The quilt patch titled
Subject: fork, vmalloc: KASAN-poison backing pages of vmapped stacks
has been removed from the -mm tree. Its filename was
fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks.patch
This patch was dropped because an updated version will be merged
------------------------------------------------------
From: Jann Horn <jannh@xxxxxxxxxx>
Subject: fork, vmalloc: KASAN-poison backing pages of vmapped stacks
Date: Tue, 17 Jan 2023 17:35:43 +0100
KASAN (except in HW_TAGS mode) tracks memory state based on virtual
addresses. The mappings of kernel stack pages in the linear mapping are
currently marked as fully accessible.
Since stack corruption issues can cause some very gnarly errors, let's be
extra careful and tell KASAN to forbid accesses to stack memory through
the linear mapping.
Link: https://lkml.kernel.org/r/20230117163543.1049025-1-jannh@xxxxxxxxxx
Signed-off-by: Jann Horn <jannh@xxxxxxxxxx>
Cc: Alexander Potapenko <glider@xxxxxxxxxx>
Cc: Andrey Konovalov <andreyknvl@xxxxxxxxx>
Cc: Andrey Ryabinin <ryabinin.a.a@xxxxxxxxx>
Cc: Andy Lutomirski <luto@xxxxxxxxxx>
Cc: Christoph Hellwig <hch@xxxxxxxxxxxxx>
Cc: Dmitry Vyukov <dvyukov@xxxxxxxxxx>
Cc: Uladzislau Rezki (Sony) <urezki@xxxxxxxxx>
Cc: Vincenzo Frascino <vincenzo.frascino@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
--- a/include/linux/vmalloc.h~fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks
+++ a/include/linux/vmalloc.h
@@ -298,4 +298,10 @@ bool vmalloc_dump_obj(void *object);
static inline bool vmalloc_dump_obj(void *object) { return false; }
#endif
+#if defined(CONFIG_MMU) && (defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS))
+void vmalloc_poison_backing_pages(const void *addr);
+#else
+static inline void vmalloc_poison_backing_pages(const void *addr) {}
+#endif
+
#endif /* _LINUX_VMALLOC_H */
--- a/kernel/fork.c~fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks
+++ a/kernel/fork.c
@@ -321,6 +321,16 @@ static int alloc_thread_stack_node(struc
vfree(stack);
return -ENOMEM;
}
+
+ /*
+ * A virtually-allocated stack's memory should only be accessed through
+ * the vmalloc area, not through the linear mapping.
+ * Inform KASAN that all accesses through the linear mapping should be
+ * reported (instead of permitting all accesses through the linear
+ * mapping).
+ */
+ vmalloc_poison_backing_pages(stack);
+
/*
* We can't call find_vm_area() in interrupt context, and
* free_thread_stack() can be called in interrupt context,
--- a/mm/vmalloc.c~fork-vmalloc-kasan-poison-backing-pages-of-vmapped-stacks
+++ a/mm/vmalloc.c
@@ -4147,6 +4147,30 @@ void pcpu_free_vm_areas(struct vm_struct
}
#endif /* CONFIG_SMP */
+#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
+/*
+ * Poison the KASAN shadow for the linear mapping of the pages used as stack
+ * memory.
+ * NOTE: This makes no sense in HW_TAGS mode because HW_TAGS marks physical
+ * memory, not virtual memory.
+ */
+void vmalloc_poison_backing_pages(const void *addr)
+{
+ struct vm_struct *area;
+ int i;
+
+ if (WARN(!PAGE_ALIGNED(addr), "bad address (%p)\n", addr))
+ return;
+
+ area = find_vm_area(addr);
+ if (WARN(!area, "nonexistent vm area (%p)\n", addr))
+ return;
+
+ for (i = 0; i < area->nr_pages; i++)
+ kasan_poison_pages(area->pages[i], 0, false);
+}
+#endif
+
#ifdef CONFIG_PRINTK
bool vmalloc_dump_obj(void *object)
{
_
Patches currently in -mm which might be from jannh@xxxxxxxxxx are
mm-khugepaged-fix-anon_vma-race.patch
