| Message ID | fc9e96c022a147120b67056525362abb43b2a0ce.1604531793.git.andreyknvl@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | kasan: add hardware tag-based mode for arm64 | expand |
On Thu, Nov 05, 2020 at 12:18:43AM +0100, Andrey Konovalov wrote: > diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c > index 8f99c65837fd..06ba6c923ab7 100644 > --- a/arch/arm64/kernel/mte.c > +++ b/arch/arm64/kernel/mte.c > @@ -34,6 +34,7 @@ static void mte_sync_page_tags(struct page *page, pte_t *ptep, bool check_swap) > return; > } > > + page_kasan_tag_reset(page); > mte_clear_page_tags(page_address(page)); I think we need an smp_wmb() between setting the flags and clearing the actual tags. If another threads reads page->flags and builds a tagged address out of it (see page_to_virt) there's an address dependency to the actual memory access. However, on the current thread, we don't guarantee that the new page->flags are visible before the tags were updated. > } > > diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c > index 70a71f38b6a9..348f4627da08 100644 > --- a/arch/arm64/mm/copypage.c > +++ b/arch/arm64/mm/copypage.c > @@ -22,6 +22,7 @@ void copy_highpage(struct page *to, struct page *from) > copy_page(kto, kfrom); > > if (system_supports_mte() && test_bit(PG_mte_tagged, &from->flags)) { > + page_kasan_tag_reset(to); > set_bit(PG_mte_tagged, &to->flags); > mte_copy_page_tags(kto, kfrom); Nitpick: move page_kasan_tag_reset() just above mte_copy_page_tags() for consistency with the other places where PG_mte_tagged is set before or after the actual tag setting. > } > diff --git a/arch/arm64/mm/mteswap.c b/arch/arm64/mm/mteswap.c > index c52c1847079c..0e7eccbe598a 100644 > --- a/arch/arm64/mm/mteswap.c > +++ b/arch/arm64/mm/mteswap.c > @@ -53,6 +53,7 @@ bool mte_restore_tags(swp_entry_t entry, struct page *page) > if (!tags) > return false; > > + page_kasan_tag_reset(page); > mte_restore_page_tags(page_address(page), tags); There is another mte_restore_page_tags() caller in hibernate.c. That one doesn't need page_kasan_tag_reset() since the page->flags would have been already restored but please add a comment in that file why its not needed.
Hi Catalin, On 11/5/20 3:59 PM, Catalin Marinas wrote: > On Thu, Nov 05, 2020 at 12:18:43AM +0100, Andrey Konovalov wrote: >> diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c >> index 8f99c65837fd..06ba6c923ab7 100644 >> --- a/arch/arm64/kernel/mte.c >> +++ b/arch/arm64/kernel/mte.c >> @@ -34,6 +34,7 @@ static void mte_sync_page_tags(struct page *page, pte_t *ptep, bool check_swap) >> return; >> } >> >> + page_kasan_tag_reset(page); >> mte_clear_page_tags(page_address(page)); > > I think we need an smp_wmb() between setting the flags and clearing the > actual tags. If another threads reads page->flags and builds a tagged > address out of it (see page_to_virt) there's an address dependency to > the actual memory access. However, on the current thread, we don't > guarantee that the new page->flags are visible before the tags were > updated. > Indeed, and I will add a comment as well to explain why. >> } >> >> diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c >> index 70a71f38b6a9..348f4627da08 100644 >> --- a/arch/arm64/mm/copypage.c >> +++ b/arch/arm64/mm/copypage.c >> @@ -22,6 +22,7 @@ void copy_highpage(struct page *to, struct page *from) >> copy_page(kto, kfrom); >> >> if (system_supports_mte() && test_bit(PG_mte_tagged, &from->flags)) { >> + page_kasan_tag_reset(to); >> set_bit(PG_mte_tagged, &to->flags); >> mte_copy_page_tags(kto, kfrom); > > Nitpick: move page_kasan_tag_reset() just above mte_copy_page_tags() for > consistency with the other places where PG_mte_tagged is set before or > after the actual tag setting. > Fine, I will add it to the next iteration. >> } >> diff --git a/arch/arm64/mm/mteswap.c b/arch/arm64/mm/mteswap.c >> index c52c1847079c..0e7eccbe598a 100644 >> --- a/arch/arm64/mm/mteswap.c >> +++ b/arch/arm64/mm/mteswap.c >> @@ -53,6 +53,7 @@ bool mte_restore_tags(swp_entry_t entry, struct page *page) >> if (!tags) >> return false; >> >> + page_kasan_tag_reset(page); >> mte_restore_page_tags(page_address(page), tags); I just realized based on your comment above that we need smp_wmb() here as well. I will add it with a comment as well. > > There is another mte_restore_page_tags() caller in hibernate.c. That one > doesn't need page_kasan_tag_reset() since the page->flags would have > been already restored but please add a comment in that file why its not > needed. > Yes I will do, I agree on the reasoning, I will report it in the comments.
diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c index 8f99c65837fd..06ba6c923ab7 100644 --- a/arch/arm64/kernel/mte.c +++ b/arch/arm64/kernel/mte.c @@ -34,6 +34,7 @@ static void mte_sync_page_tags(struct page *page, pte_t *ptep, bool check_swap) return; } + page_kasan_tag_reset(page); mte_clear_page_tags(page_address(page)); } diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c index 70a71f38b6a9..348f4627da08 100644 --- a/arch/arm64/mm/copypage.c +++ b/arch/arm64/mm/copypage.c @@ -22,6 +22,7 @@ void copy_highpage(struct page *to, struct page *from) copy_page(kto, kfrom); if (system_supports_mte() && test_bit(PG_mte_tagged, &from->flags)) { + page_kasan_tag_reset(to); set_bit(PG_mte_tagged, &to->flags); mte_copy_page_tags(kto, kfrom); } diff --git a/arch/arm64/mm/mteswap.c b/arch/arm64/mm/mteswap.c index c52c1847079c..0e7eccbe598a 100644 --- a/arch/arm64/mm/mteswap.c +++ b/arch/arm64/mm/mteswap.c @@ -53,6 +53,7 @@ bool mte_restore_tags(swp_entry_t entry, struct page *page) if (!tags) return false; + page_kasan_tag_reset(page); mte_restore_page_tags(page_address(page), tags); return true;