This is a note to let you know that I've just added the patch titled riscv: Do not re-populate shadow memory with kasan_populate_early_shadow to the 5.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: riscv-do-not-re-populate-shadow-memory-with-kasan_populate_early_shadow.patch and it can be found in the queue-5.14 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From cf11d01135ea1ff7fddb612033e3cb5cde279ff2 Mon Sep 17 00:00:00 2001 From: Alexandre Ghiti <alexandre.ghiti@xxxxxxxxxxxxx> Date: Fri, 29 Oct 2021 06:59:26 +0200 Subject: riscv: Do not re-populate shadow memory with kasan_populate_early_shadow From: Alexandre Ghiti <alexandre.ghiti@xxxxxxxxxxxxx> commit cf11d01135ea1ff7fddb612033e3cb5cde279ff2 upstream. When calling this function, all the shadow memory is already populated with kasan_early_shadow_pte which has PAGE_KERNEL protection. kasan_populate_early_shadow write-protects the mapping of the range of addresses passed in argument in zero_pte_populate, which actually write-protects all the shadow memory mapping since kasan_early_shadow_pte is used for all the shadow memory at this point. And then when using memblock API to populate the shadow memory, the first write access to the kernel stack triggers a trap. This becomes visible with the next commit that contains a fix for asan-stack. We already manually populate all the shadow memory in kasan_early_init and we write-protect kasan_early_shadow_pte at the end of kasan_init which makes the calls to kasan_populate_early_shadow superfluous so we can remove them. Signed-off-by: Alexandre Ghiti <alexandre.ghiti@xxxxxxxxxxxxx> Fixes: e178d670f251 ("riscv/kasan: add KASAN_VMALLOC support") Fixes: 8ad8b72721d0 ("riscv: Add KASAN support") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Palmer Dabbelt <palmerdabbelt@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- arch/riscv/mm/kasan_init.c | 11 ----------- 1 file changed, 11 deletions(-) --- a/arch/riscv/mm/kasan_init.c +++ b/arch/riscv/mm/kasan_init.c @@ -172,21 +172,10 @@ void __init kasan_init(void) phys_addr_t p_start, p_end; u64 i; - /* - * Populate all kernel virtual address space with kasan_early_shadow_page - * except for the linear mapping and the modules/kernel/BPF mapping. - */ - kasan_populate_early_shadow((void *)KASAN_SHADOW_START, - (void *)kasan_mem_to_shadow((void *) - VMEMMAP_END)); if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) kasan_shallow_populate( (void *)kasan_mem_to_shadow((void *)VMALLOC_START), (void *)kasan_mem_to_shadow((void *)VMALLOC_END)); - else - kasan_populate_early_shadow( - (void *)kasan_mem_to_shadow((void *)VMALLOC_START), - (void *)kasan_mem_to_shadow((void *)VMALLOC_END)); /* Populate the linear mapping */ for_each_mem_range(i, &p_start, &p_end) { Patches currently in stable-queue which might be from alexandre.ghiti@xxxxxxxxxxxxx are queue-5.14/riscv-do-not-re-populate-shadow-memory-with-kasan_populate_early_shadow.patch queue-5.14/riscv-fix-asan-stack-clang-build.patch