[PW_SID:1059743] riscv: kfence: Handle the spurious fault after kfence_unprotect()#1526
[PW_SID:1059743] riscv: kfence: Handle the spurious fault after kfence_unprotect()#1526linux-riscv-bot wants to merge 3 commits into
Conversation
In preparation of a future patch using this mechanism for non-vmalloc mappings, rename new_vmalloc into new_valid_map_cpus to avoid misleading readers. No functional change intended. Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
In preparation of a future patch using the same mechanism for non-vmalloc addresses, extract the mark_new_valid_map() helper from flush_cache_vmap(). No functional change intended. Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
In kfence_protect_page(), which kfence_unprotect() calls, we cannot send IPIs to other CPUs to ask them to flush TLB. This may lead to those CPUs spuriously faulting on a recently allocated kfence object despite it being valid, leading to false positive use-after-free reports. Fix this by calling mark_new_valid_map() so that the page fault handling code path notices the spurious fault and flushes TLB then retries the access. Update the comment in handle_exception to indicate that new_valid_map_cpus_check also handles kfence_unprotect() spurious faults. Note that kfence_protect() has the same stale TLB entries problem, but that leads to false negatives, which is fine with kfence. Cc: <stable@vger.kernel.org> Reported-by: Yanko Kaneti <yaneti@declera.com> Fixes: b3431a8 ("riscv: Fix IPIs usage in kfence_protect_page()") Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 1: "[1/3] riscv: mm: Rename new_vmalloc into new_valid_map_cpus" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 2: "[2/3] riscv: mm: Extract helper mark_new_valid_map()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
|
Patch 3: "[3/3] riscv: kfence: Call mark_new_valid_map() for kfence_unprotect()" |
PR for series 1059743 applied to workflow__riscv__fixes
Name: riscv: kfence: Handle the spurious fault after kfence_unprotect()
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1059743
Version: 1