linux-kernel - Re: [PATCH v10 08/22] kasan, arm64: untag address in __kimg_to_phys and _virt_addr_is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 14 Nov 2018 20:23:50 +0100
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Mark Rutland <mark.rutland@....com>
Cc:     Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Alexander Potapenko <glider@...gle.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will.deacon@....com>,
        Christoph Lameter <cl@...ux.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Marc Zyngier <marc.zyngier@....com>,
        Dave Martin <dave.martin@....com>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        "Eric W . Biederman" <ebiederm@...ssion.com>,
        Ingo Molnar <mingo@...nel.org>,
        Paul Lawrence <paullawrence@...gle.com>,
        Geert Uytterhoeven <geert@...ux-m68k.org>,
        Arnd Bergmann <arnd@...db.de>,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Kate Stewart <kstewart@...uxfoundation.org>,
        Mike Rapoport <rppt@...ux.vnet.ibm.com>,
        kasan-dev@...glegroups.com,
        "open list:DOCUMENTATION" <linux-doc@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Linux ARM <linux-arm-kernel@...ts.infradead.org>,
        linux-sparse@...r.kernel.org,
        Linux Memory Management List <linux-mm@...ck.org>,
        Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>,
        Kostya Serebryany <kcc@...gle.com>,
        Evgeniy Stepanov <eugenis@...gle.com>,
        Lee Smith <Lee.Smith@....com>,
        Ramana Radhakrishnan <Ramana.Radhakrishnan@....com>,
        Jacob Bramley <Jacob.Bramley@....com>,
        Ruben Ayrapetyan <Ruben.Ayrapetyan@....com>,
        Jann Horn <jannh@...gle.com>,
        Mark Brand <markbrand@...gle.com>,
        Chintan Pandya <cpandya@...eaurora.org>,
        Vishwath Mohan <vishwath@...gle.com>
Subject: Re: [PATCH v10 08/22] kasan, arm64: untag address in __kimg_to_phys
 and _virt_addr_is_linear

On Wed, Nov 7, 2018 at 5:52 PM, Mark Rutland <mark.rutland@....com> wrote:
> Hi Andrey,
>
> On Tue, Nov 06, 2018 at 06:30:23PM +0100, Andrey Konovalov wrote:
>> __kimg_to_phys (which is used by virt_to_phys) and _virt_addr_is_linear
>> (which is used by virt_addr_valid) assume that the top byte of the address
>> is 0xff, which isn't always the case with tag-based KASAN.
>
> I'm confused by this. Why/when do kimg address have a non-default tag?
>
> Any kimg address is part of the static kernel image, so it's not obvious
> to me how a kimg address would gain a tag. Could you please explain how
> this happens in the commit message?

If kimg address always points into the kernel image, then it shouldn't
be tagged, and this can be removed.

>
>> This patch resets the tag in those macros.
>>
>> Reviewed-by: Andrey Ryabinin <aryabinin@...tuozzo.com>
>> Reviewed-by: Dmitry Vyukov <dvyukov@...gle.com>
>> Signed-off-by: Andrey Konovalov <andreyknvl@...gle.com>
>> ---
>>  arch/arm64/include/asm/memory.h | 14 ++++++++++++--
>>  1 file changed, 12 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
>> index 0f1e024a951f..3226a0218b0b 100644
>> --- a/arch/arm64/include/asm/memory.h
>> +++ b/arch/arm64/include/asm/memory.h
>> @@ -92,6 +92,15 @@
>>  #define KASAN_THREAD_SHIFT   0
>>  #endif
>>
>> +#ifdef CONFIG_KASAN_SW_TAGS
>> +#define KASAN_TAG_SHIFTED(tag)               ((unsigned long)(tag) << 56)
>> +#define KASAN_SET_TAG(addr, tag)     (((addr) & ~KASAN_TAG_SHIFTED(0xff)) | \
>> +                                             KASAN_TAG_SHIFTED(tag))
>> +#define KASAN_RESET_TAG(addr)                KASAN_SET_TAG(addr, 0xff)
>> +#else
>> +#define KASAN_RESET_TAG(addr)                addr
>> +#endif
>
> Nit: the rest of the helper macros in this file are lower-case, with
> specialised helpers prefixed with several underscores. Could we please
> stick with that convention?
>
> e.g. have __tag_set() and __tag_reset() helpers.

Will do in v11.

>
>> +
>>  #define MIN_THREAD_SHIFT     (14 + KASAN_THREAD_SHIFT)
>>
>>  /*
>> @@ -232,7 +241,7 @@ static inline unsigned long kaslr_offset(void)
>>  #define __is_lm_address(addr)        (!!((addr) & BIT(VA_BITS - 1)))
>>
>>  #define __lm_to_phys(addr)   (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET)
>> -#define __kimg_to_phys(addr) ((addr) - kimage_voffset)
>> +#define __kimg_to_phys(addr) (KASAN_RESET_TAG(addr) - kimage_voffset)
>
> IIUC You need to adjust __lm_to_phys() too, since that could be passed
> an address from SLAB.
>
> Maybe that's done in a later patch, but if so it's confusing to split it
> out that way. It would be nicer to fix all the *_to_*() helpers in one
> go.

__lm_to_phys() does & ~PAGE_OFFSET, so it resets the tag by itself. I
can add an explicit __tag_reset() if you think it makes sense.

>
>>
>>  #define __virt_to_phys_nodebug(x) ({                                 \
>>       phys_addr_t __x = (phys_addr_t)(x);                             \
>> @@ -308,7 +317,8 @@ static inline void *phys_to_virt(phys_addr_t x)
>>  #endif
>>  #endif
>>
>> -#define _virt_addr_is_linear(kaddr)  (((u64)(kaddr)) >= PAGE_OFFSET)
>> +#define _virt_addr_is_linear(kaddr)  (KASAN_RESET_TAG((u64)(kaddr)) >= \
>> +                                             PAGE_OFFSET)
>
> This is painful to read. Could you please split this like:
>
> #define _virt_addr_is_linear(kaddr) \
>         (__tag_reset((u64)(kaddr)) >= PAGE_OFFSET)
>
> ... and we could reformat virt_addr_valid() in the same way while we're
> at it.

Will do in v11.

Thanks!