linux-kernel - Re: [PATCH 2/2] x86/mm: Populate KASAN shadow for per-CPU DS buffers in CPU entry area

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 9 Nov 2022 17:50:45 +0000
From:   Sean Christopherson <seanjc@...gle.com>
To:     Dave Hansen <dave.hansen@...ux.intel.com>,
        Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        linux-kernel@...r.kernel.org,
        Andrey Ryabinin <ryabinin.a.a@...il.com>,
        Dmitry Vyukov <dvyukov@...gle.com>
Subject: Re: [PATCH 2/2] x86/mm: Populate KASAN shadow for per-CPU DS buffers
 in CPU entry area

On Fri, Nov 04, 2022, Sean Christopherson wrote:
> Bounce through cea_map_percpu_pages() when setting the initial
> protections for per-CPU DS buffers so that KASAN populates a shadow for
> said mapping.  Failure to populate the shadow will result in a
> not-present #PF during KASAN validation if DS buffers are activated
> later on.
> 
> Fixes: 9fd429c28073 ("x86/kasan: Map shadow for percpu pages on demand")
> Cc: Andrey Ryabinin <ryabinin.a.a@...il.com>
> Cc: Dmitry Vyukov <dvyukov@...gle.com>
> Signed-off-by: Sean Christopherson <seanjc@...gle.com>
> ---
>  arch/x86/mm/cpu_entry_area.c | 10 ++++------
>  1 file changed, 4 insertions(+), 6 deletions(-)
> 
> diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c
> index d831aae94b41..64ae557ceb22 100644
> --- a/arch/x86/mm/cpu_entry_area.c
> +++ b/arch/x86/mm/cpu_entry_area.c
> @@ -91,13 +91,12 @@ void cea_set_pte(void *cea_vaddr, phys_addr_t pa, pgprot_t flags)
>  static void __init
>  cea_map_percpu_pages(void *cea_vaddr, void *ptr, int pages, pgprot_t prot)
>  {
> -	phys_addr_t pa = per_cpu_ptr_to_phys(ptr);
> +	int nid = ptr ? early_pfn_to_nid(PFN_DOWN(per_cpu_ptr_to_phys(ptr))) : 0;
>  
> -	kasan_populate_shadow_for_vaddr(cea_vaddr, pages * PAGE_SIZE,
> -					early_pfn_to_nid(PFN_DOWN(pa)));
> +	kasan_populate_shadow_for_vaddr(cea_vaddr, pages * PAGE_SIZE, nid);
>  
>  	for ( ; pages; pages--, cea_vaddr+= PAGE_SIZE, ptr += PAGE_SIZE)
> -		cea_set_pte(cea_vaddr, per_cpu_ptr_to_phys(ptr), prot);
> +		cea_set_pte(cea_vaddr, ptr ? per_cpu_ptr_to_phys(ptr) : 0, prot);

Gah, this is broken.  If pages > 1, subsequent iterations will generate a non-NULL
ptr.  This is likely what the kernel test bot is complaining about[1].  Andrey's
suggestion to map the entire per-CPU area in one go[2] should obviate the need for
special casing the DS buffer.  I'll give that a whirl and smush all three of these
mini-series together.

[1] https://lore.kernel.org/all/202211092215.948a1cf3-oliver.sang@intel.com
[2] https://lore.kernel.org/all/b5e31093-ac80-595b-1127-2a3e35913d86@gmail.com