The patch titled
Subject: fork, vmalloc: KASAN-poison backing pages of vmapped stacks
has been added to the -mm mm-unstable branch. Its filename is
fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks.patch
This patch will shortly appear at
https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patches/fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks.patch
This patch will later appear in the mm-unstable branch at
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next via the mm-everything
branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
and is updated there every 2-3 working days
------------------------------------------------------
From: Jann Horn <jannh@xxxxxxxxxx>
Subject: fork, vmalloc: KASAN-poison backing pages of vmapped stacks
Date: Tue, 17 Jan 2023 17:35:43 +0100
KASAN (except in HW_TAGS mode) tracks memory state based on virtual
addresses. The mappings of kernel stack pages in the linear mapping are
currently marked as fully accessible.
Since stack corruption issues can cause some very gnarly errors, let's be
extra careful and tell KASAN to forbid accesses to stack memory through
the linear mapping.
Link: https://lkml.kernel.org/r/20230117163543.1049025-1-jannh@xxxxxxxxxx
Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Cc: Andrey Konovalov <andreyknvl@xxxxxxxxx>
Cc: Andrey Ryabinin <ryabinin.a.a@xxxxxxxxx>
Cc: Andy Lutomirski <luto@xxxxxxxxxx>
Cc: Christoph Hellwig <hch@xxxxxxxxxxxxx>
Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Uladzislau Rezki (Sony) <urezki@xxxxxxxxx>
Cc: Vincenzo Frascino <vincenzo.frascino@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
--- a/include/linux/vmalloc.h~fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks
+++ a/include/linux/vmalloc.h
@@ -298,4 +298,10 @@ bool vmalloc_dump_obj(void *object);
static inline bool vmalloc_dump_obj(void *object) { return false; }
#endif
+#if defined(CONFIG_MMU) && (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS))
+void vmalloc_poison_backing_pages(const void *addr);
+#else
+static inline void vmalloc_poison_backing_pages(const void *addr) {}
+#endif
+
#endif /* _LINUX_VMALLOC_H */
--- a/kernel/fork.c~fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks
+++ a/kernel/fork.c
@@ -321,6 +321,16 @@ static int alloc_thread_stack_node(struc
vfree(stack);
return -ENOMEM;
}
+
+ /*
+ * A virtually-allocated stack's memory should only be accessed through
+ * the vmalloc area, not through the linear mapping.
+ * Inform KASAN that all accesses through the linear mapping should be
+ * reported (instead of permitting all accesses through the linear
+ * mapping).
+ */
+ vmalloc_poison_backing_pages(stack);
+
/*
* We can't call find_vm_area() in interrupt context, and
* free_thread_stack() can be called in interrupt context,
--- a/mm/vmalloc.c~fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks
+++ a/mm/vmalloc.c
@@ -4147,6 +4147,30 @@ void pcpu_free_vm_areas(struct vm_struct
}
#endif /* CONFIG_SMP */
+#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
+/*
+ * Poison the KASAN shadow for the linear mapping of the pages used as stack
+ * memory.
+ * NOTE: This makes no sense in HW_TAGS mode because HW_TAGS marks physical
+ * memory, not virtual memory.
+ */
+void vmalloc_poison_backing_pages(const void *addr)
+{
+ struct vm_struct *area;
+ int i;
+
+ if (WARN(!PAGE_ALIGNED(addr), "bad address (%p)\n", addr))
+ return;
+
+ area = find_vm_area(addr);
+ if (WARN(!area, "nonexistent vm area (%p)\n", addr))
+ return;
+
+ for (i = 0; i < area->nr_pages; i++)
+ kasan_poison_pages(area->pages[i], 0, false);
+}
+#endif
+
#ifdef CONFIG_PRINTK
bool vmalloc_dump_obj(void *object)
{
_
Patches currently in -mm which might be from jannh@xxxxxxxxxx are
mm-khugepaged-fix-anon_vma-race.patch
fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks.patch
