arm64 KASAN_HW_TAGS panic on non-MTE hardware on 5.12-rc1

DISCUSSION Catalin Marinas 2 participants 6 messages Mar 5, 2021 – Mar 8, 2021 1 message not in the archive

Share & tools

Catalin Marinas

author

2021-03-05 17:13 UTC #0 lore raw

Hi Andrey,

Enabling CONFIG_KASAN_HW_TAGS and running the resulting kernel on non-MTE hardware panics with an undefined STG instruction from mte_set_mem_tag_range():

./scripts/faddr2line vmlinux kasan_unpoison_task_stack+0x18/0x40 kasan_unpoison_task_stack+0x18/0x40:
mte_set_mem_tag_range at arch/arm64/include/asm/mte-kasan.h:71 (inlined by) mte_set_mem_tag_range at arch/arm64/include/asm/mte-kasan.h:56 (inlined by) kasan_unpoison at mm/kasan/kasan.h:363
(inlined by) kasan_unpoison_task_stack at mm/kasan/common.c:72

The full trace:

------------[ cut here ]------------
kernel BUG at arch/arm64/kernel/traps.c:406!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.12.0-rc1-00002-ge76afd1d69f3-dirty #2
pstate: 00000085 (nzcv daIf -PAN -UAO -TCO BTYPE=--)
pc : do_undefinstr+0x2c8/0x2e8
lr : do_undefinstr+0x2d4/0x2e8

sp : ffffc07baeaa3cf0
x29: ffffc07baeaa3cf0 x28: ffffc07baeab3280
x27: ffffc07baeaa9a00 x26: ffffc07baeaa7000
x25: ffffc07baeab3964 x24: ffffc07baeaa9c00
x23: 0000000040000085 x22: ffffc07baed7f0e0
x21: 00000000d9200800 x20: ffffc07baeab3280
x19: ffffc07baeaa3d80 x18: 0000000000000200
x17: 000000000000000b x16: 0000000000007fff
x15: 00000000ffffffff x14: 0000000000000000
x13: 0000000000000048 x12: ffffc07baeab3280
x11: ffff64d0ffc00294 x10: 0000000000000000
x9 : 0000000000000000 x8 : 00000000389fd980
x7 : ffff64d0ffbde5b8 x6 : 0000000000000000
x5 : ffff64d0ffb99880 x4 : ffffc07baeab5710
x3 : ffffc07baed7f0f0 x2 : 0000000000000000
x1 : ffffc07baeab3280 x0 : 0000000040000085

Call trace:
 do_undefinstr+0x2c8/0x2e8
 el1_undef+0x30/0x50
 el1_sync_handler+0x8c/0xc8
 el1_sync+0x70/0x100
 kasan_unpoison_task_stack+0x18/0x40
 sched_init+0x390/0x3f0
 start_kernel+0x2cc/0x540
 0x0
Code: 17ffff8a f9401bf7 17ffffc8 f9001bf7 (d4210000) 
random: get_random_bytes called from print_oops_end_marker+0x2c/0x68 with crng_init=0
---[ end trace c881f708bdfe36c8 ]---

If MTE is not available, I thought we should not end up calling the MTE backend but it seems that kasan expects the backend to skip the undefined instructions.

Does kasan fall back to sw_tags if hw_tags are not available or it just disables kasan altogether?

Signature · 6 lines

Catalin

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Andrey Konovalov

2021-03-05 17:29 UTC #1 lore raw

Quoted 2 lines · Catalin Marinas

Hi Andrey,

Hi Catalin,

Quoted 11 lines

Enabling CONFIG_KASAN_HW_TAGS and running the resulting kernel on non-MTE hardware panics with an undefined STG instruction from mte_set_mem_tag_range():
./scripts/faddr2line vmlinux kasan_unpoison_task_stack+0x18/0x40 kasan_unpoison_task_stack+0x18/0x40:
mte_set_mem_tag_range at arch/arm64/include/asm/mte-kasan.h:71 (inlined by) mte_set_mem_tag_range at arch/arm64/include/asm/mte-kasan.h:56 (inlined by) kasan_unpoison at mm/kasan/kasan.h:363
(inlined by) kasan_unpoison_task_stack at mm/kasan/common.c:72

This is weird. kasan_unpoison_task_stack() is only defined when CONFIG_KASAN_STACK is enabled, which shouldn't be enablable for HW_TAGS.

Are you using the mainline kernel?

Could you share the kernel config that you use?

Quoted 40 lines

The full trace:
------------[ cut here ]------------
kernel BUG at arch/arm64/kernel/traps.c:406!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper Not tainted 5.12.0-rc1-00002-ge76afd1d69f3-dirty #2
pstate: 00000085 (nzcv daIf -PAN -UAO -TCO BTYPE=--)
pc : do_undefinstr+0x2c8/0x2e8
lr : do_undefinstr+0x2d4/0x2e8
sp : ffffc07baeaa3cf0
x29: ffffc07baeaa3cf0 x28: ffffc07baeab3280
x27: ffffc07baeaa9a00 x26: ffffc07baeaa7000
x25: ffffc07baeab3964 x24: ffffc07baeaa9c00
x23: 0000000040000085 x22: ffffc07baed7f0e0
x21: 00000000d9200800 x20: ffffc07baeab3280
x19: ffffc07baeaa3d80 x18: 0000000000000200
x17: 000000000000000b x16: 0000000000007fff
x15: 00000000ffffffff x14: 0000000000000000
x13: 0000000000000048 x12: ffffc07baeab3280
x11: ffff64d0ffc00294 x10: 0000000000000000
x9 : 0000000000000000 x8 : 00000000389fd980
x7 : ffff64d0ffbde5b8 x6 : 0000000000000000
x5 : ffff64d0ffb99880 x4 : ffffc07baeab5710
x3 : ffffc07baed7f0f0 x2 : 0000000000000000
x1 : ffffc07baeab3280 x0 : 0000000040000085
Call trace:
 do_undefinstr+0x2c8/0x2e8
 el1_undef+0x30/0x50
 el1_sync_handler+0x8c/0xc8
 el1_sync+0x70/0x100
 kasan_unpoison_task_stack+0x18/0x40
 sched_init+0x390/0x3f0
 start_kernel+0x2cc/0x540
 0x0
Code: 17ffff8a f9401bf7 17ffffc8 f9001bf7 (d4210000)
random: get_random_bytes called from print_oops_end_marker+0x2c/0x68 with crng_init=0
---[ end trace c881f708bdfe36c8 ]---

Quoted 6 lines

If MTE is not available, I thought we should not end up calling the MTE backend but it seems that kasan expects the backend to skip the undefined instructions.
Does kasan fall back to sw_tags if hw_tags are not available or it just disables kasan altogether?

If the hardware doesn't support HW_TAGS, KASAN should get disabled.

If the compiler doesn't support HW_TAGS, I think KASAN will fall back to GENERIC through oldconfig.

Thanks!

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

A message that is not in the archive (sent off-list or not yet received): [email protected]

Catalin Marinas

author

2021-03-05 17:54 UTC #3 lore raw

Quoted 13 lines · Catalin Marinas

Quoted 12 lines · Andrey Konovalov
Quoted 10 lines · Catalin Marinas
Enabling CONFIG_KASAN_HW_TAGS and running the resulting kernel on non-MTE hardware panics with an undefined STG instruction from mte_set_mem_tag_range():
./scripts/faddr2line vmlinux kasan_unpoison_task_stack+0x18/0x40 kasan_unpoison_task_stack+0x18/0x40:
mte_set_mem_tag_range at arch/arm64/include/asm/mte-kasan.h:71 (inlined by) mte_set_mem_tag_range at arch/arm64/include/asm/mte-kasan.h:56 (inlined by) kasan_unpoison at mm/kasan/kasan.h:363
(inlined by) kasan_unpoison_task_stack at mm/kasan/common.c:72

Quoted 8 lines

Quoted 3 lines
This is weird. kasan_unpoison_task_stack() is only defined when CONFIG_KASAN_STACK is enabled, which shouldn't be enablable for HW_TAGS.
CONFIG_KASAN=y
# CONFIG_KASAN_GENERIC is not set
CONFIG_KASAN_HW_TAGS=y
CONFIG_KASAN_STACK=1

From Kconfig:

config KASAN_STACK

	int
	default 1 if KASAN_STACK_ENABLE || CC_IS_GCC
	default 0

and I use gcc.

Signature · 6 lines

Catalin

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Andrey Konovalov

2021-03-05 18:38 UTC #4 lore raw

Quoted 10 lines · Catalin Marinas

Quoted 9 lines
Quoted 4 lines
This is weird. kasan_unpoison_task_stack() is only defined when CONFIG_KASAN_STACK is enabled, which shouldn't be enablable for HW_TAGS.
CONFIG_KASAN=y
# CONFIG_KASAN_GENERIC is not set
CONFIG_KASAN_HW_TAGS=y
CONFIG_KASAN_STACK=1

Quoted 8 lines

From Kconfig:

config KASAN_STACK

        int
        default 1 if KASAN_STACK_ENABLE || CC_IS_GCC
        default 0

and I use gcc.

Ah, that explains it.

Could you try applying this patch and see if it fixes the issue?

https://patchwork.kernel.org/project/linux-mm/patch/[email protected]/

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Catalin Marinas

author

2021-03-06 12:03 UTC #5 lore raw

Quoted 17 lines · Andrey Konovalov

Quoted 16 lines · Catalin Marinas
Quoted 8 lines
Quoted 3 lines
This is weird. kasan_unpoison_task_stack() is only defined when CONFIG_KASAN_STACK is enabled, which shouldn't be enablable for HW_TAGS.
CONFIG_KASAN=y
# CONFIG_KASAN_GENERIC is not set
CONFIG_KASAN_HW_TAGS=y
CONFIG_KASAN_STACK=1
From Kconfig:
config KASAN_STACK
        int
        default 1 if KASAN_STACK_ENABLE || CC_IS_GCC
        default 0

Quoted 7 lines

Quoted 1 line
and I use gcc.
Ah, that explains it.
Could you try applying this patch and see if it fixes the issue?
https://patchwork.kernel.org/project/linux-mm/patch/[email protected]/

Walter's patches already in -next fix this issue.

Thanks.

Signature · 6 lines

Catalin

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

Andrey Konovalov

2021-03-08 14:58 UTC #6 lore raw

Quoted 21 lines · Catalin Marinas

Quoted 19 lines · Andrey Konovalov
Quoted 17 lines · Catalin Marinas
Quoted 8 lines
Quoted 3 lines
This is weird. kasan_unpoison_task_stack() is only defined when CONFIG_KASAN_STACK is enabled, which shouldn't be enablable for HW_TAGS.
CONFIG_KASAN=y
# CONFIG_KASAN_GENERIC is not set
CONFIG_KASAN_HW_TAGS=y
CONFIG_KASAN_STACK=1
From Kconfig:
config KASAN_STACK
        int
        default 1 if KASAN_STACK_ENABLE || CC_IS_GCC
        default 0
and I use gcc.

Quoted 7 lines

Quoted 5 lines
Ah, that explains it.
Could you try applying this patch and see if it fixes the issue?
https://patchwork.kernel.org/project/linux-mm/patch/[email protected]/
Walter's patches already in -next fix this issue.

Great!

I'll still send a patch as we need the fix in older kernels too.

Thanks for the report!

_______________________________________________
linux-arm-kernel mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel