• Andrey Konovalov's avatar
    kasan: suppress recursive reports for HW_TAGS · c6a690e0
    Andrey Konovalov authored
    KASAN suppresses reports for bad accesses done by the KASAN reporting
    code.  The reporting code might access poisoned memory for reporting
    purposes.
    
    Software KASAN modes do this by suppressing reports during reporting via
    current->kasan_depth, the same way they suppress reports during accesses
    to poisoned slab metadata.
    
    Hardware Tag-Based KASAN does not use current->kasan_depth, and instead
    resets pointer tags for accesses to poisoned memory done by the reporting
    code.
    
    Despite that, a recursive report can still happen:
    
    1. On hardware with faulty MTE support. This was observed by Weizhao
       Ouyang on a faulty hardware that caused memory tags to randomly change
       from time to time.
    
    2. Theoretically, due to a previous MTE-undetected memory corruption.
    
    A recursive report can happen via:
    
    1. Accessing a pointer with a non-reset tag in the reporting code, e.g.
       slab->slab_cache, which is what Weizhao Ouyang observed.
    
    2. Theoretically, via external non-annotated routines, e.g. stackdepot.
    
    To resolve this issue, resetting tags for all of the pointers in the
    reporting code and all the used external routines would be impractical.
    
    Instead, disable tag checking done by the CPU for the duration of KASAN
    reporting for Hardware Tag-Based KASAN.
    
    Without this fix, Hardware Tag-Based KASAN reporting code might deadlock.
    
    [andreyknvl@google.com: disable preemption instead of migration, fix comment typo]
      Link: https://lkml.kernel.org/r/d14417c8bc5eea7589e99381203432f15c0f9138.1680114854.git.andreyknvl@google.com
    Link: https://lkml.kernel.org/r/59f433e00f7fa985e8bf9f7caf78574db16b67ab.1678491668.git.andreyknvl@google.com
    Fixes: 2e903b91 ("kasan, arm64: implement HW_TAGS runtime")
    Signed-off-by: default avatarAndrey Konovalov <andreyknvl@google.com>
    Reported-by: default avatarWeizhao Ouyang <ouyangweizhao@zeku.com>
    Reviewed-by: default avatarMarco Elver <elver@google.com>
    Cc: Alexander Potapenko <glider@google.com>
    Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
    Cc: Catalin Marinas <catalin.marinas@arm.com>
    Cc: Dmitry Vyukov <dvyukov@google.com>
    Cc: Evgenii Stepanov <eugenis@google.com>
    Cc: Peter Collingbourne <pcc@google.com>
    Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
    Cc: Will Deacon <will@kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    c6a690e0
report.c 16.8 KB