[PATCH 0/5 v11] KASan for Arm

Tue Jun 30 12:54:15 EDT 2020

Hi Linus,

On 6/30/2020 6:37 AM, Linus Walleij wrote:
> This is the v11 version of the KASan patches for ARM.
> 
> The main changes from the v10 version is:
> 
> - LPAE now compiles and works again, at least Versatile Express
>   Cortex A15 TC1 in QEMU (which is the LPAE system I have
>   access to).
> 
> - Rewrite some of the page directory initialization after
>   helpful feedback from Mike Rapoport and Russell King.
> 
> Also minor improvements to commit messages and comments
> in the code so it is clear (for most cases I hope) why
> some ifdefs etc are there.
> 
> All tested platforms from ARMv4 thru ARMv7 work fine. I
> have not been able to re-test with the Qualcomm DragonBoard
> APQ8060 yet, but I suspect the problem there is that the
> DT parser code reaches out into non-kernel memory and
> needs some de-instrumentation, possibly combined with the
> memory holding the device tree getting corrupted or reused
> before we have a chance to parse it.

So one of my systems (BCM7278 chip), we do indeed reach the point where
unflatten_dt_nodes crashes the system and I guess this is a "pass" for now.

On another system though (BCM7445 chip) with a physical memory map that
looks like this:

0x0000_0000 - 0x3fff_ffff (MEMC0)
0x4000_0000 - 0x7fff_ffff (MEMC1)
0x8000_0000 - 0xbfff_ffff (MEMC2)

we get the attached boot error.
-- 
Florian
-------------- next part --------------
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.8.0-rc2-gbe67c43c4125 (fainelli at fainelli-desktop) (arm-linux-gcc (crosstool-NG ) 6.3.0, GNU ld (crosstool-NG
) 2.26.20160125) #29 SMP Tue Jun 30 09:42:15 PDT 2020
[    0.000000] CPU: ARMv7 Processor [420f00f3] revision 3 (ARMv7), cr=30c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, PIPT instruction cache
[    0.000000] OF: fdt: Machine model: BCM97445VMS
[    0.000000] printk: bootconsole [earlycon0] enabled
[    0.000000] Memory policy: Data cache writealloc
[    0.000000] cma: Reserved 16 MiB at 0x00000000bec00000
[    0.000000] Zone ranges:
[    0.000000]   DMA      [mem 0x0000000000000000-0x000000002fffffff]
[    0.000000]   Normal   empty
[    0.000000]   HighMem  [mem 0x0000000030000000-0x00000000bfffefff]
[    0.000000] Movable zone start for each node
[    0.000000] Early memory node ranges
[    0.000000]   node   0: [mem 0x0000000000000000-0x000000003dffffff]
[    0.000000]   node   0: [mem 0x0000000040000000-0x00000000bfffefff]
[    0.000000] Zeroed struct page in unavailable ranges: 1 pages
[    0.000000] Initmem setup node 0 [mem 0x0000000000000000-0x00000000bfffefff]
[    0.000000] kasan: populating shadow for b7000000, bd000000
[    0.000000] 8<--- cut here ---
[    0.000000] Unable to handle kernel paging request at virtual address bc9ffe00
[    0.000000] pgd = (ptrval)
[    0.000000] [bc9ffe00] *pgd=80000000006003, *pmd=00000000
[    0.000000] Internal error: Oops: 206 [#1] SMP ARM
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 5.8.0-rc2-gbe67c43c4125 #29
[    0.000000] Hardware name: Broadcom STB (Flattened Device Tree)
[    0.000000] PC is at check_memory_region+0xb0/0x1bc
[    0.000000] LR is at 0x40
[    0.000000] pc : [<c044f180>]    lr : [<00000040>]    psr: 000000d3
[    0.000000] sp : c2603c48  ip : bc9ffe00  fp : c2603c74
[    0.000000] r10: b81ee000  r9 : 00000000  r8 : bca00000
[    0.000000] r7 : 00000000  r6 : 00000200  r5 : bc9fffff  r4 : ecffffff
[    0.000000] r3 : c181e5fc  r2 : 00000001  r1 : 00001000  r0 : ecfff000
[    0.000000] Flags: nzcv  IRQs off  FIQs off  Mode SVC_32  ISA ARM  Segment user
[    0.000000] Control: 30c5387d  Table: 018751e0  DAC: fffffffd
[    0.000000] Process swapper (pid: 0, stack limit = 0x(ptrval))
[    0.000000] Stack: (0xc2603c48 to 0xc2604000)
[    0.000000] 3c40:                   c181e5fc 00001000 ecfff000 00000000 00000000 00000001
[    0.000000] 3c60: 00000000 b81ee000 c2603c94 c2603c78 c044ceac c044f0dc 00001000 00000000
[    0.000000] 3c80: ecfff000 00000000 c2603cd4 c2603c98 c181e5fc c044ce90 3fffffff 00000000
[    0.000000] 3ca0: 00000001 00000000 ffffffff 00000000 00000001 00000000 0002d000 b81ef000
[    0.000000] 3cc0: c29374d8 ed1eef70 c2603d04 c2603cd8 c180d36c c181e554 3fffffff 00000000
[    0.000000] 3ce0: 00000001 00000000 ffffffff ed1eef70 b8200000 ed1eef78 c2603d74 c2603d08
[    0.000000] 3d00: c180d5c0 c180d2f8 2d00071f 00c00000 c2603d3c c269a8c0 00002933 c0006e00
[    0.000000] 3d20: bd000000 c0003010 c260a284 c16cc084 2d000000 00000000 c10b6764 c10b6648
[    0.000000] 3d40: bd000000 00000000 c180b080 c269ab20 c2960638 c18750d8 c165831c bd000000
[    0.000000] 3d60: b7000000 c16cc000 c2603dc4 c2603d78 c180d8f8 c180d380 c29374c0 00000000
[    0.000000] 3d80: c1872a44 ffff1000 0002ffff 00001000 c16cc000 c269a8c0 30000000 c2d9cc80
[    0.000000] 3da0: c0008000 c1872a44 c269a8c0 e12fff1e c2603f40 c1860b48 c2603ee4 c2603dc8
[    0.000000] 3dc0: c1805c08 c180d714 0000006c 30c5387d c1200740 c2603edc 00000000 00000000
[    0.000000] 3de0: c02268c8 30c5387d 00000024 c2603df8 184c07c0 c2603ea0 c1200740 c2603edc
[    0.000000] 3e00: 41b58ab3 c165670c c1805430 c02b2ad0 c02b36c8 c02b3f08 00000000 b74c07cc
[    0.000000] 3e20: c2606d48 c2606d40 c2606d48 c2936440 c2603ed4 c2603e40 c02b36c8 c02b3f08
[    0.000000] 3e40: c2603eb4 00000000 c2603e74 c2603e58 c2603e74 c2603e60 c029891c c044ec28
[    0.000000] 3e60: 41b58ab3 c1658c9c c02b3638 c2603e78 c031d24c c044ec28 00000000 c2660178
[    0.000000] 3e80: c2603edc c2660020 c1875350 c26601ec c2660030 07723000 c295bf80 c295c7c0
[    0.000000] 3ea0: 00000000 c2606d48 c2603ec4 c2603eb8 c044ec88 00000000 c2603ee4 b74c07e4
[    0.000000] 3ec0: c2603fc0 c2606d40 c2606d48 c2936440 420f00f3 30c5387d c2603ff4 c2603ee8
[    0.000000] 3ee0: c1800d40 c180543c 00000000 00000000 00000000 00000000 00000000 00000000
[    0.000000] 3f00: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
[    0.000000] 3f20: 41b58ab3 c16557f4 c1800c64 00000000 00000000 00000000 00000000 00000000
[    0.000000] 3f40: c1872a44 00000000 00000000 00000000 00000000 c180d638 b7000000 c2935000
[    0.000000] 3f60: 30c0387d b7000000 c2603fe4 c2603f78 c180d638 c0223ae4 02933403 00c00000
[    0.000000] 3f80: 00000000 c269a8c0 00002933 c0006fb8 bf000000 c0003010 c260a284 c16cc084
[    0.000000] 3fa0: 00000000 00000000 02933000 00000000 bf000000 00000001 00000000 c1800334
[    0.000000] 3fc0: 00000000 00000000 ffffffff c1800334 00000000 30c0387d ffffffff 07723000
[    0.000000] 3fe0: 420f00f3 30c5387d 00000000 c2603ff8 00000000 c1800c70 00000000 00000000
[    0.000000] Backtrace:
[    0.000000] [<c044f0d0>] (check_memory_region) from [<c044ceac>] (memset+0x28/0x44)
[    0.000000]  r10:b81ee000 r9:00000000 r8:00000001 r7:00000000 r6:00000000 r5:ecfff000
[    0.000000]  r4:00001000 r3:c181e5fc
[    0.000000] [<c044ce84>] (memset) from [<c181e5fc>] (memblock_alloc_try_nid+0xb4/0xc4)
[    0.000000]  r7:00000000 r6:ecfff000 r5:00000000 r4:00001000
[    0.000000] [<c181e548>] (memblock_alloc_try_nid) from [<c180d36c>] (kasan_alloc_block.constprop.6+0x80/0x88)
[    0.000000]  r9:ed1eef70 r8:c29374d8 r7:b81ef000 r6:0002d000 r5:00000000 r4:00000001
[    0.000000] [<c180d2ec>] (kasan_alloc_block.constprop.6) from [<c180d5c0>] (kasan_pgd_populate.constprop.2+0x24c/0x32c)
[    0.000000]  r5:ed1eef78 r4:b8200000
[    0.000000] [<c180d374>] (kasan_pgd_populate.constprop.2) from [<c180d8f8>] (kasan_init+0x1f0/0x324)
[    0.000000]  r10:c16cc000 r9:b7000000 r8:bd000000 r7:c165831c r6:c18750d8 r5:c2960638
[    0.000000]  r4:c269ab20
[    0.000000] [<c180d708>] (kasan_init) from [<c1805c08>] (setup_arch+0x7d8/0xfa4)
[    0.000000]  r10:c1860b48 r9:c2603f40 r8:e12fff1e r7:c269a8c0 r6:c1872a44 r5:c0008000
[    0.000000]  r4:c2d9cc80
[    0.000000] [<c1805430>] (setup_arch) from [<c1800d40>] (start_kernel+0xdc/0x6b4)
[    0.000000]  r10:30c5387d r9:420f00f3 r8:c2936440 r7:c2606d48 r6:c2606d40 r5:c2603fc0
[    0.000000]  r4:b74c07e4
[    0.000000] [<c1800c64>] (start_kernel) from [<00000000>] (0x0)
[    0.000000]  r10:30c5387d r9:420f00f3 r8:07723000 r7:ffffffff r6:30c0387d r5:00000000
[    0.000000]  r4:c1800334
[    0.000000] Code: e286e007 a1a0e006 e1b0e1ce 0a00002d (e1cc60d0)
[    0.000000] random: get_random_bytes called from print_oops_end_marker+0x48/0x58 with crng_init=0
[    0.000000] ---[ end trace 0000000000000000 ]---
[    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---