On Mon, Feb 13, 2023 at 05:52:14PM -0800, Peter Collingbourne wrote:
During page migration, the copy_highpage function is used to copy the page data to the target page. If the source page is a userspace page with MTE tags, the KASAN tag of the target page must have the match-all tag in order to avoid tag check faults during subsequent accesses to the page by the kernel. However, the target page may have been allocated in a number of ways, some of which will use the KASAN allocator and will therefore end up setting the KASAN tag to a non-match-all tag. Therefore, update the target page's KASAN tag to match the source page.
We ended up unintentionally fixing this issue as a result of a bad merge conflict resolution between commit e059853d14ca ("arm64: mte: Fix/clarify the PG_mte_tagged semantics") and commit 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags""), which preserved a tag reset for PG_mte_tagged pages which was considered to be unnecessary at the time. Because SW tags KASAN uses separate tag storage, update the code to only reset the tags when HW tags KASAN is enabled.
Does KASAN_SW_TAGS work together with MTE? In theory they should but I wonder whether we have other places calling page_kasan_tag_reset() without the kasan_hw_tags_enabled() check.
Signed-off-by: Peter Collingbourne pcc@google.com Link: https://linux-review.googlesource.com/id/If303d8a709438d3ff5af5fd85706505830... Reported-by: "Kuan-Ying Lee (李冠穎)" Kuan-Ying.Lee@mediatek.com Cc: stable@vger.kernel.org # 6.1
What are we trying to fix? The removal of page_kasan_tag_reset() in copy_highpage()? If yes, I think we should use:
Fixes: 20794545c146 ("arm64: kasan: Revert "arm64: mte: reset the page tag in page->flags"") Cc: stable@vger.kernel.org # 6.0.x