[RFC PATCH] riscv: kasan: Flush TLB after switching to temporary page table

[Mingfeng Lin]

kasan_init() switches satp to tmp_pg_dir before clearing the early
KASAN mappings from swapper_pg_dir. Both page-table roots use ASID 0.

A write to satp neither invalidates address-translation caches nor
orders page-table updates with subsequent address translations. An
out-of-order implementation can have speculative memory accesses and
their page-table walks in flight when satp is written. Without an
SFENCE.VMA after the switch, such a walk can complete later and install
a translation derived from swapper_pg_dir while that page table is being
cleared.

This is especially problematic with KASAN. Compiler-inserted checks read
KASAN shadow memory before ordinary accesses. If an obsolete or faulting
translation for the shadow is installed, the shadow load raises a page
fault. The RISC-V page-fault handler is itself KASAN-instrumented, so it
performs another shadow access before it can handle the original fault.
The same bad translation can therefore cause recursive page faults and
prevent kasan_init() from reaching the final satp switch and TLB flush.

Flush the local TLB after installing tmp_pg_dir and before clearing
swapper_pg_dir. This also orders the writes that initialized tmp_pg_dir
before subsequent implicit page-table accesses.

Fixes: 96f9d4daf745 ("riscv: Rework kasan population functions")
Signed-off-by: Mingfeng Lin <mingfeng.lin at redrisc.com>
---
 arch/riscv/mm/kasan_init.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/riscv/mm/kasan_init.c b/arch/riscv/mm/kasan_init.c
index c4a2a9e5586e..a2a1051590e3 100644
--- a/arch/riscv/mm/kasan_init.c
+++ b/arch/riscv/mm/kasan_init.c
@@ -487,6 +487,7 @@ void __init kasan_init(void)
 
 	create_tmp_mapping();
 	csr_write(CSR_SATP, PFN_DOWN(__pa(tmp_pg_dir)) | satp_mode);
+	local_flush_tlb_all();
 
 	kasan_early_clear_pgd(pgd_offset_k(KASAN_SHADOW_START),
 			      KASAN_SHADOW_START, KASAN_SHADOW_END);
-- 
2.53.0