Skip to contentSkip to conversation

kasan-vmalloc-only-tag-normal-vmalloc-allocations.patch removed from -mm tree

merged Andrew Morton 1 participant 1 message Mar 25, 2022

lore
Share & tools
lore

Andrew Morton

author tree notice Applied
#0 lore raw

The patch titled
Subject: kasan, vmalloc: only tag normal vmalloc allocations
has been removed from the -mm tree. Its filename was
kasan-vmalloc-only-tag-normal-vmalloc-allocations.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Andrey Konovalov <[email protected]>
Subject: kasan, vmalloc: only tag normal vmalloc allocations

The kernel can use to allocate executable memory. The only supported way to do that is via __vmalloc_node_range() with the executable bit set in the prot argument. (vmap() resets the bit via pgprot_nx()).

Once tag-based KASAN modes start tagging vmalloc allocations, executing code from such allocations will lead to the PC register getting a tag, which is not tolerated by the kernel.

Only tag the allocations for normal kernel pages.

[[email protected]: pass KASAN_VMALLOC_PROT_NORMAL to kasan_unpoison_vmalloc()]
Link https://lkml.kernel.org/r/9230ca3d3e40ffca041c133a524191fd71969a8d.1646233925.git.andreyknvl@google.com open here
[[email protected]: support tagged vmalloc mappings]
Link https://lkml.kernel.org/r/2f6605e3a358cf64d73a05710cb3da356886ad29.1646233925.git.andreyknvl@google.com open here
[[email protected]: don't unintentionally disabled poisoning]
Link https://lkml.kernel.org/r/de4587d6a719232e83c760113e46ed2d4d8da61e.1646757322.git.andreyknvl@google.com open here
Link https://lkml.kernel.org/r/fbfd9939a4dc375923c9a5c6b9e7ab05c26b8c6b.1643047180.git.andreyknvl@google.com open here
Signed-off-by Andrey Konovalov <[email protected]>
Acked-by Marco Elver <[email protected]>
Cc Alexander Potapenko <[email protected]>
Cc Andrey Ryabinin <[email protected]>
Cc Catalin Marinas <[email protected]>
Cc Dmitry Vyukov <[email protected]>
Cc Evgenii Stepanov <[email protected]>
Cc Mark Rutland <[email protected]>
Cc Peter Collingbourne <[email protected]>
Cc Vincenzo Frascino <[email protected]>
Cc Will Deacon <[email protected]>
Signed-off-by Andrew Morton <[email protected]>

---

 include/linux/kasan.h |    7 +++--
 kernel/scs.c          |   12 ++++++---
 mm/kasan/hw_tags.c    |    7 +++++
 mm/kasan/shadow.c     |    8 ++++++
 mm/vmalloc.c          |   49 +++++++++++++++++++++++-----------------
 5 files changed, 56 insertions(+), 27 deletions(-)
include/linux/kasan.h renamed from include/linux/kasan.h~kasan-vmalloc-only-tag-normal-vmalloc-allocations +4 -3
@@ -28,9 +28,10 @@ struct kunit_kasan_expectation {
 
 typedef unsigned int __bitwise kasan_vmalloc_flags_t;
 
-#define KASAN_VMALLOC_NONE	0x00u
-#define KASAN_VMALLOC_INIT	0x01u
-#define KASAN_VMALLOC_VM_ALLOC	0x02u
+#define KASAN_VMALLOC_NONE		0x00u
+#define KASAN_VMALLOC_INIT		0x01u
+#define KASAN_VMALLOC_VM_ALLOC		0x02u
+#define KASAN_VMALLOC_PROT_NORMAL	0x04u
 
 #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
kernel/scs.c renamed from kernel/scs.c~kasan-vmalloc-only-tag-normal-vmalloc-allocations +8 -4
@@ -32,15 +32,19 @@ static void *__scs_alloc(int node)
 	for (i = 0; i < NR_CACHED_SCS; i++) {
 		s = this_cpu_xchg(scs_cache[i], NULL);
 		if (s) {
-			kasan_unpoison_vmalloc(s, SCS_SIZE, KASAN_VMALLOC_NONE);
+			s = kasan_unpoison_vmalloc(s, SCS_SIZE,
+						   KASAN_VMALLOC_PROT_NORMAL);
 			memset(s, 0, SCS_SIZE);
-			return s;
+			goto out;
 		}
 	}
 
-	return __vmalloc_node_range(SCS_SIZE, 1, VMALLOC_START, VMALLOC_END,
+	s = __vmalloc_node_range(SCS_SIZE, 1, VMALLOC_START, VMALLOC_END,
 				    GFP_SCS, PAGE_KERNEL, 0, node,
 				    __builtin_return_address(0));
+
+out:
+	return kasan_reset_tag(s);
 }
 
 void *scs_alloc(int node)

@@ -78,7 +82,7 @@ void scs_free(void *s)
 		if (this_cpu_cmpxchg(scs_cache[i], 0, s) == NULL)
 			return;
 
-	kasan_unpoison_vmalloc(s, SCS_SIZE, KASAN_VMALLOC_NONE);
+	kasan_unpoison_vmalloc(s, SCS_SIZE, KASAN_VMALLOC_PROT_NORMAL);
 	vfree_atomic(s);
 }
mm/kasan/hw_tags.c renamed from mm/kasan/hw_tags.c~kasan-vmalloc-only-tag-normal-vmalloc-allocations +7 -0
@@ -247,6 +247,13 @@ void *__kasan_unpoison_vmalloc(const voi
 	if (!(flags & KASAN_VMALLOC_VM_ALLOC))
 		return (void *)start;
 
+	/*
+	 * Don't tag executable memory.
+	 * The kernel doesn't tolerate having the PC register tagged.
+	 */
+	if (!(flags & KASAN_VMALLOC_PROT_NORMAL))
+		return (void *)start;
+
 	tag = kasan_random_tag();
 	start = set_tag(start, tag);
mm/kasan/shadow.c renamed from mm/kasan/shadow.c~kasan-vmalloc-only-tag-normal-vmalloc-allocations +8 -0
@@ -488,6 +488,14 @@ void *__kasan_unpoison_vmalloc(const voi
 	if (!is_vmalloc_or_module_addr(start))
 		return (void *)start;
 
+	/*
+	 * Don't tag executable memory with the tag-based mode.
+	 * The kernel doesn't tolerate having the PC register tagged.
+	 */
+	if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) &&
+	    !(flags & KASAN_VMALLOC_PROT_NORMAL))
+		return (void *)start;
+
 	start = set_tag(start, kasan_random_tag());
 	kasan_unpoison(start, size, false);
 	return (void *)start;
mm/vmalloc.c renamed from mm/vmalloc.c~kasan-vmalloc-only-tag-normal-vmalloc-allocations +29 -20

89 lines not on this page · raw message

_

Patches currently in -mm which might be from [email protected] are

stacktrace-add-interface-based-on-shadow-call-stack.patch arm64-scs-save-scs_sp-values-per-cpu-when-switching-stacks.patch arm64-implement-stack_trace_save_shadow.patch kasan-use-stack_trace_save_shadow.patch