tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

mm/kasan: avoid lazy MMU mode hazards

Functions __kasan_populate_vmalloc() and __kasan_depopulate_vmalloc() use
apply_to_pte_range(), which enters lazy MMU mode. In that mode updating
PTEs may not be observed until the mode is left.

That may lead to a situation in which otherwise correct reads and writes
to a PTE using ptep_get(), set_pte(), pte_clear() and other access
primitives bring wrong results when the vmalloc shadow memory is being
(de-)populated.

To avoid these hazards leave the lazy MMU mode before and re-enter it
after each PTE manipulation.

Link: https://lkml.kernel.org/r/0d2efb7ddddbff6b288fbffeeb10166e90771718.1755528662.git.agordeev@linux.ibm.com
Fixes: 3c5c3cfb9ef4 ("kasan: support backing vmalloc space with real shadow memory")
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Daniel Axtens <dja@axtens.net>
Cc: Marc Rutland <mark.rutland@arm.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

authored by

Alexander Gordeev and committed by
Andrew Morton c519c3c0 08c7c253

+8
+8
mm/kasan/shadow.c
··· 305 305 pte_t pte; 306 306 int index; 307 307 308 + arch_leave_lazy_mmu_mode(); 309 + 308 310 index = PFN_DOWN(addr - data->start); 309 311 page = data->pages[index]; 310 312 __memset(page_to_virt(page), KASAN_VMALLOC_INVALID, PAGE_SIZE); ··· 318 316 data->pages[index] = NULL; 319 317 } 320 318 spin_unlock(&init_mm.page_table_lock); 319 + 320 + arch_enter_lazy_mmu_mode(); 321 321 322 322 return 0; 323 323 } ··· 465 461 pte_t pte; 466 462 int none; 467 463 464 + arch_leave_lazy_mmu_mode(); 465 + 468 466 spin_lock(&init_mm.page_table_lock); 469 467 pte = ptep_get(ptep); 470 468 none = pte_none(pte); ··· 476 470 477 471 if (likely(!none)) 478 472 __free_page(pfn_to_page(pte_pfn(pte))); 473 + 474 + arch_enter_lazy_mmu_mode(); 479 475 480 476 return 0; 481 477 }