linux-kernel - Re: [PATCH v8 28/43] arm64: mte: Reset the page tag in page->flags

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 6 Nov 2020 11:46:15 +0000
From:   Vincenzo Frascino <vincenzo.frascino@....com>
To:     Catalin Marinas <catalin.marinas@....com>,
        Andrey Konovalov <andreyknvl@...gle.com>
Cc:     Will Deacon <will.deacon@....com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Alexander Potapenko <glider@...gle.com>,
        Marco Elver <elver@...gle.com>,
        Evgenii Stepanov <eugenis@...gle.com>,
        Branislav Rankov <Branislav.Rankov@....com>,
        Kevin Brodsky <kevin.brodsky@....com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        kasan-dev@...glegroups.com, linux-arm-kernel@...ts.infradead.org,
        linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v8 28/43] arm64: mte: Reset the page tag in page->flags

Hi Catalin,

On 11/5/20 3:59 PM, Catalin Marinas wrote:
> On Thu, Nov 05, 2020 at 12:18:43AM +0100, Andrey Konovalov wrote:
>> diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
>> index 8f99c65837fd..06ba6c923ab7 100644
>> --- a/arch/arm64/kernel/mte.c
>> +++ b/arch/arm64/kernel/mte.c
>> @@ -34,6 +34,7 @@ static void mte_sync_page_tags(struct page *page, pte_t *ptep, bool check_swap)
>>  			return;
>>  	}
>>  
>> +	page_kasan_tag_reset(page);
>>  	mte_clear_page_tags(page_address(page));
> 
> I think we need an smp_wmb() between setting the flags and clearing the
> actual tags. If another threads reads page->flags and builds a tagged
> address out of it (see page_to_virt) there's an address dependency to
> the actual memory access. However, on the current thread, we don't
> guarantee that the new page->flags are visible before the tags were
> updated.
> 

Indeed, and I will add a comment as well to explain why.

>>  }
>>  
>> diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c
>> index 70a71f38b6a9..348f4627da08 100644
>> --- a/arch/arm64/mm/copypage.c
>> +++ b/arch/arm64/mm/copypage.c
>> @@ -22,6 +22,7 @@ void copy_highpage(struct page *to, struct page *from)
>>  	copy_page(kto, kfrom);
>>  
>>  	if (system_supports_mte() && test_bit(PG_mte_tagged, &from->flags)) {
>> +		page_kasan_tag_reset(to);
>>  		set_bit(PG_mte_tagged, &to->flags);
>>  		mte_copy_page_tags(kto, kfrom);
> 
> Nitpick: move page_kasan_tag_reset() just above mte_copy_page_tags() for
> consistency with the other places where PG_mte_tagged is set before or
> after the actual tag setting.
> 

Fine, I will add it to the next iteration.

>>  	}
>> diff --git a/arch/arm64/mm/mteswap.c b/arch/arm64/mm/mteswap.c
>> index c52c1847079c..0e7eccbe598a 100644
>> --- a/arch/arm64/mm/mteswap.c
>> +++ b/arch/arm64/mm/mteswap.c
>> @@ -53,6 +53,7 @@ bool mte_restore_tags(swp_entry_t entry, struct page *page)
>>  	if (!tags)
>>  		return false;
>>  
>> +	page_kasan_tag_reset(page);
>>  	mte_restore_page_tags(page_address(page), tags);

I just realized based on your comment above that we need smp_wmb() here as well.
I will add it with a comment as well.

> 
> There is another mte_restore_page_tags() caller in hibernate.c. That one
> doesn't need page_kasan_tag_reset() since the page->flags would have
> been already restored but please add a comment in that file why its not
> needed.
> 

Yes I will do, I agree on the reasoning, I will report it in the comments.

-- 
Regards,
Vincenzo