xref: /linux/mm/kmsan/shadow.c (revision ed3b875bea55a3ec4837113356df2ead11115af9)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * KMSAN shadow implementation.
4  *
5  * Copyright (C) 2017-2022 Google LLC
6  * Author: Alexander Potapenko <glider@google.com>
7  *
8  */
9 
10 #include <asm/kmsan.h>
11 #include <asm/tlbflush.h>
12 #include <linux/cacheflush.h>
13 #include <linux/memblock.h>
14 #include <linux/mm_types.h>
15 #include <linux/slab.h>
16 #include <linux/smp.h>
17 #include <linux/stddef.h>
18 
19 #include "../internal.h"
20 #include "../vmalloc.h"
21 #include "kmsan.h"
22 
23 #define shadow_page_for(page) ((page)->kmsan_shadow)
24 
25 #define origin_page_for(page) ((page)->kmsan_origin)
26 
27 static void *shadow_ptr_for(struct page *page)
28 {
29 	return page_address(shadow_page_for(page));
30 }
31 
32 static void *origin_ptr_for(struct page *page)
33 {
34 	return page_address(origin_page_for(page));
35 }
36 
37 static bool page_has_metadata(struct page *page)
38 {
39 	return shadow_page_for(page) && origin_page_for(page);
40 }
41 
42 static void set_no_shadow_origin_page(struct page *page)
43 {
44 	shadow_page_for(page) = NULL;
45 	origin_page_for(page) = NULL;
46 }
47 
48 /*
49  * Dummy load and store pages to be used when the real metadata is unavailable.
50  * There are separate pages for loads and stores, so that every load returns a
51  * zero, and every store doesn't affect other loads.
52  */
53 static char dummy_load_page[PAGE_SIZE] __aligned(PAGE_SIZE);
54 static char dummy_store_page[PAGE_SIZE] __aligned(PAGE_SIZE);
55 
56 static unsigned long vmalloc_meta(void *addr, bool is_origin)
57 {
58 	unsigned long addr64 = (unsigned long)addr, off;
59 
60 	KMSAN_WARN_ON(is_origin && !IS_ALIGNED(addr64, KMSAN_ORIGIN_SIZE));
61 	if (kmsan_internal_is_vmalloc_addr(addr)) {
62 		off = addr64 - VMALLOC_START;
63 		return off + (is_origin ? KMSAN_VMALLOC_ORIGIN_START :
64 					  KMSAN_VMALLOC_SHADOW_START);
65 	}
66 	if (kmsan_internal_is_module_addr(addr)) {
67 		off = addr64 - MODULES_VADDR;
68 		return off + (is_origin ? KMSAN_MODULES_ORIGIN_START :
69 					  KMSAN_MODULES_SHADOW_START);
70 	}
71 	return 0;
72 }
73 
74 static struct page *virt_to_page_or_null(void *vaddr)
75 {
76 	if (kmsan_virt_addr_valid(vaddr))
77 		return virt_to_page(vaddr);
78 	else
79 		return NULL;
80 }
81 
82 struct shadow_origin_ptr kmsan_get_shadow_origin_ptr(void *address, u64 size,
83 						     bool store)
84 {
85 	struct shadow_origin_ptr ret;
86 	void *shadow;
87 
88 	/*
89 	 * Even if we redirect this memory access to the dummy page, it will
90 	 * go out of bounds.
91 	 */
92 	KMSAN_WARN_ON(size > PAGE_SIZE);
93 
94 	if (!kmsan_enabled)
95 		goto return_dummy;
96 
97 	KMSAN_WARN_ON(!kmsan_metadata_is_contiguous(address, size));
98 	shadow = kmsan_get_metadata(address, KMSAN_META_SHADOW);
99 	if (!shadow)
100 		goto return_dummy;
101 
102 	ret.shadow = shadow;
103 	ret.origin = kmsan_get_metadata(address, KMSAN_META_ORIGIN);
104 	return ret;
105 
106 return_dummy:
107 	if (store) {
108 		/* Ignore this store. */
109 		ret.shadow = dummy_store_page;
110 		ret.origin = dummy_store_page;
111 	} else {
112 		/* This load will return zero. */
113 		ret.shadow = dummy_load_page;
114 		ret.origin = dummy_load_page;
115 	}
116 	return ret;
117 }
118 
119 /*
120  * Obtain the shadow or origin pointer for the given address, or NULL if there's
121  * none. The caller must check the return value for being non-NULL if needed.
122  * The return value of this function should not depend on whether we're in the
123  * runtime or not.
124  */
125 void *kmsan_get_metadata(void *address, bool is_origin)
126 {
127 	u64 addr = (u64)address, off;
128 	struct page *page;
129 	void *ret;
130 
131 	if (is_origin)
132 		addr = ALIGN_DOWN(addr, KMSAN_ORIGIN_SIZE);
133 	address = (void *)addr;
134 	if (kmsan_internal_is_vmalloc_addr(address) ||
135 	    kmsan_internal_is_module_addr(address))
136 		return (void *)vmalloc_meta(address, is_origin);
137 
138 	ret = arch_kmsan_get_meta_or_null(address, is_origin);
139 	if (ret)
140 		return ret;
141 
142 	page = virt_to_page_or_null(address);
143 	if (!page)
144 		return NULL;
145 	if (!page_has_metadata(page))
146 		return NULL;
147 	off = offset_in_page(addr);
148 
149 	return (is_origin ? origin_ptr_for(page) : shadow_ptr_for(page)) + off;
150 }
151 
152 void kmsan_copy_page_meta(struct page *dst, struct page *src)
153 {
154 	if (!kmsan_enabled || kmsan_in_runtime())
155 		return;
156 	if (!dst || !page_has_metadata(dst))
157 		return;
158 	if (!src || !page_has_metadata(src)) {
159 		kmsan_internal_unpoison_memory(page_address(dst), PAGE_SIZE,
160 					       /*checked*/ false);
161 		return;
162 	}
163 
164 	kmsan_enter_runtime();
165 	__memcpy(shadow_ptr_for(dst), shadow_ptr_for(src), PAGE_SIZE);
166 	__memcpy(origin_ptr_for(dst), origin_ptr_for(src), PAGE_SIZE);
167 	kmsan_leave_runtime();
168 }
169 EXPORT_SYMBOL(kmsan_copy_page_meta);
170 
171 void kmsan_alloc_page(struct page *page, unsigned int order, gfp_t flags)
172 {
173 	bool initialized = (flags & __GFP_ZERO) || !kmsan_enabled;
174 	struct page *shadow, *origin;
175 	depot_stack_handle_t handle;
176 	int pages = 1 << order;
177 
178 	if (!page)
179 		return;
180 
181 	shadow = shadow_page_for(page);
182 	origin = origin_page_for(page);
183 
184 	if (initialized) {
185 		__memset(page_address(shadow), 0, PAGE_SIZE * pages);
186 		__memset(page_address(origin), 0, PAGE_SIZE * pages);
187 		return;
188 	}
189 
190 	/* Zero pages allocated by the runtime should also be initialized. */
191 	if (kmsan_in_runtime())
192 		return;
193 
194 	__memset(page_address(shadow), -1, PAGE_SIZE * pages);
195 	kmsan_enter_runtime();
196 	handle = kmsan_save_stack_with_flags(flags, /*extra_bits*/ 0);
197 	kmsan_leave_runtime();
198 	/*
199 	 * Addresses are page-aligned, pages are contiguous, so it's ok
200 	 * to just fill the origin pages with @handle.
201 	 */
202 	for (int i = 0; i < PAGE_SIZE * pages / sizeof(handle); i++)
203 		((depot_stack_handle_t *)page_address(origin))[i] = handle;
204 }
205 
206 void kmsan_free_page(struct page *page, unsigned int order)
207 {
208 	if (!kmsan_enabled || kmsan_in_runtime())
209 		return;
210 	kmsan_enter_runtime();
211 	kmsan_internal_poison_memory(page_address(page), PAGE_SIZE << order,
212 				     GFP_KERNEL & ~(__GFP_RECLAIM),
213 				     KMSAN_POISON_CHECK | KMSAN_POISON_FREE);
214 	kmsan_leave_runtime();
215 }
216 
217 int kmsan_vmap_pages_range_noflush(unsigned long start, unsigned long end,
218 				   pgprot_t prot, struct page **pages,
219 				   unsigned int page_shift, gfp_t gfp_mask)
220 {
221 	unsigned long shadow_start, origin_start, shadow_end, origin_end;
222 	struct page **s_pages, **o_pages;
223 	int nr, mapped, err = 0;
224 
225 	if (!kmsan_enabled)
226 		return 0;
227 
228 	shadow_start = vmalloc_meta((void *)start, KMSAN_META_SHADOW);
229 	shadow_end = vmalloc_meta((void *)end, KMSAN_META_SHADOW);
230 	if (!shadow_start)
231 		return 0;
232 
233 	nr = (end - start) / PAGE_SIZE;
234 	s_pages = kzalloc_objs(*s_pages, nr, gfp_mask);
235 	o_pages = kzalloc_objs(*o_pages, nr, gfp_mask);
236 	if (!s_pages || !o_pages) {
237 		err = -ENOMEM;
238 		goto ret;
239 	}
240 	for (int i = 0; i < nr; i++) {
241 		s_pages[i] = shadow_page_for(pages[i]);
242 		o_pages[i] = origin_page_for(pages[i]);
243 	}
244 	prot = PAGE_KERNEL;
245 
246 	origin_start = vmalloc_meta((void *)start, KMSAN_META_ORIGIN);
247 	origin_end = vmalloc_meta((void *)end, KMSAN_META_ORIGIN);
248 	kmsan_enter_runtime();
249 	mapped = __vmap_pages_range_noflush(shadow_start, shadow_end, prot,
250 					    s_pages, page_shift);
251 	kmsan_leave_runtime();
252 	if (mapped) {
253 		err = mapped;
254 		goto ret;
255 	}
256 	kmsan_enter_runtime();
257 	mapped = __vmap_pages_range_noflush(origin_start, origin_end, prot,
258 					    o_pages, page_shift);
259 	kmsan_leave_runtime();
260 	if (mapped) {
261 		err = mapped;
262 		goto ret;
263 	}
264 	flush_tlb_kernel_range(shadow_start, shadow_end);
265 	flush_tlb_kernel_range(origin_start, origin_end);
266 	flush_cache_vmap(shadow_start, shadow_end);
267 	flush_cache_vmap(origin_start, origin_end);
268 
269 ret:
270 	kfree(s_pages);
271 	kfree(o_pages);
272 	return err;
273 }
274 
275 /* Allocate metadata for pages allocated at boot time. */
276 void __init kmsan_init_alloc_meta_for_range(void *start, void *end)
277 {
278 	struct page *shadow_p, *origin_p;
279 	void *shadow, *origin;
280 	struct page *page;
281 	u64 size;
282 
283 	start = (void *)PAGE_ALIGN_DOWN((u64)start);
284 	size = PAGE_ALIGN((u64)end - (u64)start);
285 	shadow = memblock_alloc_or_panic(size, PAGE_SIZE);
286 	origin = memblock_alloc_or_panic(size, PAGE_SIZE);
287 
288 	for (u64 addr = 0; addr < size; addr += PAGE_SIZE) {
289 		page = virt_to_page_or_null((char *)start + addr);
290 		shadow_p = virt_to_page((char *)shadow + addr);
291 		set_no_shadow_origin_page(shadow_p);
292 		shadow_page_for(page) = shadow_p;
293 		origin_p = virt_to_page((char *)origin + addr);
294 		set_no_shadow_origin_page(origin_p);
295 		origin_page_for(page) = origin_p;
296 	}
297 }
298 
299 void kmsan_setup_meta(struct page *page, struct page *shadow,
300 		      struct page *origin, int order)
301 {
302 	for (int i = 0; i < (1 << order); i++) {
303 		set_no_shadow_origin_page(&shadow[i]);
304 		set_no_shadow_origin_page(&origin[i]);
305 		shadow_page_for(&page[i]) = &shadow[i];
306 		origin_page_for(&page[i]) = &origin[i];
307 	}
308 }
309