Re: [PATCH v6 31/39] kasan, vmalloc: only tag normal vmalloc allocations

Andrey Konovalov
2022-03-08T15:32:18Z

[-- Attachment #1: Type: text/plain, Size: 1038 bytes --]

On Tue, Mar 8, 2022 at 4:17 PM Vasily Gorbik <gor@linux.ibm.com> wrote:
>
> On Mon, Jan 24, 2022 at 07:05:05PM +0100, andrey.konovalov@linux.dev wrote:
> > From: Andrey Konovalov <andreyknvl@google.com>
> >
> > The kernel can use to allocate executable memory. The only supported way
> > to do that is via __vmalloc_node_range() with the executable bit set in
> > the prot argument. (vmap() resets the bit via pgprot_nx()).
> >
> > Once tag-based KASAN modes start tagging vmalloc allocations, executing
> > code from such allocations will lead to the PC register getting a tag,
> > which is not tolerated by the kernel.
> >
> > Only tag the allocations for normal kernel pages.
> >
> > Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
>
> This breaks s390 and produce huge amount of false positives.
> I haven't been testing linux-next with KASAN for while, now tried it with
> next-20220308 and bisected false positives to this commit.
>
> Any idea what is going wrong here?

Hi Vasily,

Could you try the attached fix?

Thanks!

[-- Attachment #2: s390-kasan-vmalloc.fix --]
[-- Type: application/octet-stream, Size: 536 bytes --]

diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c
index 7272e248db87..693954f771ec 100644
--- a/mm/kasan/shadow.c
+++ b/mm/kasan/shadow.c
@@ -492,7 +492,8 @@ void *__kasan_unpoison_vmalloc(const void *start, unsigned long size,
* Don't tag executable memory.
* The kernel doesn't tolerate having the PC register tagged.
*/
- if (!(flags & KASAN_VMALLOC_PROT_NORMAL))
+ if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) &&
+ !(flags & KASAN_VMALLOC_PROT_NORMAL))
return (void *)start;

start = set_tag(start, kasan_random_tag());

[-- Attachment #3: Type: text/plain, Size: 176 bytes --]