linux-kernel - Re: [PATCH] mm: Fix kernel stack tagging for certain configs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aLdFxtVpOX-qf0qc@casper.infradead.org>
Date: Tue, 2 Sep 2025 20:30:14 +0100
From: Matthew Wilcox <willy@...radead.org>
To: "Vishal Moola (Oracle)" <vishal.moola@...il.com>
Cc: linux-mm@...ck.org, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	David Hildenbrand <david@...hat.com>,
	Ingo Molnar <mingo@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Juri Lelli <juri.lelli@...hat.com>,
	Vincent Guittot <vincent.guittot@...aro.org>,
	Kees Cook <kees@...nel.org>, kernel test robot <lkp@...el.com>,
	Dan Carpenter <dan.carpenter@...aro.org>
Subject: Re: [PATCH] mm: Fix kernel stack tagging for certain configs

On Tue, Sep 02, 2025 at 10:59:03AM -0700, Vishal Moola (Oracle) wrote:
> There are 3 cases where kernel pages are allocated for kernel stacks:
> CONFIG_VMAP_STACK, THREAD_SIZE >= PAGE_SIZE, THREAD_SIZE < PAGE_SIZE.
> These cases use vmalloc(), alloc_pages() and kmem_cache_alloc()
> respectively.

I missed that the third case existed ...

> In the first 2 cases, THREAD_SIZE / PAGE_SIZE will always be greater
> than 0, and pages are tagged as expected. In the third case,
> THREAD_SIZE / PAGE_SIZE evaluates to 0 and doesn't tag any pages at all.
> This meant that in those configs, the stack tagging was a no-op, and led
> to smatch build warnings.

I didn't see those smatch warnings.  Were they cc'd to the mailing list?

> We definitely have at least 1 page we want tagged at this point, so fix
> it by using a do {} while loop instead of a for loop.

We can't do this.  Pages can only have one type at a time.  Since
they're allocated from slab, they have PGTY_slab.  This will lead to
a warning at runtime:

        VM_BUG_ON_PAGE(data_race(page->page_type) != UINT_MAX, page);   \

But for our purposes (trying to figure out how fragmented the vmap
stack is making the memmap), we don't need to do this accounting.
These pages are already being allocated from slab, and slab allocates
naturally aligned, so we can skip all of this for these configurations.

(now I'll go back and reply to David's mail from the 21st which I
missed)