Hi, That's more of an RFC to get a discussion started. I plan to eventually apply the third patch reverting the page_kasan_tag_reset() calls under arch/arm64 since they don't cover all cases (the race is rare and we haven't hit anything yet but it's possible). On a system with MTE and KASAN_HW_TAGS enabled, when a page is allocated kasan_unpoison_pages() sets a random tag and saves it in page->flags so that page_to_virt() re-creates the correct tagged pointer. We need to ensure that the in-memory tags are visible before setting the page->flags: P0 (__kasan_unpoison_range): P1 (access via virt_to_page): Wtags=x Rflags=x | | | DMB | address dependency V V Wflags=x Rtags=x The first patch changes the order of page unpoisoning with the tag storing in page->flags. page_kasan_tag_set() has the right barriers through try_cmpxchg(). If such page is mapped in user-space with PROT_MTE, the architecture code will set the tag to 0 and a subsequent page_to_virt() dereference will fault. We currently try to fix this by resetting the tag in page->flags so that it is 0xff (match-all, not faulting). However, setting the tags and flags can race with another CPU reading the flags (page_to_virt()) and barriers can't help, e.g.: P0 (mte_sync_page_tags): P1 (memcpy from virt_to_page): Rflags!=0xff Wflags=0xff DMB (doesn't help) Wtags=0 Rtags=0 // fault Since clearing the flags in the arch code doesn't work, try to do this at page allocation time by a new flag added to GFP_USER. Could we instead add __GFP_SKIP_KASAN_UNPOISON rather than a new flag? Thanks. Catalin Marinas (3): mm: kasan: Ensure the tags are visible before the tag in page->flags mm: kasan: Reset the tag on pages intended for user arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags" arch/arm64/kernel/hibernate.c | 5 ----- arch/arm64/kernel/mte.c | 9 --------- arch/arm64/mm/copypage.c | 9 --------- arch/arm64/mm/fault.c | 1 - arch/arm64/mm/mteswap.c | 9 --------- include/linux/gfp.h | 10 +++++++--- mm/kasan/common.c | 3 ++- mm/page_alloc.c | 9 ++++++--- 8 files changed, 15 insertions(+), 40 deletions(-)