From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66043C433EF for ; Thu, 2 Dec 2021 14:28:27 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C1A836B0072; Thu, 2 Dec 2021 09:28:16 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id BA1BE6B0073; Thu, 2 Dec 2021 09:28:16 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A1C076B0074; Thu, 2 Dec 2021 09:28:16 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0165.hostedemail.com [216.40.44.165]) by kanga.kvack.org (Postfix) with ESMTP id 8EBDB6B0072 for ; Thu, 2 Dec 2021 09:28:16 -0500 (EST) Received: from smtpin28.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 42A6C1846A707 for ; Thu, 2 Dec 2021 14:28:06 +0000 (UTC) X-FDA: 78873083772.28.CD9C4C0 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) by imf08.hostedemail.com (Postfix) with ESMTP id A3FCD30000AA for ; Thu, 2 Dec 2021 14:28:07 +0000 (UTC) Received: by mail-wr1-f46.google.com with SMTP id l16so60012814wrp.11 for ; Thu, 02 Dec 2021 06:28:05 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=0bMo5owWEWMIAHQEq+ayNoaDPR5E2HoxKytk6h0JhPY=; b=TPi+XE3Oo+N09uSXdVOp7OEyleERqi72ChP0+G0uqZhZshuZxSAfAprKOVRe1GIEqz gRzzEK1xzF09jzf+kPRhI2C0VJo/LRHtaHhvWb9/YOHb8EBkVvu9pY9LiE6Li+lE/7sY 7BuS03jEhWmkch/mmbrMu47CzL9UdkeorBmre8tYVi0wtzohdMJLqO+1tEqqYvXu8k08 UqJ7sGFj4wwjQN6aid7XGc7e8d3ShtTTd9qrwuAHemTFX6OPz6MUmtIzgTVQNVQk6YDf bEl+TwOcQdk31SNEgEPPK2Im7xt5Cq3tp/emUcIPqrkqmYyAEHRv0e5WgRmUrsdNFeQv gT0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=0bMo5owWEWMIAHQEq+ayNoaDPR5E2HoxKytk6h0JhPY=; b=kDweVX+muOpt+nYuSasyjkQi5f0BS5Grk1iyVtLVEpVdfHNqlU6bD+cZRYrTqjZRR6 0d2jq43tXiTF9ii1RtsyR7sH0mbPy7TQduzat9i9wZjk/NyyZbkp0PzrxvCMcI8hmLXx Ov+5eoqCveNNf+5ldawRGJj+4zlTuf83a76ZGsv0anKBU0AmUNYuQamL816S6+bmRnGk 5hCRqVhHW0LbxpKUVOP4OXblOugxaZhOrGqZsH1Ccgw8iTdT7hUPTVyDnUfhJdQ6r43Q cgqcjE2oWWcYx3SMjO+9ZNuyvV666M7+v5xcaHQL7MLbIbFsOqOcsZMUyJYH5lHAQk3h cCSA== X-Gm-Message-State: AOAM533bVaK3BX7fO3MG9Ote3MQP2w3oINfATrflHoQxWa9WdfmO81E7 /TomVHP6LjZpPmOCc4D9/YbLLw== X-Google-Smtp-Source: ABdhPJwOjT3KMKwLy1T16G1ueo5MPcTda4YCBsvgXWbw9NLVsW9gvMLOA03kXSxG0jRiauRt8sfvyQ== X-Received: by 2002:adf:f0c5:: with SMTP id x5mr14116782wro.484.1638455284429; Thu, 02 Dec 2021 06:28:04 -0800 (PST) Received: from elver.google.com ([2a00:79e0:15:13:ddd6:f3c9:b2f0:82f3]) by smtp.gmail.com with ESMTPSA id k37sm2403749wms.21.2021.12.02.06.28.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 02 Dec 2021 06:28:03 -0800 (PST) Date: Thu, 2 Dec 2021 15:27:58 +0100 From: Marco Elver To: andrey.konovalov@linux.dev Cc: Alexander Potapenko , Vincenzo Frascino , Catalin Marinas , Peter Collingbourne , Andrey Konovalov , Dmitry Vyukov , kasan-dev@googlegroups.com, Andrew Morton , linux-mm@kvack.org, Will Deacon , linux-arm-kernel@lists.infradead.org, Evgenii Stepanov , linux-kernel@vger.kernel.org, Andrey Konovalov Subject: Re: [PATCH 21/31] kasan, fork: don't tag stacks allocated with vmalloc Message-ID: References: <4fbc6668845e699bf708aee5c11ad9fd012d4dcd.1638308023.git.andreyknvl@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4fbc6668845e699bf708aee5c11ad9fd012d4dcd.1638308023.git.andreyknvl@google.com> User-Agent: Mutt/2.0.5 (2021-01-21) X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: A3FCD30000AA X-Stat-Signature: w3sx9rwm7ft8urypwako1d7koxua6wex Authentication-Results: imf08.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=TPi+XE3O; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf08.hostedemail.com: domain of elver@google.com designates 209.85.221.46 as permitted sender) smtp.mailfrom=elver@google.com X-HE-Tag: 1638455287-530652 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Nov 30, 2021 at 11:07PM +0100, andrey.konovalov@linux.dev wrote: > From: Andrey Konovalov > > Once tag-based KASAN modes start tagging vmalloc() allocations, > kernel stacks will start getting tagged if CONFIG_VMAP_STACK is enabled. > > Reset the tag of kernel stack pointers after allocation. > > For SW_TAGS KASAN, when CONFIG_KASAN_STACK is enabled, the > instrumentation can't handle the sp register being tagged. > > For HW_TAGS KASAN, there's no instrumentation-related issues. However, > the impact of having a tagged SP pointer needs to be properly evaluated, > so keep it non-tagged for now. Don't VMAP_STACK stacks have guards? So some out-of-bounds would already be caught. What would be the hypothetical benefit of using a tagged stack pointer? Perhaps wildly out-of-bounds accesses derived from stack pointers? I agree that unless we understand the impact of using a tagged stack pointers, it should remain non-tagged for now. > Note, that the memory for the stack allocation still gets tagged to > catch vmalloc-into-stack out-of-bounds accesses. Will the fact it's tagged cause issues for other code? I think kmemleak already untags all addresses it scans for pointers. Anything else? > Signed-off-by: Andrey Konovalov > --- > kernel/fork.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/kernel/fork.c b/kernel/fork.c > index 3244cc56b697..062d1484ef42 100644 > --- a/kernel/fork.c > +++ b/kernel/fork.c > @@ -253,6 +253,7 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node) > * so cache the vm_struct. > */ > if (stack) { > + stack = kasan_reset_tag(stack); > tsk->stack_vm_area = find_vm_area(stack); > tsk->stack = stack; > } > -- > 2.25.1 >