linux-kernel - Re: [PATCH v8 28/43] arm64: mte: Reset the page tag in page->flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 5 Nov 2020 15:59:00 +0000
From:   Catalin Marinas <catalin.marinas@....com>
To:     Andrey Konovalov <andreyknvl@...gle.com>
Cc:     Will Deacon <will.deacon@....com>,
        Vincenzo Frascino <vincenzo.frascino@....com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Alexander Potapenko <glider@...gle.com>,
        Marco Elver <elver@...gle.com>,
        Evgenii Stepanov <eugenis@...gle.com>,
        Branislav Rankov <Branislav.Rankov@....com>,
        Kevin Brodsky <kevin.brodsky@....com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        kasan-dev@...glegroups.com, linux-arm-kernel@...ts.infradead.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v8 28/43] arm64: mte: Reset the page tag in page->flags

On Thu, Nov 05, 2020 at 12:18:43AM +0100, Andrey Konovalov wrote:
> diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
> index 8f99c65837fd..06ba6c923ab7 100644
> --- a/arch/arm64/kernel/mte.c
> +++ b/arch/arm64/kernel/mte.c
> @@ -34,6 +34,7 @@ static void mte_sync_page_tags(struct page *page, pte_t *ptep, bool check_swap)
>  			return;
>  	}
>  
> +	page_kasan_tag_reset(page);
>  	mte_clear_page_tags(page_address(page));

I think we need an smp_wmb() between setting the flags and clearing the
actual tags. If another threads reads page->flags and builds a tagged
address out of it (see page_to_virt) there's an address dependency to
the actual memory access. However, on the current thread, we don't
guarantee that the new page->flags are visible before the tags were
updated.

>  }
>  
> diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c
> index 70a71f38b6a9..348f4627da08 100644
> --- a/arch/arm64/mm/copypage.c
> +++ b/arch/arm64/mm/copypage.c
> @@ -22,6 +22,7 @@ void copy_highpage(struct page *to, struct page *from)
>  	copy_page(kto, kfrom);
>  
>  	if (system_supports_mte() && test_bit(PG_mte_tagged, &from->flags)) {
> +		page_kasan_tag_reset(to);
>  		set_bit(PG_mte_tagged, &to->flags);
>  		mte_copy_page_tags(kto, kfrom);

Nitpick: move page_kasan_tag_reset() just above mte_copy_page_tags() for
consistency with the other places where PG_mte_tagged is set before or
after the actual tag setting.

>  	}
> diff --git a/arch/arm64/mm/mteswap.c b/arch/arm64/mm/mteswap.c
> index c52c1847079c..0e7eccbe598a 100644
> --- a/arch/arm64/mm/mteswap.c
> +++ b/arch/arm64/mm/mteswap.c
> @@ -53,6 +53,7 @@ bool mte_restore_tags(swp_entry_t entry, struct page *page)
>  	if (!tags)
>  		return false;
>  
> +	page_kasan_tag_reset(page);
>  	mte_restore_page_tags(page_address(page), tags);

There is another mte_restore_page_tags() caller in hibernate.c. That one
doesn't need page_kasan_tag_reset() since the page->flags would have
been already restored but please add a comment in that file why its not
needed.

-- 
Catalin