From: Andrey Konovalov <redacted>

This patch adds vmalloc tagging support to HW_TAGS KASAN.

The key difference between HW_TAGS and the other two KASAN modes
when it comes to vmalloc: HW_TAGS KASAN can only assign tags to
physical memory. The other two modes have shadow memory covering
every mapped virtual memory region.

This patch makes __kasan_unpoison_vmalloc() for HW_TAGS KASAN:

- Skip non-VM_ALLOC mappings as HW_TAGS KASAN can only tag a single
  mapping of normal physical memory; see the comment in the function.
- Generate a random tag, tag the returned pointer and the allocation,
  and initialize the allocation at the same time.
- Propagate the tag into the page stucts to allow accesses through
  page_address(vmalloc_to_page()).

The rest of vmalloc-related KASAN hooks are not needed:

- The shadow-related ones are fully skipped.
- __kasan_poison_vmalloc() is kept as a no-op with a comment.

Poisoning and zeroing of physical pages that are backing vmalloc()
allocations are skipped via __GFP_SKIP_KASAN_UNPOISON and
__GFP_SKIP_ZERO: __kasan_unpoison_vmalloc() does that instead.

This patch allows enabling CONFIG_KASAN_VMALLOC with HW_TAGS
and adjusts CONFIG_KASAN_VMALLOC description:

- Mention HW_TAGS support.
- Remove unneeded internal details: they have no place in Kconfig
  description and are already explained in the documentation.

Signed-off-by: Andrey Konovalov <redacted>
Co-developed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>

---

Changes v1->v2:
- Allow enabling CONFIG_KASAN_VMALLOC with HW_TAGS in this patch.
- Move memory init for page_alloc pages backing vmalloc() into
  kasan_unpoison_vmalloc().
---
 include/linux/kasan.h | 30 +++++++++++++--
 lib/Kconfig.kasan     | 20 +++++-----
 mm/kasan/hw_tags.c    | 89 +++++++++++++++++++++++++++++++++++++++++++
 mm/kasan/shadow.c     | 11 +++++-
 mm/vmalloc.c          | 32 +++++++++++++---
 5 files changed, 162 insertions(+), 20 deletions(-)

diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 6a2619759e93..0bdc2b824b9c 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h

@@ -417,19 +417,40 @@ static inline void kasan_init_hw_tags(void) { }

 #ifdef CONFIG_KASAN_VMALLOC

+#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
+
 void kasan_populate_early_vm_area_shadow(void *start, unsigned long size);
 int kasan_populate_vmalloc(unsigned long addr, unsigned long size);
 void kasan_release_vmalloc(unsigned long start, unsigned long end,
                           unsigned long free_region_start,
                           unsigned long free_region_end);

+#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
+
+static inline void kasan_populate_early_vm_area_shadow(void *start,
+                                                      unsigned long size)
+{ }
+static inline int kasan_populate_vmalloc(unsigned long start,
+                                       unsigned long size)
+{
+       return 0;
+}
+static inline void kasan_release_vmalloc(unsigned long start,
+                                        unsigned long end,
+                                        unsigned long free_region_start,
+                                        unsigned long free_region_end) { }
+
+#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
+
 void * __must_check __kasan_unpoison_vmalloc(const void *start,
-                                            unsigned long size);
+                                            unsigned long size,
+                                            bool vm_alloc, bool init);
 static __always_inline void * __must_check kasan_unpoison_vmalloc(
-                                       const void *start, unsigned long size)
+                                       const void *start, unsigned long size,
+                                       bool vm_alloc, bool init)
 {
        if (kasan_enabled())
-               return __kasan_unpoison_vmalloc(start, size);
+               return __kasan_unpoison_vmalloc(start, size, vm_alloc, init);
        return (void *)start;
 }

@@ -456,7 +477,8 @@ static inline void kasan_release_vmalloc(unsigned long start,
                                         unsigned long free_region_end) { }

 static inline void *kasan_unpoison_vmalloc(const void *start,
-                                          unsigned long size, bool unique)
+                                          unsigned long size,
+                                          bool vm_alloc, bool init)
 {
        return (void *)start;
 }

diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index 3f144a87f8a3..7834c35a7964 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan

@@ -178,17 +178,17 @@ config KASAN_TAGS_IDENTIFY
          memory consumption.

 config KASAN_VMALLOC
-       bool "Back mappings in vmalloc space with real shadow memory"
-       depends on (KASAN_GENERIC || KASAN_SW_TAGS) && HAVE_ARCH_KASAN_VMALLOC
+       bool "Check accesses to vmalloc allocations"
+       depends on HAVE_ARCH_KASAN_VMALLOC
        help
-         By default, the shadow region for vmalloc space is the read-only
-         zero page. This means that KASAN cannot detect errors involving
-         vmalloc space.
-
-         Enabling this option will hook in to vmap/vmalloc and back those
-         mappings with real shadow memory allocated on demand. This allows
-         for KASAN to detect more sorts of errors (and to support vmapped
-         stacks), but at the cost of higher memory usage.
+         This mode makes KASAN check accesses to vmalloc allocations for
+         validity.
+
+         With software KASAN modes, checking is done for all types of vmalloc
+         allocations. Enabling this option leads to higher memory usage.
+
+         With hardware tag-based KASAN, only VM_ALLOC mappings are checked.
+         There is no additional memory usage.

 config KASAN_KUNIT_TEST
        tristate "KUnit-compatible tests of KASAN bug detection capabilities" if !KUNIT_ALL_TESTS

diff --git a/mm/kasan/hw_tags.c b/mm/kasan/hw_tags.c
index 76cf2b6229c7..837c260beec6 100644
--- a/mm/kasan/hw_tags.c
+++ b/mm/kasan/hw_tags.c

@@ -192,6 +192,95 @@ void __init kasan_init_hw_tags(void)
                kasan_stack_collection_enabled() ? "on" : "off");
 }

+#ifdef CONFIG_KASAN_VMALLOC
+
+static void unpoison_vmalloc_pages(const void *addr, u8 tag)
+{
+       struct vm_struct *area;
+       int i;
+
+       /*
+        * As hardware tag-based KASAN only tags VM_ALLOC vmalloc allocations
+        * (see the comment in __kasan_unpoison_vmalloc), all of the pages
+        * should belong to a single area.
+        */
+       area = find_vm_area((void *)addr);
+       if (WARN_ON(!area))
+               return;
+
+       for (i = 0; i < area->nr_pages; i++) {
+               struct page *page = area->pages[i];
+
+               page_kasan_tag_set(page, tag);
+       }
+}
+
+void *__kasan_unpoison_vmalloc(const void *start, unsigned long size,
+                               bool vm_alloc, bool init)
+{
+       u8 tag;
+       unsigned long redzone_start, redzone_size;
+
+       if (!is_vmalloc_or_module_addr(start))
+               return (void *)start;
+
+       /* Unpoisoning and pointer tag assignment is skipped for non-VM_ALLOC
+        * mappings as:
+        *
+        * 1. Unlike the software KASAN modes, hardware tag-based KASAN only
+        *    supports tagging physical memory. Therefore, it can only tag a
+        *    single mapping of normal physical pages.
+        * 2. Hardware tag-based KASAN can only tag memory mapped with special
+        *    mapping protection bits, see arch_vmalloc_pgprot_modify().
+        *    As non-VM_ALLOC mappings can be mapped outside of vmalloc code,
+        *    providing these bits would require tracking all non-VM_ALLOC
+        *    mappers.
+        *
+        * Thus, for VM_ALLOC mappings, hardware tag-based KASAN only tags
+        * the first virtual mapping, which is created by vmalloc().
+        * Tagging the page_alloc memory backing that vmalloc() allocation is
+        * skipped, see ___GFP_SKIP_KASAN_UNPOISON.
+        *
+        * For non-VM_ALLOC allocations, page_alloc memory is tagged as usual.
+        */
+       if (!vm_alloc)
+               return (void *)start;
+
+       tag = kasan_random_tag();
+       start = set_tag(start, tag);
+
+       /* Unpoison and initialize memory up to size. */
+       kasan_unpoison(start, size, init);
+
+       /*
+        * Explicitly poison and initialize the in-page vmalloc() redzone.
+        * Unlike software KASAN modes, hardware tag-based KASAN doesn't
+        * unpoison memory when populating shadow for vmalloc() space.
+        */
+       redzone_start = round_up((unsigned long)start + size, KASAN_GRANULE_SIZE);
+       redzone_size = round_up(redzone_start, PAGE_SIZE) - redzone_start;
+       kasan_poison((void *)redzone_start, redzone_size, KASAN_TAG_INVALID, init);
+
+       /*
+        * Set per-page tag flags to allow accessing physical memory for the
+        * vmalloc() mapping through page_address(vmalloc_to_page()).
+        */
+       unpoison_vmalloc_pages(start, tag);
+
+       return (void *)start;
+}
+
+void __kasan_poison_vmalloc(const void *start, unsigned long size)
+{
+       /*
+        * No tagging here.
+        * The physical pages backing the vmalloc() allocation are poisoned
+        * through the usual page_alloc paths.
+        */
+}
+
+#endif
+
 #if IS_ENABLED(CONFIG_KASAN_KUNIT_TEST)

 void kasan_enable_tagging_sync(void)

diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c
index 4ca280a96fbc..8600dd925f35 100644
--- a/mm/kasan/shadow.c
+++ b/mm/kasan/shadow.c

@@ -475,8 +475,17 @@ void kasan_release_vmalloc(unsigned long start, unsigned long end,
        }
 }

-void *__kasan_unpoison_vmalloc(const void *start, unsigned long size)
+void *__kasan_unpoison_vmalloc(const void *start, unsigned long size,
+                               bool vm_alloc, bool init)
 {
+       /*
+        * Software tag-based KASAN tags both VM_ALLOC and non-VM_ALLOC
+        * mappings, so the vm_alloc argument is ignored.
+        * Software tag-based KASAN can't optimize zeroing memory by combining
+        * it with setting memory tags, so the init argument is ignored;
+        * vmalloc() memory is poisoned via page_alloc.
+        */
+
        if (!is_vmalloc_or_module_addr(start))
                return (void *)start;

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 82ef1e27e2e4..d48db7cc3358 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c

@@ -2214,8 +2214,12 @@ void *vm_map_ram(struct page **pages, unsigned int count, int node)
                return NULL;
        }

-       /* Mark the pages as accessible after they were mapped in. */
-       mem = kasan_unpoison_vmalloc(mem, size);
+       /*
+        * Mark the pages as accessible after they were mapped in.
+        * With hardware tag-based KASAN, marking is skipped for
+        * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc().
+        */
+       mem = kasan_unpoison_vmalloc(mem, size, false, false);

        return mem;
 }

@@ -2449,9 +2453,12 @@ static struct vm_struct *__get_vm_area_node(unsigned long size,
         * accessible after they are mapped in.
         * Otherwise, as the pages can be mapped outside of vmalloc code,
         * mark them now as a best-effort approach.
+        * With hardware tag-based KASAN, marking is skipped for
+        * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc().
         */
        if (!(flags & VM_ALLOC))
-               area->addr = kasan_unpoison_vmalloc(area->addr, requested_size);
+               area->addr = kasan_unpoison_vmalloc(area->addr, requested_size,
+                                                       false, false);

        return area;
 }

@@ -2849,6 +2856,12 @@ vm_area_alloc_pages(gfp_t gfp, int nid,
        struct page *page;
        int i;

+       /*
+        * Skip page_alloc poisoning and zeroing for pages backing VM_ALLOC
+        * mappings. Only effective in HW_TAGS mode.
+        */
+       gfp &= __GFP_SKIP_KASAN_UNPOISON & __GFP_SKIP_ZERO;
+
        /*
         * For order-0 pages we make use of bulk allocator, if
         * the page array is partly or not at all populated due

@@ -3027,6 +3040,7 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
 {
        struct vm_struct *area;
        void *addr;
+       bool init;
        unsigned long real_size = size;
        unsigned long real_align = align;
        unsigned int shift = PAGE_SHIFT;

@@ -3083,8 +3097,13 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align,
        /*
         * Mark the pages for VM_ALLOC mappings as accessible after they were
         * mapped in.
+        * The init condition should match the one in post_alloc_hook()
+        * (except for the should_skip_init() check) to make sure that memory
+        * is initialized under the same conditions regardless of the enabled
+        * KASAN mode.
         */
-       addr = kasan_unpoison_vmalloc(addr, real_size);
+       init = !want_init_on_free() && want_init_on_alloc(gfp_mask);
+       addr = kasan_unpoison_vmalloc(addr, real_size, true, init);

        /*
         * In this function, newly allocated vm_struct has VM_UNINITIALIZED

@@ -3784,10 +3803,13 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
         * Mark allocated areas as accessible.
         * As the pages are mapped outside of vmalloc code,
         * mark them now as a best-effort approach.
+        * With hardware tag-based KASAN, marking is skipped for
+        * non-VM_ALLOC mappings, see __kasan_unpoison_vmalloc().
         */
        for (area = 0; area < nr_vms; area++)
                vms[area]->addr = kasan_unpoison_vmalloc(vms[area]->addr,
-                                                        vms[area]->size);
+                                                        vms[area]->size,
+                                                        false, false);

        kfree(vas);
        return vms;
--

2.25.1