From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f46.google.com (mail-wr1-f46.google.com [209.85.221.46]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 923A7210F59 for ; Fri, 5 Dec 2025 01:09:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.46 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764896958; cv=none; b=EFCR0AHxYtDYhfRKnW8v9vJShkBMi4z1TEw9M4BYe5CfVCUx39HcfbT7rdO/XZMDFnKXbkgolelO451nOK+x16JeyzMX18LuTyT+n3Uf1UwYesQ6RYyqwcI3EvvxU+mxP2YNyGtxt3c/prvAfYCG3hoUo4yEOWnIHcmrbMrJdrI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764896958; c=relaxed/simple; bh=rMRBv/ChXqoLELq8qKykFWomxTtcupwUcOcKG7qeZeE=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=UrwMsoYwYPeGutwvF1IP0/xtDHAO7KxNPHMh2cbpX/l/gQ7zcp0kg6VfVCeSoRqnvc5XXvWVI9X1r8Hy/dA+luKmKkDQ5RxEh8snACKPvmaUpTMZ2i3utVQ53QER29wT0WFIxLpIK5pKPDqDr8zpRQY3VtVXf/NC70+eWlWEWVk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=LbweWum0; arc=none smtp.client-ip=209.85.221.46 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="LbweWum0" Received: by mail-wr1-f46.google.com with SMTP id ffacd0b85a97d-42e2ba54a6fso636332f8f.3 for ; Thu, 04 Dec 2025 17:09:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1764896954; x=1765501754; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=m+mF3Gja/Pth6t91/XACwIVYUz7EioOwwJ2M/LMKxqY=; b=LbweWum0RlskAexYY8+YqyvKAGGstZi/DCVt5I9ZJGsqxMJL3AoB6VKiMixuUrKrVP kmRqmio6VcpZT/HCJNpxVGwd0muD+WAKKRHRrPW4969CXHQ413eAwWfs3kU97AUdh3El ARGy1FU8PRY15bjI0W7env9QMqYaj1f6ZZIv2Y3MI6jb7WHVNgjrsvN7nY3+tKgSlCic gjdoSpgpD2I6Jjpe9NuwVW9aLolzn6JJJY42doI/4OVLOBNL8DKviQmy5LKQwfHd74zz t2wSuDXgxS6VV2s2UZ8ZczFHN7xB99yaS3GHK5XjD7JM4x/UAxUQFJgsCLaeoRWapLTY FBLA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764896954; x=1765501754; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=m+mF3Gja/Pth6t91/XACwIVYUz7EioOwwJ2M/LMKxqY=; b=ELeKHjCwTz5EK43ht609Dp55k1E7knvnDFpSkr/8R85eRFvUq589jGhPSSMQi7mwRl lsBe7CJy1lLfNoJ3tNBk14sd7Yybmy43MgOe84Xktf2tzilOox/rZrpV5/Jad2MAfGUQ a+qNI1RxLdGgx1BTp+Mjc9pJbae63X2FB7bl/eCgqc61qnoiEH+DwPpC/pyN0Wc49tNo qytdweVbUv8Q0TkAp4YWyTvaqP3MQdQDNpw3nwyg+j2DUF+O8+hj+nYse8FiJ1XFsT6N +8Y80C6Vdbp/rOqqn/zobMzOUILgvf6EJB7zMtrHJnj8MxlxMSMmjA+NEADO3uTJPM16 hKtg== X-Forwarded-Encrypted: i=1; AJvYcCWoY2/z8N9J3DqptQclby2spc9F2a7dkYt92tUmWGxUB8GdXBgZ+LXbzfkTmSqZTCViYnQow49IQ5gABnQ=@vger.kernel.org X-Gm-Message-State: AOJu0YzMx2ImccX9pIexuUBDUlFLMwcsoRVdtRyfnUI8Z0aC25NxzneN XyIqP9fZW6tH1Li9+I400LUtci9VxBgsjBISnv1/GJdSes76YgoMHDjyGVleO8yMnIJwYub1Ovu 0hYvj5ZIQPvARLXnTFNjY7BwuRb3VE/4= X-Gm-Gg: ASbGncu4/sNFD4BKPiXpL2HuwOyfAA/alvvcjyFGWBeO6EFW1xjNvYAtJHMwZbur6pN IZbe1bI/zwjp8v1DzjKOTpWkA92c5GIjFz+FpFjluT+YVfwh2TGGPlDvKg6mvV1qFzHGTfE334f lf3creel1EY9w5558cQC519UhKMv2AgynOyy9AfQZbC2ZNHsjr3BqiS0p5Bsr8WM0MHV2txWUWo P6PYOfno9Ow609pF57zoV2iAMgK+yQexrfbGilm7u9Ky8mcLc1LIqghzBBzuxQlsWGX9cdylX7T auqSexjcXPWfQpf+PrPjcLBzHoBr65O2 X-Google-Smtp-Source: AGHT+IHrLxvQquVzeBGBF0tieKiREZvd+gfKaW/+zjkJAmLlTU45HN5GIeGBuFV6OBvncx3R42+sl70O/V0jBzKjc54= X-Received: by 2002:a05:6000:1887:b0:42b:2f90:bd05 with SMTP id ffacd0b85a97d-42f731c3290mr7979343f8f.45.1764896953705; Thu, 04 Dec 2025 17:09:13 -0800 (PST) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: In-Reply-To: From: Andrey Konovalov Date: Fri, 5 Dec 2025 02:09:02 +0100 X-Gm-Features: AQt7F2q4Ra3kjpdEcyDMUb7m8yHahuZhZTyWN3KMRPGCVySA_YBmuHFHNlC1cSE Message-ID: Subject: Re: [PATCH v3 2/3] kasan: Refactor pcpu kasan vmalloc unpoison To: Maciej Wieczor-Retman Cc: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Vincenzo Frascino , Andrew Morton , Uladzislau Rezki , Marco Elver , jiayuan.chen@linux.dev, stable@vger.kernel.org, Maciej Wieczor-Retman , kasan-dev@googlegroups.com, linux-kernel@vger.kernel.org, linux-mm@kvack.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Thu, Dec 4, 2025 at 8:00=E2=80=AFPM Maciej Wieczor-Retman wrote: > > From: Maciej Wieczor-Retman > > A KASAN tag mismatch, possibly causing a kernel panic, can be observed > on systems with a tag-based KASAN enabled and with multiple NUMA nodes. > It was reported on arm64 and reproduced on x86. It can be explained in > the following points: > > 1. There can be more than one virtual memory chunk. > 2. Chunk's base address has a tag. > 3. The base address points at the first chunk and thus inherits > the tag of the first chunk. > 4. The subsequent chunks will be accessed with the tag from the > first chunk. > 5. Thus, the subsequent chunks need to have their tag set to > match that of the first chunk. > > Refactor code by reusing __kasan_unpoison_vmalloc in a new helper in > preparation for the actual fix. > > Changelog v1 (after splitting of from the KASAN series): > - Rewrite first paragraph of the patch message to point at the user > impact of the issue. > - Move helper to common.c so it can be compiled in all KASAN modes. Nit: Can put this part after ---. > > Fixes: 1d96320f8d53 ("kasan, vmalloc: add vmalloc tagging for SW_TAGS") > Cc: # 6.1+ > Signed-off-by: Maciej Wieczor-Retman > --- > Changelog v3: > - Redo the patch after applying Andrey's comments to align the code more > with what's already in include/linux/kasan.h > > Changelog v2: > - Redo the whole patch so it's an actual refactor. > > include/linux/kasan.h | 15 +++++++++++++++ > mm/kasan/common.c | 17 +++++++++++++++++ > mm/vmalloc.c | 4 +--- > 3 files changed, 33 insertions(+), 3 deletions(-) > > diff --git a/include/linux/kasan.h b/include/linux/kasan.h > index 6d7972bb390c..cde493cb7702 100644 > --- a/include/linux/kasan.h > +++ b/include/linux/kasan.h > @@ -615,6 +615,16 @@ static __always_inline void kasan_poison_vmalloc(con= st void *start, > __kasan_poison_vmalloc(start, size); > } > > +void __kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms, > + kasan_vmalloc_flags_t flags); > +static __always_inline void > +kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms, > + kasan_vmalloc_flags_t flags) > +{ > + if (kasan_enabled()) > + __kasan_unpoison_vmap_areas(vms, nr_vms, flags); > +} > + > #else /* CONFIG_KASAN_VMALLOC */ > > static inline void kasan_populate_early_vm_area_shadow(void *start, > @@ -639,6 +649,11 @@ static inline void *kasan_unpoison_vmalloc(const voi= d *start, > static inline void kasan_poison_vmalloc(const void *start, unsigned long= size) > { } > > +static __always_inline void > +kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms, > + kasan_vmalloc_flags_t flags) > +{ } > + > #endif /* CONFIG_KASAN_VMALLOC */ > > #if (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)) && = \ > diff --git a/mm/kasan/common.c b/mm/kasan/common.c > index d4c14359feaf..1ed6289d471a 100644 > --- a/mm/kasan/common.c > +++ b/mm/kasan/common.c > @@ -28,6 +28,7 @@ > #include > #include > #include > +#include > > #include "kasan.h" > #include "../slab.h" > @@ -582,3 +583,19 @@ bool __kasan_check_byte(const void *address, unsigne= d long ip) > } > return true; > } > + > +#ifdef CONFIG_KASAN_VMALLOC > +void __kasan_unpoison_vmap_areas(struct vm_struct **vms, int nr_vms, > + kasan_vmalloc_flags_t flags) > +{ > + unsigned long size; > + void *addr; > + int area; > + > + for (area =3D 0 ; area < nr_vms ; area++) { > + size =3D vms[area]->size; > + addr =3D vms[area]->addr; > + vms[area]->addr =3D __kasan_unpoison_vmalloc(addr, size, = flags); > + } > +} > +#endif > diff --git a/mm/vmalloc.c b/mm/vmalloc.c > index 22a73a087135..33e705ccafba 100644 > --- a/mm/vmalloc.c > +++ b/mm/vmalloc.c > @@ -4872,9 +4872,7 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned= long *offsets, > * With hardware tag-based KASAN, marking is skipped for > * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc(). > */ > - for (area =3D 0; area < nr_vms; area++) > - vms[area]->addr =3D kasan_unpoison_vmalloc(vms[area]->add= r, > - vms[area]->size, KASAN_VMALLOC_PROT_NORMA= L); > + kasan_unpoison_vmap_areas(vms, nr_vms, KASAN_VMALLOC_PROT_NORMAL)= ; > > kfree(vas); > return vms; > -- > 2.52.0 > Reviewed-by: Andrey Konovalov