linux-kernel - Re: [PATCH v2 0/2] kasan: vmalloc: Fix incorrect tag assignment with multiple vm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20251202083522.1b0349117b9159b891808532@linux-foundation.org>
Date: Tue, 2 Dec 2025 08:35:22 -0800
From: Andrew Morton <akpm@...ux-foundation.org>
To: Maciej Wieczor-Retman <m.wieczorretman@...me>
Cc: urezki@...il.com, elver@...gle.com, vincenzo.frascino@....com,
 glider@...gle.com, dvyukov@...gle.com, ryabinin.a.a@...il.com,
 andreyknvl@...il.com, kasan-dev@...glegroups.com,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 maciej.wieczor-retman@...el.com, Jiayuan Chen <jiayuan.chen@...ux.dev>
Subject: Re: [PATCH v2 0/2] kasan: vmalloc: Fix incorrect tag assignment
 with multiple vm_structs

On Tue, 02 Dec 2025 14:27:56 +0000 Maciej Wieczor-Retman <m.wieczorretman@...me> wrote:

> A KASAN tag mismatch, possibly resulting in a kernel panic, can be
> observed on systems with a tag-based KASAN enabled and with multiple
> NUMA nodes. Initially it was only noticed on x86 [1] but later a similar
> issue was also reported on arm64 [2].
> 
> Specifically the problem is related to how vm_structs interact with
> pcpu_chunks - both when they are allocated, assigned and when pcpu_chunk
> addresses are derived.
> 
> When vm_structs are allocated they are tagged if vmalloc support is
> enabled along the KASAN mode. Later when first pcpu chunk is allocated
> it gets its 'base_addr' field set to the first allocated vm_struct.
> With that it inherits that vm_struct's tag.
> 
> When pcpu_chunk addresses are later derived (by pcpu_chunk_addr(), for
> example in pcpu_alloc_noprof()) the base_addr field is used and offsets
> are added to it. If the initial conditions are satisfied then some of
> the offsets will point into memory allocated with a different vm_struct.
> So while the lower bits will get accurately derived the tag bits in the
> top of the pointer won't match the shadow memory contents.
> 
> The solution (proposed at v2 of the x86 KASAN series [3]) is to tag the
> vm_structs the same when allocating them for the per cpu allocator (in
> pcpu_get_vm_areas()).
> 
> Originally these patches were part of the x86 KASAN series [4].
> 
> The series is based on 6.18.

This series overlaps a lot with

https://lkml.kernel.org/r/20251128111516.244497-1-jiayuan.chen@linux.dev

Please discuss!

> [1] https://lore.kernel.org/all/e7e04692866d02e6d3b32bb43b998e5d17092ba4.1738686764.git.maciej.wieczor-retman@intel.com/
> [2] https://lore.kernel.org/all/aMUrW1Znp1GEj7St@MiWiFi-R3L-srv/
> [3] https://lore.kernel.org/all/CAPAsAGxDRv_uFeMYu9TwhBVWHCCtkSxoWY4xmFB_vowMbi8raw@mail.gmail.com/
> [4] https://lore.kernel.org/all/cover.1761763681.git.m.wieczorretman@pm.me/
>