From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out28-98.mail.aliyun.com (out28-98.mail.aliyun.com [115.124.28.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 10C7C448BA4 for ; Tue, 28 Jul 2026 14:16:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=115.124.28.98 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785248216; cv=none; b=U4e068vmQ3fHLskjurkr/GlYZ/3foCLb3JV1Lg2SYTot5eU10Lompym4xcuGTXNFbZAgD5/TCu9PCTfZweFIXhG3CVDzBBlnYPiX2pmlm3O5weG1W7BM3gTyVTfHu3A+ukhAJNFSmhlTac230lOj2TWkYxgXRIsGqct0+MX9Oaw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785248216; c=relaxed/simple; bh=MptZmQ7qtbQBrS1DPvHgiZ68mWqLLQuNY+MCsY9MFXM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=KITmqMTlM41nT9OBcbfEIu08NJ41ylJvcAs9TNhTjL0XtNcthQldUVpM271X3eHSMq+Cqjyx4NlyHmJ1+kdB0oeOyj8XYhY+j/15rYryMhcR9mY3cuD5yfVzrEnV9oLWeJxHAgNoEng+sdSjhRmOmyFrG5wR63p40atXqJy/qYw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=redrisc.com; spf=pass smtp.mailfrom=redrisc.com; arc=none smtp.client-ip=115.124.28.98 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=redrisc.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redrisc.com X-Alimail-AntiSpam:AC=CONTINUE;BC=0.0744582|-1;CH=green;DM=|CONTINUE|false|;DS=CONTINUE|ham_system_inform|0.0077261-0.0014522-0.990822;FP=2580275551777208554|1|1|1|0|-1|-1|-1;HT=maildocker-contentspam033045213054;MF=mingfeng.lin@redrisc.com;NM=1;PH=DS;RN=14;RT=14;SR=0;TI=SMTPD_---.iXVrDu6_1785248193; Received: from open01.kxhcluster.com(mailfrom:mingfeng.lin@redrisc.com fp:SMTPD_---.iXVrDu6_1785248193 cluster:ay29) by smtp.aliyun-inc.com; Tue, 28 Jul 2026 22:16:39 +0800 From: Mingfeng Lin To: Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , linux-riscv@lists.infradead.org Cc: Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Dmitry Vyukov , Vincenzo Frascino , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, Mingfeng Lin Subject: [RFC PATCH] riscv: kasan: Flush TLB after switching to temporary page table Date: Tue, 28 Jul 2026 22:16:30 +0800 Message-ID: <20260728141630.1635367-1-mingfeng.lin@redrisc.com> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit kasan_init() switches satp to tmp_pg_dir before clearing the early KASAN mappings from swapper_pg_dir. Both page-table roots use ASID 0. A write to satp neither invalidates address-translation caches nor orders page-table updates with subsequent address translations. An out-of-order implementation can have speculative memory accesses and their page-table walks in flight when satp is written. Without an SFENCE.VMA after the switch, such a walk can complete later and install a translation derived from swapper_pg_dir while that page table is being cleared. This is especially problematic with KASAN. Compiler-inserted checks read KASAN shadow memory before ordinary accesses. If an obsolete or faulting translation for the shadow is installed, the shadow load raises a page fault. The RISC-V page-fault handler is itself KASAN-instrumented, so it performs another shadow access before it can handle the original fault. The same bad translation can therefore cause recursive page faults and prevent kasan_init() from reaching the final satp switch and TLB flush. Flush the local TLB after installing tmp_pg_dir and before clearing swapper_pg_dir. This also orders the writes that initialized tmp_pg_dir before subsequent implicit page-table accesses. Fixes: 96f9d4daf745 ("riscv: Rework kasan population functions") Signed-off-by: Mingfeng Lin --- arch/riscv/mm/kasan_init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/riscv/mm/kasan_init.c b/arch/riscv/mm/kasan_init.c index c4a2a9e5586e..a2a1051590e3 100644 --- a/arch/riscv/mm/kasan_init.c +++ b/arch/riscv/mm/kasan_init.c @@ -487,6 +487,7 @@ void __init kasan_init(void) create_tmp_mapping(); csr_write(CSR_SATP, PFN_DOWN(__pa(tmp_pg_dir)) | satp_mode); + local_flush_tlb_all(); kasan_early_clear_pgd(pgd_offset_k(KASAN_SHADOW_START), KASAN_SHADOW_START, KASAN_SHADOW_END); -- 2.53.0