[PATCH v2 1/4] mm: kasan: Ensure the tags are visible before the tag in page->flags
Catalin Marinas
catalin.marinas at arm.com
Thu Jul 7 04:44:29 PDT 2022
On Thu, Jul 07, 2022 at 10:22:37AM +0100, Will Deacon wrote:
> On Fri, Jun 10, 2022 at 04:21:38PM +0100, Catalin Marinas wrote:
> > __kasan_unpoison_pages() colours the memory with a random tag and stores
> > it in page->flags in order to re-create the tagged pointer via
> > page_to_virt() later. When the tag from the page->flags is read, ensure
> > that the in-memory tags are already visible by re-ordering the
> > page_kasan_tag_set() after kasan_unpoison(). The former already has
> > barriers in place through try_cmpxchg(). On the reader side, the order
> > is ensured by the address dependency between page->flags and the memory
> > access.
> >
> > Signed-off-by: Catalin Marinas <catalin.marinas at arm.com>
> > Reviewed-by: Andrey Konovalov <andreyknvl at gmail.com>
> > Cc: Andrey Ryabinin <ryabinin.a.a at gmail.com>
> > Cc: Vincenzo Frascino <vincenzo.frascino at arm.com>
> > ---
> > mm/kasan/common.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/mm/kasan/common.c b/mm/kasan/common.c
> > index c40c0e7b3b5f..78be2beb7453 100644
> > --- a/mm/kasan/common.c
> > +++ b/mm/kasan/common.c
> > @@ -108,9 +108,10 @@ void __kasan_unpoison_pages(struct page *page, unsigned int order, bool init)
> > return;
> >
> > tag = kasan_random_tag();
> > + kasan_unpoison(set_tag(page_address(page), tag),
> > + PAGE_SIZE << order, init);
> > for (i = 0; i < (1 << order); i++)
> > page_kasan_tag_set(page + i, tag);
> > - kasan_unpoison(page_address(page), PAGE_SIZE << order, init);
>
> This looks good to me, but after reading the cover letter I'm wondering
> whether the try_cmpxchg() in page_kasan_tag_set() could be relaxed to
> try_cmpxchg_release() as a separate optimisation?
I think it can be a try_cmpxchg_release() (I did not realise we have
one). I'll post a patch later today.
--
Catalin
More information about the linux-arm-kernel
mailing list