On Thu, Nov 05, 2020 at 12:18:43AM +0100, Andrey Konovalov wrote:
> diff --git a/arch/arm64/kernel/mte.c b/arch/arm64/kernel/mte.c
> index 8f99c65837fd..06ba6c923ab7 100644
> --- a/arch/arm64/kernel/mte.c
> +++ b/arch/arm64/kernel/mte.c
> @@ -34,6 +34,7 @@ static void mte_sync_page_tags(struct page *page, pte_t *ptep, bool check_swap)
> return;
> }
>
> + page_kasan_tag_reset(page);
> mte_clear_page_tags(page_address(page));
I think we need an smp_wmb() between setting the flags and clearing the
actual tags. If another threads reads page->flags and builds a tagged
address out of it (see page_to_virt) there's an address dependency to
the actual memory access. However, on the current thread, we don't
guarantee that the new page->flags are visible before the tags were
updated.
> }
>
> diff --git a/arch/arm64/mm/copypage.c b/arch/arm64/mm/copypage.c
> index 70a71f38b6a9..348f4627da08 100644
> --- a/arch/arm64/mm/copypage.c
> +++ b/arch/arm64/mm/copypage.c
> @@ -22,6 +22,7 @@ void copy_highpage(struct page *to, struct page *from)
> copy_page(kto, kfrom);
>
> if (system_supports_mte() && test_bit(PG_mte_tagged, &from->flags)) {
> + page_kasan_tag_reset(to);
> set_bit(PG_mte_tagged, &to->flags);
> mte_copy_page_tags(kto, kfrom);
Nitpick: move page_kasan_tag_reset() just above mte_copy_page_tags() for
consistency with the other places where PG_mte_tagged is set before or
after the actual tag setting.
> }
> diff --git a/arch/arm64/mm/mteswap.c b/arch/arm64/mm/mteswap.c
> index c52c1847079c..0e7eccbe598a 100644
> --- a/arch/arm64/mm/mteswap.c
> +++ b/arch/arm64/mm/mteswap.c
> @@ -53,6 +53,7 @@ bool mte_restore_tags(swp_entry_t entry, struct page *page)
> if (!tags)
> return false;
>
> + page_kasan_tag_reset(page);
> mte_restore_page_tags(page_address(page), tags);
There is another mte_restore_page_tags() caller in hibernate.c. That one
doesn't need page_kasan_tag_reset() since the page->flags would have
been already restored but please add a comment in that file why its not
needed.
--
Catalin
