 3c40da479899..2b71079d2d32 100644 > --- a/arch/arm64/mm/fault.c > +++ b/arch/arm64/mm/fault.c > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > struct pt_regs *regs) > { > /* > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > - * check faults. Mask them out now so that userspace doesn't see them. > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > + * for tag check faults. Set them to the corresponding bits in the > + * untagged address. > */ > - far &= (1UL << 60) - 1; > + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; > do_bad_area(far, esr, regs); > return 0; > } BTW, we can do "untagged_addr(far) | (far & MTE_TAG_MASK)" here, as untagged_addr() doesn't change kernel pointers.
On Fri, Jan 15, 2021 at 05:30:40PM +0100, Andrey Konovalov wrote: > On Wed, Jan 13, 2021 at 5:54 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > > > Fix up the pointer tag before calling kasan_report. > > > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > > > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > > --- > > > arch/arm64/mm/fault.c | 2 ++ > > > 1 file changed, 2 insertions(+) > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > index 3c40da479899..a218f6f2fdc8 100644 > > > --- a/arch/arm64/mm/fault.c > > > +++ b/arch/arm64/mm/fault.c > > > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > > > { > > > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > > > > > + /* The format of KASAN tags is 0xF<x>. */ > > > + addr |= (0xF0UL << MTE_TAG_SHIFT); > > > > Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this > > was added, the only tag faults were generated for user addresses. > > > > Anyway, I'd rather fix it in there based on bit 55, something like (only > > compile-tested): > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > index 3c40da479899..2b71079d2d32 100644 > > --- a/arch/arm64/mm/fault.c > > +++ b/arch/arm64/mm/fault.c > > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > > struct pt_regs *regs) > > { > > /* > > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > > - * check faults. Mask them out now so that userspace doesn't see them. > > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > > + * for tag check faults. Set them to the corresponding bits in the > > + * untagged address. > > */ > > - far &= (1UL << 60) - 1; > > + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; > > do_bad_area(far, esr, regs); > > return 0; > > } > > BTW, we can do "untagged_addr(far) | (far & MTE_TAG_MASK)" here, as > untagged_addr() doesn't change kernel pointers. untagged_addr() does change tagged kernel pointers, it sign-extends from bit 55. So the top byte becomes 0xff and you can no longer or the tag bits in.
On Fri, Jan 15, 2021 at 5:56 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Fri, Jan 15, 2021 at 05:30:40PM +0100, Andrey Konovalov wrote: > > On Wed, Jan 13, 2021 at 5:54 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > > > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > > > > > Fix up the pointer tag before calling kasan_report. > > > > > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > > > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > > > > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > > > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > > > --- > > > > arch/arm64/mm/fault.c | 2 ++ > > > > 1 file changed, 2 insertions(+) > > > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > > index 3c40da479899..a218f6f2fdc8 100644 > > > > --- a/arch/arm64/mm/fault.c > > > > +++ b/arch/arm64/mm/fault.c > > > > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > > > > { > > > > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > > > > > > > + /* The format of KASAN tags is 0xF<x>. */ > > > > + addr |= (0xF0UL << MTE_TAG_SHIFT); > > > > > > Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this > > > was added, the only tag faults were generated for user addresses. > > > > > > Anyway, I'd rather fix it in there based on bit 55, something like (only > > > compile-tested): > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > index 3c40da479899..2b71079d2d32 100644 > > > --- a/arch/arm64/mm/fault.c > > > +++ b/arch/arm64/mm/fault.c > > > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > > > struct pt_regs *regs) > > > { > > > /* > > > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > > > - * check faults. Mask them out now so that userspace doesn't see them. > > > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > > > + * for tag check faults. Set them to the corresponding bits in the > > > + * untagged address. > > > */ > > > - far &= (1UL << 60) - 1; > > > + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; > > > do_bad_area(far, esr, regs); > > > return 0; > > > } > > > > BTW, we can do "untagged_addr(far) | (far & MTE_TAG_MASK)" here, as > > untagged_addr() doesn't change kernel pointers. > > untagged_addr() does change tagged kernel pointers, it sign-extends from > bit 55. So the top byte becomes 0xff and you can no longer or the tag > bits in. That's __untagged_addr(), untagged_addr() keeps the bits for kernel pointers as of 597399d0cb91.
On Fri, Jan 15, 2021 at 06:00:36PM +0100, Andrey Konovalov wrote: > On Fri, Jan 15, 2021 at 5:56 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > On Fri, Jan 15, 2021 at 05:30:40PM +0100, Andrey Konovalov wrote: > > > On Wed, Jan 13, 2021 at 5:54 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > > > > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > > > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > > > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > > > > > > > Fix up the pointer tag before calling kasan_report. > > > > > > > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > > > > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > > > > > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > > > > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > > > > --- > > > > > arch/arm64/mm/fault.c | 2 ++ > > > > > 1 file changed, 2 insertions(+) > > > > > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > > > index 3c40da479899..a218f6f2fdc8 100644 > > > > > --- a/arch/arm64/mm/fault.c > > > > > +++ b/arch/arm64/mm/fault.c > > > > > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > > > > > { > > > > > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > > > > > > > > > + /* The format of KASAN tags is 0xF<x>. */ > > > > > + addr |= (0xF0UL << MTE_TAG_SHIFT); > > > > > > > > Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this > > > > was added, the only tag faults were generated for user addresses. > > > > > > > > Anyway, I'd rather fix it in there based on bit 55, something like (only > > > > compile-tested): > > > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > > index 3c40da479899..2b71079d2d32 100644 > > > > --- a/arch/arm64/mm/fault.c > > > > +++ b/arch/arm64/mm/fault.c > > > > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > > > > struct pt_regs *regs) > > > > { > > > > /* > > > > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > > > > - * check faults. Mask them out now so that userspace doesn't see them. > > > > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > > > > + * for tag check faults. Set them to the corresponding bits in the > > > > + * untagged address. > > > > */ > > > > - far &= (1UL << 60) - 1; > > > > + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; > > > > do_bad_area(far, esr, regs); > > > > return 0; > > > > } > > > > > > BTW, we can do "untagged_addr(far) | (far & MTE_TAG_MASK)" here, as > > > untagged_addr() doesn't change kernel pointers. > > > > untagged_addr() does change tagged kernel pointers, it sign-extends from > > bit 55. So the top byte becomes 0xff and you can no longer or the tag > > bits in. > > That's __untagged_addr(), untagged_addr() keeps the bits for kernel > pointers as of 597399d0cb91. Ah, you are right. In this case I think we should use __untagged_addr() above. Even if the tag check fault happened on a kernel address, bits 63:60 are still unknown.
On Fri, Jan 15, 2021 at 6:06 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Fri, Jan 15, 2021 at 06:00:36PM +0100, Andrey Konovalov wrote: > > On Fri, Jan 15, 2021 at 5:56 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > > > On Fri, Jan 15, 2021 at 05:30:40PM +0100, Andrey Konovalov wrote: > > > > On Wed, Jan 13, 2021 at 5:54 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > > > > On Wed, Jan 13, 2021 at 05:03:30PM +0100, Andrey Konovalov wrote: > > > > > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > > > > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > > > > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > > > > > > > > > Fix up the pointer tag before calling kasan_report. > > > > > > > > > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > > > > > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > > > > > > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > > > > > > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> > > > > > > --- > > > > > > arch/arm64/mm/fault.c | 2 ++ > > > > > > 1 file changed, 2 insertions(+) > > > > > > > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > > > > index 3c40da479899..a218f6f2fdc8 100644 > > > > > > --- a/arch/arm64/mm/fault.c > > > > > > +++ b/arch/arm64/mm/fault.c > > > > > > @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, > > > > > > { > > > > > > bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; > > > > > > > > > > > > + /* The format of KASAN tags is 0xF<x>. */ > > > > > > + addr |= (0xF0UL << MTE_TAG_SHIFT); > > > > > > > > > > Ah, I see, that top 4 bits are zeroed by do_tag_check_fault(). When this > > > > > was added, the only tag faults were generated for user addresses. > > > > > > > > > > Anyway, I'd rather fix it in there based on bit 55, something like (only > > > > > compile-tested): > > > > > > > > > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > > > > > index 3c40da479899..2b71079d2d32 100644 > > > > > --- a/arch/arm64/mm/fault.c > > > > > +++ b/arch/arm64/mm/fault.c > > > > > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > > > > > struct pt_regs *regs) > > > > > { > > > > > /* > > > > > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > > > > > - * check faults. Mask them out now so that userspace doesn't see them. > > > > > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > > > > > + * for tag check faults. Set them to the corresponding bits in the > > > > > + * untagged address. > > > > > */ > > > > > - far &= (1UL << 60) - 1; > > > > > + far = (untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK) ; > > > > > do_bad_area(far, esr, regs); > > > > > return 0; > > > > > } > > > > > > > > BTW, we can do "untagged_addr(far) | (far & MTE_TAG_MASK)" here, as > > > > untagged_addr() doesn't change kernel pointers. > > > > > > untagged_addr() does change tagged kernel pointers, it sign-extends from > > > bit 55. So the top byte becomes 0xff and you can no longer or the tag > > > bits in. > > > > That's __untagged_addr(), untagged_addr() keeps the bits for kernel > > pointers as of 597399d0cb91. > > Ah, you are right. In this case I think we should use __untagged_addr() > above. Even if the tag check fault happened on a kernel address, bits > 63:60 are still unknown. Yeah, I keep forgetting about [__]untagged_addr() too. Maybe we need better names? Like untagged_addr() and untagged_addr_ttbr0()? Anyway, I'll do the explicit calculation with __untagged_addr() in the next version. Thanks!
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 3c40da479899..a218f6f2fdc8 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -304,6 +304,8 @@ static void report_tag_fault(unsigned long addr, unsigned int esr, { bool is_write = ((esr & ESR_ELx_WNR) >> ESR_ELx_WNR_SHIFT) != 0; + /* The format of KASAN tags is 0xF<x>. */ + addr |= (0xF0UL << MTE_TAG_SHIFT); /* * SAS bits aren't set for all faults reported in EL1, so we can't * find out access size.
As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address that is passed to report_tag_fault has pointer tags in the format of 0x0X, while KASAN uses 0xFX format (note the difference in the top 4 bits). Fix up the pointer tag before calling kasan_report. Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- arch/arm64/mm/fault.c | 2 ++ 1 file changed, 2 insertions(+)