From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-lf0-f71.google.com (mail-lf0-f71.google.com [209.85.215.71]) by kanga.kvack.org (Postfix) with ESMTP id DFCCB6B0534 for ; Tue, 11 Jul 2017 13:03:35 -0400 (EDT) Received: by mail-lf0-f71.google.com with SMTP id 24so1271343lfr.10 for ; Tue, 11 Jul 2017 10:03:35 -0700 (PDT) Received: from mail-lf0-x229.google.com (mail-lf0-x229.google.com. [2a00:1450:4010:c07::229]) by mx.google.com with ESMTPS id s133si211342lja.223.2017.07.11.10.03.34 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 11 Jul 2017 10:03:34 -0700 (PDT) Received: by mail-lf0-x229.google.com with SMTP id h22so5552064lfk.3 for ; Tue, 11 Jul 2017 10:03:34 -0700 (PDT) Date: Tue, 11 Jul 2017 20:03:32 +0300 From: "Kirill A. Shutemov" Subject: Re: KASAN vs. boot-time switching between 4- and 5-level paging Message-ID: <20170711170332.wlaudicepkg35dmm@node.shutemov.name> References: <20170710141713.7aox3edx6o7lrrie@node.shutemov.name> <03A6D7ED-300C-4431-9EB5-67C7A3EA4A2E@amacapital.net> <20170710184704.realchrhzpblqqlk@node.shutemov.name> <20170710212403.7ycczkhhki3vrgac@node.shutemov.name> <20170711103548.mkv5w7dd5gpdenne@node.shutemov.name> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Sender: owner-linux-mm@kvack.org List-ID: To: Andrey Ryabinin Cc: Andy Lutomirski , Dmitry Vyukov , Alexander Potapenko , "Kirill A. Shutemov" , Linus Torvalds , Andrew Morton , "x86@kernel.org" , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Andi Kleen , Dave Hansen , linux-arch , "linux-mm@kvack.org" , LKML , kasan-dev On Tue, Jul 11, 2017 at 07:45:48PM +0300, Andrey Ryabinin wrote: > On 07/11/2017 06:15 PM, Andrey Ryabinin wrote: > > > > I reproduced this, and this is kasan bug: > > > > a??0xffffffff84864897 mov $0xffffffff83f1d0b8,%rdi > > a??0xffffffff8486489e movabs $0xdffffc0000000000,%rax > > a??0xffffffff848648a8 push %rbp > > a??0xffffffff848648a9 mov %rdi,%rdx > > a??0xffffffff848648ac shr $0x3,%rdx > > a??0xffffffff848648b0 mov %rsp,%rbp > > >a??0xffffffff848648b3 mov (%rdx,%rax,1),%al > > > > we crash on the last move which is a read from shadow > > > Ughh, I forgot about phys_base. Thanks! Works for me. Can use your Signed-off-by for a [cleaned up version of your] patch? -- Kirill A. Shutemov -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org