From patchwork Thu Apr 20 21:09:45 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Collingbourne X-Patchwork-Id: 13219184 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 373BDC77B7C for ; Thu, 20 Apr 2023 21:10:04 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 9153F900003; Thu, 20 Apr 2023 17:10:03 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 8C599900002; Thu, 20 Apr 2023 17:10:03 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 78D3C900003; Thu, 20 Apr 2023 17:10:03 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 6478C900002 for ; Thu, 20 Apr 2023 17:10:03 -0400 (EDT) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 3125BC06A7 for ; Thu, 20 Apr 2023 21:10:03 +0000 (UTC) X-FDA: 80703011886.29.2EDB1BB Received: from mail-yb1-f201.google.com (mail-yb1-f201.google.com [209.85.219.201]) by imf03.hostedemail.com (Postfix) with ESMTP id 7BC382001C for ; Thu, 20 Apr 2023 21:10:01 +0000 (UTC) Authentication-Results: imf03.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=Tsfu7N3s; spf=pass (imf03.hostedemail.com: domain of 3KKpBZAMKCKsaNNRZZRWP.NZXWTYfi-XXVgLNV.ZcR@flex--pcc.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=3KKpBZAMKCKsaNNRZZRWP.NZXWTYfi-XXVgLNV.ZcR@flex--pcc.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1682025001; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=z8h/G6KklbzPNQ9jczk/GigGAZbyVMnEE1fOx6AWhk0=; b=rvLOdhpckn6G7Hkhi2o+KoIh3hlZoEGcwI7DGlimmXZNDfz8065tDuFhXh6ilhZ2a9mF1S 3Q4ToSczcT4ciPvc55M05fpKWTgirEgHf2coXfh20X9xpLgjp9UHlkBQxBmYfJPOyk9Orf EUfg8WU9pWkAWGzWATGwBHhR2/qesAo= ARC-Authentication-Results: i=1; imf03.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=Tsfu7N3s; spf=pass (imf03.hostedemail.com: domain of 3KKpBZAMKCKsaNNRZZRWP.NZXWTYfi-XXVgLNV.ZcR@flex--pcc.bounces.google.com designates 209.85.219.201 as permitted sender) smtp.mailfrom=3KKpBZAMKCKsaNNRZZRWP.NZXWTYfi-XXVgLNV.ZcR@flex--pcc.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1682025001; a=rsa-sha256; cv=none; b=e4d2qm5H93aV1aSnEBgAnxAeOkeKM8jghd/we/ukxC8EWpAnpruDg2PZOxrRICeln3gk15 G9VG1+MCaBQkTyocyAPvNRRm02Crex0Un0X6vkYS+jFw5x27YZ50g2E46IUeDE41sEWDbW OXIwB6ZpmlR+vT7Mq+PfuPMudM5KlKc= Received: by mail-yb1-f201.google.com with SMTP id 3f1490d57ef6-b8f46dc51bdso1408196276.3 for ; Thu, 20 Apr 2023 14:10:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1682025000; x=1684617000; h=cc:to:from:subject:mime-version:message-id:date:from:to:cc:subject :date:message-id:reply-to; bh=z8h/G6KklbzPNQ9jczk/GigGAZbyVMnEE1fOx6AWhk0=; b=Tsfu7N3sgp7w1vKNJM9c81o728KVru0BquBWnMQY/b0rj89/J7YDKEvS0qTHAxya8o Dzx598eMlhbDY1y7Vsp1bFSwyCiXLS46NE+zJwUvgWx4/0830zIDiWgClXVhidYUy4g/ 1Sq6rO+y8jIi9tsI/n0Zh+hFlb7z6CCrUyG1u9y4zllMqsoALTUu9MBE54/EGabk62uw m2ulxPu1ZJjFH0tl98CKI+NczD04CyPP9ho0xRDgp6V9CeOW6xN/cH9AwqUanFLKKR5z 3AAdyGky/r2mC1b1VMT5AGyu79grJ75LGGHokL7aJMin3FbAbG9rz6wezsXePG49VskW eyVA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682025000; x=1684617000; h=cc:to:from:subject:mime-version:message-id:date:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=z8h/G6KklbzPNQ9jczk/GigGAZbyVMnEE1fOx6AWhk0=; b=HcgLc3fjj7Kb7c+7FCTw6smy44WK4YgdbM3qMupRLY6Z0LP1UjRD1TOlwoMYwxRkB+ dF79urSACcT7lr+PkiZOdRB0Z3chlhgNqv137Yp0pVAZJrSnPO4LvkE7CBi2EOAxIzIk 6y0MDmGCCbFCLGlS5R+HhbDuGP6I9OD4NTow89FlUe/nMPy4t1VXzsZnPhTiIoEHhL9F TVWfG/cuUn85HQX9r4qFgPbK2lstu15x0nNP03Q/AKe4EdUS1zRaVcek4d95BSeD7mro W3x3kwnBmJfdDOLPWhhFQ6uuP/BQG3f0ytza6WuLHAAXipPcDvO9MWD1bnxyVufck058 IDeA== X-Gm-Message-State: AAQBX9djZeqahNpNeP4Cj/wQBm9+bfWSvSozLRtCTJSyhUrwucyNdEFm wubfsuWnUSSB9Ki2mOa7ROmJsyk= X-Google-Smtp-Source: AKy350aKMhHVQ7iipV9l0amJ4UENFSScgBz98TKfwb3TKU8QIOIzHCJygyFU0PqVoUYPVprNhXly068= X-Received: from pcc-desktop.svl.corp.google.com ([2620:15c:2d3:205:651e:f743:4850:3ce]) (user=pcc job=sendgmr) by 2002:a25:e097:0:b0:b95:4128:bff6 with SMTP id x145-20020a25e097000000b00b954128bff6mr274448ybg.1.1682025000734; Thu, 20 Apr 2023 14:10:00 -0700 (PDT) Date: Thu, 20 Apr 2023 14:09:45 -0700 Message-Id: <20230420210945.2313627-1-pcc@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.40.0.396.gfff15efe05-goog Subject: [PATCH] arm64: Also reset KASAN tag if page is not PG_mte_tagged From: Peter Collingbourne To: catalin.marinas@arm.com, andreyknvl@gmail.com Cc: Peter Collingbourne , " =?utf-8?b?UXVuLXdlaSBMaW4gKA==?= =?utf-8?b?5p6X576k5bS0KQ==?= " , " =?utf-8?b?R3Vhbmd5ZSBZYW5nICjmnajlhYnkuJop?= " , linux-mm@kvack.org, " =?utf-8?b?Q2hpbndlbiBDaGFuZyAo5by16Yym5paHKQ==?= " , kasan-dev@googlegroups.com, ryabinin.a.a@gmail.com, linux-arm-kernel@lists.infradead.org, vincenzo.frascino@arm.com, will@kernel.org, eugenis@google.com, stable@vger.kernel.org X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: 7BC382001C X-Rspam-User: X-Stat-Signature: 6zbbi8tagyonjj6nubkgoq7whkgffh4o X-HE-Tag: 1682025001-822537 X-HE-Meta: U2FsdGVkX18GFJPUrsvuHtmAxty8FUzYfMfvdzS5Pk3zKcQxqQwLA29do5MT8569d2u3rod2dNiyQnYFnoPzgGQoUv5IBr+raThHw7oKsqUQRabtSSsLu31tv7h1w7o0k7zVaLZJTQaz0RCNkSIcemSiX1962Pv1/eEA7PSwKzhox0AS7OlovGdTCYDfuJiuy+ounauMFLSrRVK+I9BMWuehKE7bwnK2uQ6mUz7UbJFbPJUEH2OsnScWOh5aIelH1UQnLeVfi3DccsmFy7g2w/vpPfSEApB+Pgubqdv+teBVEDR5ao4DkvJNwNCy62DNl2ZGF2SIs/bG4CdIfJWg2Nrr6/DJ6y/SREPrQuinMgxYQJCgKCgLGTYuXBdj62qJYi5kUlPo/KrlCamecMqY8Kwv0yDOJBCvhYpHo4R/p6ubx6S9mL++HIkEeXJpnmcOHocEmGUBMycFvyv3UKFgbcwTNSsZMX1OWDhj31BZY8SoQV9Hzs/ZeM2KiiBFkOB+hrQpKTaeUvMjOlttSY3MAKhDsa+OBTTdNVa2pKTVgFbGbfZdJhJ34A9P8IhxleIa3nZFkUfXgaSns4r5EFYqZZGOJWJyr3Cx+dWtbCtY6SXa7YiGdC1BRDWIM/QZIMI3Wu8ZCeA+6zpfYxmiMkeJJLblDBGy4srwHtFMCA/qh3ey/4haJSus4oyS0phnOxbteHxSKj8MTfjpR2BgDW0qQhU6Bz/y/1g69gZ4ZDSqBUMSAO2ZUOu+lnC1+SqxbjvedE00bq7epkwx1WoLfwD64qiO0VnJhynWqHgB7tc+1xFGB55UeVbYy0JgPkWL855/M9kH1RdqsNHE+jPHygHwdm2/BbhlqFy9vXzmiULf7xhbzXa5aBDtz6UeHiGMn2lZQdK4aSM84S+Vr9AskrVVXEfFp8Qwq9BMgDmj6ZlPBRwWY31FKMz9H7Zs04iz5Qzh/gouUiXZY3tm957/iBY +rNsBKGu K7GXAWyJCf8LNbmsFyzZ58NS+5u30C7RwVH1YBxWWVyjk0EmNhdFzDAv97rBMK0t60+xK+mm/kaBnYXq58VstyomF/nCL4Dzm4WW633hnY9SJI1fHSr4w0IXiZ1HjeAqYNSwpuS4oJqrj4WImgeIDIEbXA9gOChV0nILXUtkMAnr3Uw6CDoa/saxnUDZbLcJtO9bwGBINtUgsY5BFgRhGXh4jFv5o0hgN4RtF+PsTAxqjjL5+Tj0+yTeQE6z4pN4uIsalrCWcjVZ+yR4fK7kORdtVwgXJmIIdNlG+8jy4AoMNcHRtyd05uH0neDNtFdVbi6zVEfq6V1/sdtffqmfWKjgHP3fhzPit8lL+QbOu8uOXiv+DW+rZjhXJH4lmIgaCTUOqJRttxKatxyN7aZqbYQ+BQ57fAG+lJmrK/XU3UuP8dw5uaVHq3wBpju/VgjR2BQPdKXJ4s5VSgwbYftambEVWnck6hYLOwsrfPGdReIybDGK++PgKSZAmlBsh8g4RQfjhMSUCFXcGEv9LI7BBDFyItC9WCb7A2n8XpBfytjp1qRb2aqlTRX3t5q+Ts6o1i6kffL+o18dzOOPFyHWH5DT1k8oOC2fPYbK1DLWZ+RFxvNa85CMO8QEv/t63ONmkzHNbsdCp1WZrpSW4pRZ4KlH7I1b2h6LeUBmQnuffg8I1rFBA1xGQdLQoUivtvozFlUcEq5OIKwzMIZczfQXYt3fGbUMM0yZ4xacKoshJg16Uh86HizvUW2shehSnxnLnwWSpj6RGTmPyg1Ri1K2jBZZMM01oZ3GF2oWmNRZk4vK3vtuE+03CX8v5KX5kZ9eA1SNQ X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Consider the following sequence of events: 1) A page in a PROT_READ|PROT_WRITE VMA is faulted. 2) Page migration allocates a page with the KASAN allocator, causing it to receive a non-match-all tag, and uses it to replace the page faulted in 1. 3) The program uses mprotect() to enable PROT_MTE on the page faulted in 1. As a result of step 3, we are left with a non-match-all tag for a page with tags accessible to userspace, which can lead to the same kind of tag check faults that commit e74a68468062 ("arm64: Reset KASAN tag in copy_highpage with HW tags only") intended to fix. The general invariant that we have for pages in a VMA with VM_MTE_ALLOWED is that they cannot have a non-match-all tag. As a result of step 2, the invariant is broken. This means that the fix in the referenced commit was incomplete and we also need to reset the tag for pages without PG_mte_tagged. Fixes: e5b8d9218951 ("arm64: mte: reset the page tag in page->flags") Cc: # 5.15 Link: https://linux-review.googlesource.com/id/I7409cdd41acbcb215c2a7417c1e50d37b875beff Signed-off-by: Peter Collingbourne Reviewed-by: Catalin Marinas --- arch/arm64/mm/copypage.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c index 4aadcfb01754..a7bb20055ce0 100644 --- a/arch/arm64/mm/copypage.c +++ b/arch/arm64/mm/copypage.c @@ -21,9 +21,10 @@ void copy_highpage(struct page *to, struct page *from) copy_page(kto, kfrom); + if (kasan_hw_tags_enabled()) + page_kasan_tag_reset(to); + if (system_supports_mte() && page_mte_tagged(from)) { - if (kasan_hw_tags_enabled()) - page_kasan_tag_reset(to); /* It's a new page, shouldn't have been tagged yet */ WARN_ON_ONCE(!try_page_mte_tagging(to)); mte_copy_page_tags(kto, kfrom);