Re: [PATCH v6 09/18] mm/execmem: Untag addresses in EXECMEM_ROX related pointer arithmetic
From: Alexander Potapenko <glider@google.com>
Date: 2025-11-11 09:14:35
Also in:
linux-kbuild, linux-mm, lkml, llvm
On Wed, Oct 29, 2025 at 8:08 PM Maciej Wieczor-Retman [off-list ref] wrote:
From: Maciej Wieczor-Retman <redacted> ARCH_HAS_EXECMEM_ROX was re-enabled in x86 at Linux 6.14 release. vm_reset_perms() calculates range's start and end addresses using min() and max() functions. To do that it compares pointers but, with KASAN software tags mode enabled, some are tagged - addr variable is, while start and end variables aren't. This can cause the wrong address to be chosen and result in various errors in different places. Reset tags in the address used as function argument in min(), max(). execmem_cache_add() adds tagged pointers to a maple tree structure, which then are incorrectly compared when walking the tree. That results in different pointers being returned later and page permission violation errors panicking the kernel. Reset tag of the address range inserted into the maple tree inside execmem_vmalloc() which then gets propagated to execmem_cache_add(). Signed-off-by: Maciej Wieczor-Retman <redacted>
Acked-by: Alexander Potapenko <glider@google.com>
quoted hunk ↗ jump to hunk
diff --git a/mm/execmem.c b/mm/execmem.c index 810a4ba9c924..fd11409a6217 100644 --- a/mm/execmem.c +++ b/mm/execmem.c@@ -59,7 +59,7 @@ static void *execmem_vmalloc(struct execmem_range *range, size_t size, return NULL; } - return p; + return kasan_reset_tag(p);
I think a comment would be nice here.
quoted hunk ↗ jump to hunk
--- a/mm/vmalloc.c +++ b/mm/vmalloc.c@@ -3328,7 +3328,7 @@ static void vm_reset_perms(struct vm_struct *area) * the vm_unmap_aliases() flush includes the direct map. */ for (i = 0; i < area->nr_pages; i += 1U << page_order) { - unsigned long addr = (unsigned long)page_address(area->pages[i]); + unsigned long addr = (unsigned long)kasan_reset_tag(page_address(area->pages[i]));
Ditto