linux/mm/kasan
Andrey Konovalov c6a690e0c9 kasan: suppress recursive reports for HW_TAGS
KASAN suppresses reports for bad accesses done by the KASAN reporting
code.  The reporting code might access poisoned memory for reporting
purposes.

Software KASAN modes do this by suppressing reports during reporting via
current->kasan_depth, the same way they suppress reports during accesses
to poisoned slab metadata.

Hardware Tag-Based KASAN does not use current->kasan_depth, and instead
resets pointer tags for accesses to poisoned memory done by the reporting
code.

Despite that, a recursive report can still happen:

1. On hardware with faulty MTE support. This was observed by Weizhao
   Ouyang on a faulty hardware that caused memory tags to randomly change
   from time to time.

2. Theoretically, due to a previous MTE-undetected memory corruption.

A recursive report can happen via:

1. Accessing a pointer with a non-reset tag in the reporting code, e.g.
   slab->slab_cache, which is what Weizhao Ouyang observed.

2. Theoretically, via external non-annotated routines, e.g. stackdepot.

To resolve this issue, resetting tags for all of the pointers in the
reporting code and all the used external routines would be impractical.

Instead, disable tag checking done by the CPU for the duration of KASAN
reporting for Hardware Tag-Based KASAN.

Without this fix, Hardware Tag-Based KASAN reporting code might deadlock.

[andreyknvl@google.com: disable preemption instead of migration, fix comment typo]
  Link: https://lkml.kernel.org/r/d14417c8bc5eea7589e99381203432f15c0f9138.1680114854.git.andreyknvl@google.com
Link: https://lkml.kernel.org/r/59f433e00f7fa985e8bf9f7caf78574db16b67ab.1678491668.git.andreyknvl@google.com
Fixes: 2e903b9147 ("kasan, arm64: implement HW_TAGS runtime")
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reported-by: Weizhao Ouyang <ouyangweizhao@zeku.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2023-04-05 19:42:43 -07:00
..
common.c lib/stacktrace, kasan, kmsan: rework extra_bits interface 2023-02-16 20:43:51 -08:00
generic.c Merge branch 'mm-hotfixes-stable' into mm-stable 2023-02-10 15:34:48 -08:00
hw_tags.c kasan, arm64: rename tagging-related routines 2023-04-05 19:42:43 -07:00
init.c kasan: use MAX_PTRS_PER_* for early shadow tables 2021-06-29 10:53:53 -07:00
kasan_test_module.c kasan: migrate workqueue_uaf test to kunit 2022-11-08 17:37:14 -08:00
kasan_test.c kasan, arm64: rename tagging-related routines 2023-04-05 19:42:43 -07:00
kasan.h kasan, arm64: add arch_suppress_tag_checks_start/stop 2023-04-05 19:42:43 -07:00
Makefile kasan: test: fix test for new meminstrinsic instrumentation 2023-03-02 21:54:22 -08:00
quarantine.c kasan: give better names to shadow values 2022-05-13 07:20:19 -07:00
report_generic.c kasan: infer allocation size by scanning metadata 2023-02-09 16:51:40 -08:00
report_hw_tags.c kasan: infer allocation size by scanning metadata 2023-02-09 16:51:40 -08:00
report_sw_tags.c kasan: infer allocation size by scanning metadata 2023-02-09 16:51:40 -08:00
report_tags.c kasan: infer allocation size by scanning metadata 2023-02-09 16:51:40 -08:00
report.c kasan: suppress recursive reports for HW_TAGS 2023-04-05 19:42:43 -07:00
shadow.c kasan: treat meminstrinsic as builtins in uninstrumented files 2023-03-02 21:54:22 -08:00
sw_tags.c kasan: infer allocation size by scanning metadata 2023-02-09 16:51:40 -08:00
tags.c kasan: dynamically allocate stack ring entries 2022-10-03 14:03:02 -07:00