From nobody Fri Oct 3 21:02:27 2025 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 619FA179BD; Mon, 25 Aug 2025 20:31:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756153893; cv=none; b=ZUPYEwG9/IZaxoj7nT9nMRZOZ+4HtNOw81sMOFZHJTovUNEKS3k++P9nCnz7yWopYirQY+AK+TKLoRpZ0fDea31LEsaLKOmA2gJs8izduZNq3NHp4fRUEoIT0qVMLlcL0+fJ8nwMevR4bH/bMHKdxu7QwIDqydbuCOtEIGMinJI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756153893; c=relaxed/simple; bh=JSgqcace1ZHH5nH7cPzoLy1AXwxiMzBjeR3CdVvlZ7Q=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fnFd3AvQifLfIREPa3Mf0G1YKbIsTQIyEKUT7jGRiW8y04tdniiLYVNTvZjM/0dWNVZXl/N6bDq0TpdBDDaOppe7miq/AKvIh+pckGlZJ9zJGU/KV6TYqSkNUXHMh7SMjrN63806c++TyjbouYuX6AuerBCVuEk/uxA8uNnM6q4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=UdaeRrQy; arc=none smtp.client-ip=192.198.163.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="UdaeRrQy" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1756153891; x=1787689891; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=JSgqcace1ZHH5nH7cPzoLy1AXwxiMzBjeR3CdVvlZ7Q=; b=UdaeRrQyLnKKMBgQFJRjXIAqOYwSF2bxCUVCmj/kATSFIdHU6KiVxWmI nmEU5aGNIrYMVQ+IL/xB5/k5C5Y2Khzv4k7OYQvCqOmRw7GWfkNOK+3dz hHghg7Ye/7YilwVPFbtjk8vfRx4E6E8QIQdZe/4aeuVNCK+QH9u/KRn7a BCuwl461b78K7jVSEtQISK+28Nr/gdl1NnZHc3KvPQRmoD2R4M8VFbXcb WCDw5f2cNmF4ebx9KolyBr+bvE9r1vtWALGAW9+yS/VY/eftbFdqErSc/ j5t4yDxMfVrNdtf6ec6HSnqNpuWy/69I88JfLwRZgvYUM3pJlRJwXcxmb w==; X-CSE-ConnectionGUID: iQfxBrPoRYm+1JohU9N2ew== X-CSE-MsgGUID: fICe+YxKRce1t0G+fGIa4g== X-IronPort-AV: E=McAfee;i="6800,10657,11533"; a="68971148" X-IronPort-AV: E=Sophos;i="6.18,214,1751266800"; d="scan'208";a="68971148" Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Aug 2025 13:31:30 -0700 X-CSE-ConnectionGUID: BoQjm7KIRB+2p+yFhmf/bw== X-CSE-MsgGUID: iY6qVZe4QbiO9mWsK80olA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.18,214,1751266800"; d="scan'208";a="169780999" Received: from bergbenj-mobl1.ger.corp.intel.com (HELO wieczorr-mobl1.intel.com) ([10.245.245.6]) by fmviesa008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Aug 2025 13:31:11 -0700 From: Maciej Wieczor-Retman To: sohil.mehta@intel.com, baohua@kernel.org, david@redhat.com, kbingham@kernel.org, weixugc@google.com, Liam.Howlett@oracle.com, alexandre.chartre@oracle.com, kas@kernel.org, mark.rutland@arm.com, trintaeoitogc@gmail.com, axelrasmussen@google.com, yuanchu@google.com, joey.gouly@arm.com, samitolvanen@google.com, joel.granados@kernel.org, graf@amazon.com, vincenzo.frascino@arm.com, kees@kernel.org, ardb@kernel.org, thiago.bauermann@linaro.org, glider@google.com, thuth@redhat.com, kuan-ying.lee@canonical.com, pasha.tatashin@soleen.com, nick.desaulniers+lkml@gmail.com, vbabka@suse.cz, kaleshsingh@google.com, justinstitt@google.com, catalin.marinas@arm.com, alexander.shishkin@linux.intel.com, samuel.holland@sifive.com, dave.hansen@linux.intel.com, corbet@lwn.net, xin@zytor.com, dvyukov@google.com, tglx@linutronix.de, scott@os.amperecomputing.com, jason.andryuk@amd.com, morbo@google.com, nathan@kernel.org, lorenzo.stoakes@oracle.com, mingo@redhat.com, brgerst@gmail.com, kristina.martsenko@arm.com, bigeasy@linutronix.de, luto@kernel.org, jgross@suse.com, jpoimboe@kernel.org, urezki@gmail.com, mhocko@suse.com, ada.coupriediaz@arm.com, hpa@zytor.com, maciej.wieczor-retman@intel.com, leitao@debian.org, peterz@infradead.org, wangkefeng.wang@huawei.com, surenb@google.com, ziy@nvidia.com, smostafa@google.com, ryabinin.a.a@gmail.com, ubizjak@gmail.com, jbohac@suse.cz, broonie@kernel.org, akpm@linux-foundation.org, guoweikang.kernel@gmail.com, rppt@kernel.org, pcc@google.com, jan.kiszka@siemens.com, nicolas.schier@linux.dev, will@kernel.org, andreyknvl@gmail.com, jhubbard@nvidia.com, bp@alien8.de Cc: x86@kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, llvm@lists.linux.dev, linux-kbuild@vger.kernel.org, kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org Subject: [PATCH v5 17/19] mm: Unpoison pcpu chunks with base address tag Date: Mon, 25 Aug 2025 22:24:42 +0200 Message-ID: X-Mailer: git-send-email 2.50.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The problem presented here is related to NUMA systems and tag-based KASAN mode. It can be explained in the following points: 1. There can be more than one virtual memory chunk. 2. Chunk's base address has a tag. 3. The base address points at the first chunk and thus inherits the tag of the first chunk. 4. The subsequent chunks will be accessed with the tag from the first chunk. 5. Thus, the subsequent chunks need to have their tag set to match that of the first chunk. Refactor code by moving it into a helper in preparation for the actual fix. Signed-off-by: Maciej Wieczor-Retman Tested-by: Baoquan He --- Changelog v4: - Redo the patch message numbered list. - Do the refactoring in this patch and move additions to the next new one. Changelog v3: - Remove last version of this patch that just resets the tag on base_addr and add this patch that unpoisons all areas with the same tag instead. include/linux/kasan.h | 10 ++++++++++ mm/kasan/hw_tags.c | 11 +++++++++++ mm/kasan/shadow.c | 10 ++++++++++ mm/vmalloc.c | 4 +--- 4 files changed, 32 insertions(+), 3 deletions(-) diff --git a/include/linux/kasan.h b/include/linux/kasan.h index 7a2527794549..3ec432d7df9a 100644 --- a/include/linux/kasan.h +++ b/include/linux/kasan.h @@ -613,6 +613,13 @@ static __always_inline void kasan_poison_vmalloc(const= void *start, __kasan_poison_vmalloc(start, size); } =20 +void __kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms); +static __always_inline void kasan_unpoison_vmap_areas(struct vm_struct **v= ms, int nr_vms) +{ + if (kasan_enabled()) + __kasan_unpoison_vmap_areas(vms, nr_vms); +} + #else /* CONFIG_KASAN_VMALLOC */ =20 static inline void kasan_populate_early_vm_area_shadow(void *start, @@ -637,6 +644,9 @@ static inline void *kasan_unpoison_vmalloc(const void *= start, static inline void kasan_poison_vmalloc(const void *start, unsigned long s= ize) { } =20 +static inline void kasan_unpoison_vmap_areas(struct vm_struct **vms, int n= r_vms) +{ } + #endif /* CONFIG_KASAN_VMALLOC */ =20 #if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && \ diff --git a/mm/kasan/hw_tags.c b/mm/kasan/hw_tags.c index 9a6927394b54..1f569df313c3 100644 --- a/mm/kasan/hw_tags.c +++ b/mm/kasan/hw_tags.c @@ -382,6 +382,17 @@ void __kasan_poison_vmalloc(const void *start, unsigne= d long size) */ } =20 +void __kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms) +{ + int area; + + for (area =3D 0 ; area < nr_vms ; area++) { + vms[area]->addr =3D __kasan_unpoison_vmalloc( + vms[area]->addr, vms[area]->size, + KASAN_VMALLOC_PROT_NORMAL); + } +} + #endif =20 void kasan_enable_hw_tags(void) diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c index d2c70cd2afb1..b41f74d68916 100644 --- a/mm/kasan/shadow.c +++ b/mm/kasan/shadow.c @@ -646,6 +646,16 @@ void __kasan_poison_vmalloc(const void *start, unsigne= d long size) kasan_poison(start, size, KASAN_VMALLOC_INVALID, false); } =20 +void __kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms) +{ + int area; + + for (area =3D 0 ; area < nr_vms ; area++) { + kasan_poison(vms[area]->addr, vms[area]->size, + arch_kasan_get_tag(vms[area]->addr), false); + } +} + #else /* CONFIG_KASAN_VMALLOC */ =20 int kasan_alloc_module_shadow(void *addr, size_t size, gfp_t gfp_mask) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index c93893fb8dd4..00be0abcaf60 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -4847,9 +4847,7 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned l= ong *offsets, * With hardware tag-based KASAN, marking is skipped for * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc(). */ - for (area =3D 0; area < nr_vms; area++) - vms[area]->addr =3D kasan_unpoison_vmalloc(vms[area]->addr, - vms[area]->size, KASAN_VMALLOC_PROT_NORMAL); + kasan_unpoison_vmap_areas(vms, nr_vms); =20 kfree(vas); return vms; --=20 2.50.1