Message-ID: <CAJuCfpE_Vr63QHpwG7G71iabN_kFyacbYtc-9vCC8iF=nu4mmA@mail.gmail.com>
Date: Tue, 10 Dec 2024 12:04:46 -0800
From: Suren Baghdasaryan <surenb@...gle.com>
To: Hao Ge <hao.ge@...ux.dev>
Cc: kent.overstreet@...ux.dev, akpm@...ux-foundation.org, linux-mm@...ck.org, 
	linux-kernel@...r.kernel.org, greearb@...delatech.com, 
	Hao Ge <gehao@...inos.cn>
Subject: Re: [PATCH v2] mm/alloc_tag: Add kasan_alloc_module_shadow when
 CONFIS_KASAN_VMALLOC disabled

On Tue, Dec 10, 2024 at 11:37 AM Hao Ge <hao.ge@...ux.dev> wrote:
>
> Hi Suren
>
>
> On 12/11/24 03:20, Suren Baghdasaryan wrote:
> > On Tue, Dec 10, 2024 at 10:46 AM Hao Ge <hao.ge@...ux.dev> wrote:
> >> Hi Suren
> >>
> >>
> >> Thanks for your review.
> >>
> >>
> >> On 12/11/24 01:55, Suren Baghdasaryan wrote:
> >>> On Mon, Dec 9, 2024 at 10:53 PM Hao Ge <hao.ge@...ux.dev> wrote:
> >>>> From: Hao Ge <gehao@...inos.cn>
> >>>>
> >>>> When CONFIG_KASAN is enabled but CONFIG_KASAN_VMALLOC
> >>>> is not enabled, we may encounter a panic during system boot.
> >>>>
> >>>> Because we haven't allocated pages and created mappings
> >>>> for the shadow memory corresponding to module_tags region,
> >>>> similar to how it is done for execmem_vmalloc.
> >>>>
> >>>> The difference is that our module_tags are allocated on demand,
> >>>> so similarly,we also need to allocate shadow memory regions on demand.
> >>>> However, we still need to adhere to the MODULE_ALIGN principle.
> >>>>
> >>>> Here is the log for panic:
> >>>>
> >>>> [   18.349421] BUG: unable to handle page fault for address: fffffbfff8092000
> >>>> [   18.350016] #PF: supervisor read access in kernel mode
> >>>> [   18.350459] #PF: error_code(0x0000) - not-present page
> >>>> [   18.350904] PGD 20fe52067 P4D 219dc8067 PUD 219dc4067 PMD 102495067 PTE 0
> >>>> [   18.351484] Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
> >>>> [   18.351961] CPU: 5 UID: 0 PID: 1 Comm: systemd Not tainted 6.13.0-rc1+ #3
> >>>> [   18.352533] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
> >>>> [   18.353494] RIP: 0010:kasan_check_range+0xba/0x1b0
> >>>> [   18.353931] Code: 8d 5a 07 4c 0f 49 da 49 c1 fb 03 45 85 db 0f 84 dd 00 00 00 45 89 db 4a 8d 14 d8 eb 0d 48 83 c0 08 48 39 c2 0f 84 c1 00 00 00 <48> 83 38 00 74 ed 48 8d 50 08 eb 0d 48 83 c0 01 48 39 d0 0f 84 90
> >>>> [   18.355484] RSP: 0018:ff11000101877958 EFLAGS: 00010206
> >>>> [   18.355937] RAX: fffffbfff8092000 RBX: fffffbfff809201e RCX: ffffffff82a7ceac
> >>>> [   18.356542] RDX: fffffbfff8092018 RSI: 00000000000000f0 RDI: ffffffffc0490000
> >>>> [   18.357153] RBP: fffffbfff8092000 R08: 0000000000000001 R09: fffffbfff809201d
> >>>> [   18.357756] R10: ffffffffc04900ef R11: 0000000000000003 R12: ffffffffc0490000
> >>>> [   18.358365] R13: ff11000101877b48 R14: ffffffffc0490000 R15: 000000000000002c
> >>>> [   18.358968] FS:  00007f9bd13c5940(0000) GS:ff110001eb480000(0000) knlGS:0000000000000000
> >>>> [   18.359648] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>>> [   18.360178] CR2: fffffbfff8092000 CR3: 0000000109214004 CR4: 0000000000771ef0
> >>>> [   18.360790] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> >>>> [   18.361404] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> >>>> [   18.362020] PKRU: 55555554
> >>>> [   18.362261] Call Trace:
> >>>> [   18.362481]  <TASK>
> >>>> [   18.362671]  ? __die+0x23/0x70
> >>>> [   18.362964]  ? page_fault_oops+0xc2/0x160
> >>>> [   18.363318]  ? exc_page_fault+0xad/0xc0
> >>>> [   18.363680]  ? asm_exc_page_fault+0x26/0x30
> >>>> [   18.364056]  ? move_module+0x3cc/0x8a0
> >>>> [   18.364398]  ? kasan_check_range+0xba/0x1b0
> >>>> [   18.364755]  __asan_memcpy+0x3c/0x60
> >>>> [   18.365074]  move_module+0x3cc/0x8a0
> >>>> [   18.365386]  layout_and_allocate.constprop.0+0x3d5/0x720
> >>>> [   18.365841]  ? early_mod_check+0x3dc/0x510
> >>>> [   18.366195]  load_module+0x72/0x1850
> >>>> [   18.366509]  ? __pfx_kernel_read_file+0x10/0x10
> >>>> [   18.366918]  ? vm_mmap_pgoff+0x21c/0x2d0
> >>>> [   18.367262]  init_module_from_file+0xd1/0x130
> >>>> [   18.367638]  ? __pfx_init_module_from_file+0x10/0x10
> >>>> [   18.368073]  ? __pfx__raw_spin_lock+0x10/0x10
> >>>> [   18.368456]  ? __pfx_cred_has_capability.isra.0+0x10/0x10
> >>>> [   18.368938]  idempotent_init_module+0x22c/0x790
> >>>> [   18.369332]  ? simple_getattr+0x6f/0x120
> >>>> [   18.369676]  ? __pfx_idempotent_init_module+0x10/0x10
> >>>> [   18.370110]  ? fdget+0x58/0x3a0
> >>>> [   18.370393]  ? security_capable+0x64/0xf0
> >>>> [   18.370745]  __x64_sys_finit_module+0xc2/0x140
> >>>> [   18.371136]  do_syscall_64+0x7d/0x160
> >>>> [   18.371459]  ? fdget_pos+0x1c8/0x4c0
> >>>> [   18.371784]  ? ksys_read+0xfd/0x1d0
> >>>> [   18.372106]  ? syscall_exit_to_user_mode+0x10/0x1f0
> >>>> [   18.372525]  ? do_syscall_64+0x89/0x160
> >>>> [   18.372860]  ? do_syscall_64+0x89/0x160
> >>>> [   18.373194]  ? do_syscall_64+0x89/0x160
> >>>> [   18.373527]  ? syscall_exit_to_user_mode+0x10/0x1f0
> >>>> [   18.373952]  ? do_syscall_64+0x89/0x160
> >>>> [   18.374283]  ? syscall_exit_to_user_mode+0x10/0x1f0
> >>>> [   18.374701]  ? do_syscall_64+0x89/0x160
> >>>> [   18.375037]  ? do_user_addr_fault+0x4a8/0xa40
> >>>> [   18.375416]  ? clear_bhb_loop+0x25/0x80
> >>>> [   18.375748]  ? clear_bhb_loop+0x25/0x80
> >>>> [   18.376119]  ? clear_bhb_loop+0x25/0x80
> >>>> [   18.376450]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
> >>>>
> >>>> Fixes: 233e89322cbe ("alloc_tag: fix module allocation tags populated area calculation")
> >>>> Reported-by: Ben Greear <greearb@...delatech.com>
> >>>> Closes: https://lore.kernel.org/all/1ba0cc57-e2ed-caa2-1241-aa5615bee01f@candelatech.com/
> >>>> Signed-off-by: Hao Ge <gehao@...inos.cn>
> >>>> ---
> >>>> v2: Add comments to facilitate understanding of the code.
> >>>>       Add align nr << PAGE_SHIFT to MODULE_ALIGN,even though kasan_alloc_module_shadow
> >>>>       already handles this internally,but to make the code more readable and user-friendly
> >>>>
> >>>> commit 233e89322cbe ("alloc_tag: fix module allocation
> >>>> tags populated area calculation") is currently in the
> >>>> mm-hotfixes-unstable branch, so this patch is
> >>>> developed based on the mm-hotfixes-unstable branch.
> >>>> ---
> >>>>    lib/alloc_tag.c | 12 ++++++++++++
> >>>>    1 file changed, 12 insertions(+)
> >>>>
> >>>> diff --git a/lib/alloc_tag.c b/lib/alloc_tag.c
> >>>> index f942408b53ef..bd3ee57ea13f 100644
> >>>> --- a/lib/alloc_tag.c
> >>>> +++ b/lib/alloc_tag.c
> >>>> @@ -10,6 +10,7 @@
> >>>>    #include <linux/seq_buf.h>
> >>>>    #include <linux/seq_file.h>
> >>>>    #include <linux/vmalloc.h>
> >>>> +#include <linux/math.h>
> >>>>
> >>>>    #define ALLOCINFO_FILE_NAME            "allocinfo"
> >>>>    #define MODULE_ALLOC_TAG_VMAP_SIZE     (100000UL * sizeof(struct alloc_tag))
> >>>> @@ -422,6 +423,17 @@ static int vm_module_tags_populate(void)
> >>>>                           return -ENOMEM;
> >>>>                   }
> >>>>                   vm_module_tags->nr_pages += nr;
> >>>> +
> >>>> +               /*
> >>>> +                * Kasan allocates 1 byte of shadow for every 8 bytes of data.
> >>>> +                * When kasan_alloc_module_shadow allocates shadow memory,
> >>>> +                * it does so in units of pages.
> >>>> +                * Therefore, here we need to align to MODULE_ALIGN.
> >>>> +                */
> >>>> +               if ((phys_end & (MODULE_ALIGN - 1)) == 0)
> >>> phys_end is calculated as:
> >>>
> >>> unsigned long phys_end = ALIGN_DOWN(module_tags.start_addr, PAGE_SIZE) +
> >>>                                              (vm_module_tags->nr_pages
> >>> << PAGE_SHIFT);
> >>>
> >>> and therefore is always PAGE_SIZE-aligned. PAGE_SIZE is always a
> >>> multiple of MODULE_ALIGN, therefore phys_end is always
> >> When CONFIG_KASAN_VMALLOC is not enabled
> >>
> >> #define MODULE_ALIGN (PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT)
> > Ah, sorry, I misread this as (PAGE_SIZE >> KASAN_SHADOW_SCALE_SHIFT)
> > and assumed MODULE_ALIGN is always multiple of PAGE_SIZE. Now it makes
> > more sense. However I'm still not sure about this condition:
> >
> > if ((phys_end & (MODULE_ALIGN - 1)) == 0)
> >
> > What if page_end is not MODULE_ALIGN-aligned. We will be skipping
> > kasan_alloc_module_shadow().
>
>
> Theoretically, this scenario does not exist.
>
>
> Please refer to the following:
>
> https://elixir.bootlin.com/linux/v6.13-rc2/source/arch/x86/mm/init.c#L1072
>
> They would all comply with MODULE_ALIGN.

Well, not all. The original execmem_vmap() called from
alloc_mod_tags_mem() will indeed return MODULE_ALIGN-aligned address,
therefore the original phys_end is MODULE_ALIGN-aligned. But as
phys_end grows it can become misaligned. Let's modify my example:

module_tags.start_addr = 0x8000; (returned by execmem_vmap())
// we need to allocate 1 page (nr = 1)
phys_end  = 0x8000; // MODULE_ALIGN'ed, so we allocate a shadow page
// tags covered area is [0x8000-0x9000]
// our shadows memory represents the area [0x8000-0x10000]

// now we allocate 8 more pages (nr = 8)
phys_end = 0x9000; // not MODULE_ALIGN'ed, we skip allocating shadow pages
// tags covered area is [0x8000-0x11000]
// but our shadows memory still represents the area [0x8000-0x10000]


>
>
> > For example, say module_tags.start_addr == 0x1018 (4096+24), original
> > phys_end will be 0x1000 (4096) and say we allocated one page (nr ==
> > 1), tags area is [0x1000-0x2000]. phys_end is not MODULE_ALIGN-aligned
> > and we will skip kasan_alloc_module_shadow(). IIUC, this is already
> > incorrect.
> > Now, say the next time we allocate 8 pages. phys_end this time is
> > 0x2000 and the new tags area spans [0x1000-0xA000], we skip
> > kasan_alloc_module_shadow() again. Next time we allocate pages,
> > phys_end is 0xA000 and it again is not MODULE_ALIGN-aligned, we skip
> > again. You see my point?
> >
> >> https://elixir.bootlin.com/linux/v6.13-rc2/source/include/linux/execmem.h#L11
> >>
> >> and On x86, KASAN_SHADOW_SCALE_SHIFT is set to 3
> >>
> >> https://elixir.bootlin.com/linux/v6.13-rc2/source/arch/x86/include/asm/kasan.h#L7
> >>
> >> As mentioned in my comment, Kasan allocates 1 byte of shadow for every 8
> >> bytes of data
> >>
> >> So, when you allocate a shadow page through kasan_alloc_module_shadow,
> >> it corresponds to eight physical pages in our system.
> >>
> >> So, we need MODULE_ALIGN to ensure proper alignment when allocating
> >> shadow memory for modules using KASAN.
> >>
> >> Let's take a look at the kasan_alloc_module_shadow function again
> >>
> >> As I mentioned earlier,Kasan allocates 1 byte of shadow for every 8
> >> bytes of data.
> >>
> >> Assuming phys_end is set to 0 for the sake of this example, if you
> >> allocate a single shadow page,
> >>
> >> the corresponding address range it can represent would be [0, 0x7FFFF].
> >>
> >> So, it is incorrect to call kasan_alloc_module_shadow every time a page
> >> is allocated, as it can trigger warnings in the system.
> >>
> >> https://elixir.bootlin.com/linux/v6.13-rc2/source/mm/kasan/shadow.c#L599
> >>
> >> Thanks
> >>
> >> Best Regards Hao
> >>
> >>> MODULE_ALIGN-aligned and the above condition is not needed.
> >>>
> >>>> +                       kasan_alloc_module_shadow((void *)phys_end,
> >>>> +                                                 round_up(nr << PAGE_SHIFT, MODULE_ALIGN),
> >>> Here again, (nr << PAGE_SHIFT) is PAGE_SIZE-aligned and PAGE_SIZE is a
> >>> multiple of MODULE_ALIGN, therefore (nr << PAGE_SHIFT) is always
> >>> multiple of MODULE_ALIGN and there is no need for round_up().
> >>>
> >>> IOW, I think this patch should simply add one line:
> >>>
> >>>                   vm_module_tags->nr_pages += nr;
> >>> +               kasan_alloc_module_shadow((void *)phys_end, nr <<
> >>> PAGE_SHIFT, GFP_KERNEL);
> >>>
> >>> Am I missing something?
> >>>
> >>
> >>>> +                                                 GFP_KERNEL);
> >>>>           }
> >>>>
> >>>>           /*
> >>>> --
> >>>> 2.25.1
> >>>>

Powered by blists - more mailing lists