Hi, That's a second attempt on fixing the race race between setting the allocation (in-memory) tags in a page and the corresponding logical tag in page->flags. Initial version here: https://lore.kernel.org/r/20220517180945.756303-1-catalin.marinas@xxxxxxx This new series does not introduce any new GFP flags but instead always skips unpoisoning of the user pages (we already skip the poisoning on free). Any unpoisoned page will have the page->flags tag reset. For the background: On a system with MTE and KASAN_HW_TAGS enabled, when a page is allocated kasan_unpoison_pages() sets a random tag and saves it in page->flags so that page_to_virt() re-creates the correct tagged pointer. We need to ensure that the in-memory tags are visible before setting the page->flags: P0 (__kasan_unpoison_range): P1 (access via virt_to_page): Wtags=x Rflags=x | | | DMB | address dependency V V Wflags=x Rtags=x The first patch changes the order of page unpoisoning with the tag storing in page->flags. page_kasan_tag_set() has the right barriers through try_cmpxchg(). If a page is mapped in user-space with PROT_MTE, the architecture code will set the allocation tag to 0 and a subsequent page_to_virt() dereference will fault. We currently try to fix this by resetting the tag in page->flags so that it is 0xff (match-all, not faulting). However, setting the tags and flags can race with another CPU reading the flags (page_to_virt()) and barriers can't help, e.g.: P0 (mte_sync_page_tags): P1 (memcpy from virt_to_page): Rflags!=0xff Wflags=0xff DMB (doesn't help) Wtags=0 Rtags=0 // fault Since clearing the flags in the arch code doesn't work, to do this at page allocation time when __GFP_SKIP_KASAN_UNPOISON is passed. Thanks. Catalin Marinas (4): mm: kasan: Ensure the tags are visible before the tag in page->flags mm: kasan: Skip unpoisoning of user pages mm: kasan: Skip page unpoisoning only if __GFP_SKIP_KASAN_UNPOISON arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags" arch/arm64/kernel/hibernate.c | 5 ----- arch/arm64/kernel/mte.c | 9 --------- arch/arm64/mm/copypage.c | 9 --------- arch/arm64/mm/fault.c | 1 - arch/arm64/mm/mteswap.c | 9 --------- include/linux/gfp.h | 2 +- mm/kasan/common.c | 3 ++- mm/page_alloc.c | 19 ++++++++++--------- 8 files changed, 13 insertions(+), 44 deletions(-)
