From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6C1592D193F for ; Mon, 17 Nov 2025 19:17:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763407073; cv=none; b=E3gDMa2Rs69sIWjXclxcQ/Nyhrmfb8Pyr9SFuVbsYYE2OtUwrUZ7hI5nBzSLzFs1P0+0Kx8qH2At+lrLhHvj7iX4ILeGaMl6lulYSPE04cKBKujybh1Mks8DtxCZVuD+ARlIqfhEuOl91KwqCpFwPRyTg5H1Hrsxw8YRZv6LPW4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1763407073; c=relaxed/simple; bh=xz+7hSiNavh/vVqR2VliUy8xLdZjqIGcW4tr3YO+8xc=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=GU0Dt2OV3MlCzv9HC870eKIWiOj/jDI2MU4nsTm+mk4kBK98fvhY8MhhmW7vBilZiefhaiXEILuIXVTjUGmHWyVe/G3POZ3/qkr6u/MD41vR/R7FETvMSpCB0bRPU+JeGRIj0r+koeV5kgt7mN989jZz92jOzHdH1BZa2kggFK8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gxDdGAtt; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gxDdGAtt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 47C69C19425; Mon, 17 Nov 2025 19:17:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1763407072; bh=xz+7hSiNavh/vVqR2VliUy8xLdZjqIGcW4tr3YO+8xc=; h=Date:Subject:From:To:Cc:References:In-Reply-To:From; b=gxDdGAttAWDFlnY8XYRStNd4lRVVa0rT2M19Gwp+AtNeJdTGNgkxmGyxXrZjRfzKm sot4fH5YXjUYBRlqZ9AvrHUABPom9TYU9f6Y0VaeG2phty9ClXEIt1AY0w/JHOd+AI YJGgw6CVh1044ht2zjpZMOdHssp+5CWkZ16tB9DR4NfGjeiOIf02qBGP+aNmRur+ug Adp7RNKABGEjpBa0X34ElipDlQnIbQU8MP1U0DptT2/4yaGZIe5cN0mwgZCVFGtzad 7zQL7KSPXRUdHLfYh1sDcluGVm7q/51MExDv11tQWFadtIXSBKssc7nFGrEM46Du2y Wy80IEiYJaDUw== Message-ID: <5903ee6c-3774-47d6-b14a-51201fd75c0f@kernel.org> Date: Mon, 17 Nov 2025 20:17:47 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: Linux 6.18-rc6 From: "David Hildenbrand (Red Hat)" To: Linus Torvalds Cc: David Wang <00107082@163.com>, catalin.marinas@arm.com, lance.yang@linux.dev, b-padhi@ti.com, akpm@linux-foundation.org, linux-kernel@vger.kernel.org, Jan Polensky References: <20251117082023.90176-1-00107082@163.com> <6c09aaea.aa4a.19a91e379ab.Coremail.00107082@163.com> <37bad560-a8f3-4ae2-aa34-1edc635062c0@kernel.org> <1c14c47e.ab83.19a92102b26.Coremail.00107082@163.com> <25e4c75c-097d-44bb-8739-136a0238d5bf@kernel.org> <189cfb08-2593-4ff1-a3fa-3c7957cb6b60@kernel.org> <08790cc2-0db4-4920-8331-9061114e8645@kernel.org> Content-Language: en-US In-Reply-To: <08790cc2-0db4-4920-8331-9061114e8645@kernel.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 17.11.25 19:24, David Hildenbrand (Red Hat) wrote: > On 17.11.25 18:59, Linus Torvalds wrote: >> On Mon, 17 Nov 2025 at 09:53, David Hildenbrand (Red Hat) >> wrote: >>> >>> I had the same in mind for a second, but then I looked at >>> kernel_init_pages() with the kasan_disable_current() handling and >>> concluded that it's clearer to just disallow tag_clear_highpage() being >>> abused in the first place and reduce the effective code footprint of >>> post_alloc_hook(). >> >> See, I had the exact opposite reaction: I think the one-liner is >> better not just because it's simpler, but exactly *because* of the >> mess that is kernel_init_pages(). > > Heh, I intuitively avoid runtime checks on the fast paths where avoidable :) > >> >> IOW, that one-liner is either correct *without* all that crud - and >> it's unnecessary for the __GFP_ZEROTAGS case because that only happens >> at init time - or it shows a bug in the arm64 code. > > What sticks out is that we perform the tag_clear_highpage() before we do > all the KASAN poison magic. And we perform the kernel_init_pages() after > the kasan magic. > > The clear_highpage() fallback in tag_clear_highpage() was just recently > added by Catalin (in the same commit we are fixing here IIRC). > > I am no expert on KASAN, but I would suspect that it is important for us > to clear the pages after doing the > kasan_unpoison_pages/page_kasan_tag_reset. > > I'll have to dig into the history of tag_clear_highpage() a bit to > understand how this would interact with non-hw-tag-based KASAN. IIRC, > amd64 also supports SW-tag KASAN. So, I briefly tried on x86 with KASAN and the one-liner. I was assuming that KASAN would complain because we are clearing the page before doing the kasan_unpoison_pages() (IOW, writing to a KASAN-poisoned page). It didn't trigger, and I assume it is because clear_highpage() on x86 will not be instrumented by KASAN (my theory). The comment in kernel_init_pages() indicates that s390x uses memset() for that purpose and I would assume that that one would be instrumented. So I'll give it a try on s390x with KASAN. I should be able to get my hands on a system later today. -- Cheers David