Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934113AbdGKRDi (ORCPT ); Tue, 11 Jul 2017 13:03:38 -0400 Received: from mail-lf0-f52.google.com ([209.85.215.52]:35618 "EHLO mail-lf0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755870AbdGKRDf (ORCPT ); Tue, 11 Jul 2017 13:03:35 -0400 Date: Tue, 11 Jul 2017 20:03:32 +0300 From: "Kirill A. Shutemov" To: Andrey Ryabinin Cc: Andy Lutomirski , Dmitry Vyukov , Alexander Potapenko , "Kirill A. Shutemov" , Linus Torvalds , Andrew Morton , "x86@kernel.org" , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Andi Kleen , Dave Hansen , linux-arch , "linux-mm@kvack.org" , LKML , kasan-dev Subject: Re: KASAN vs. boot-time switching between 4- and 5-level paging Message-ID: <20170711170332.wlaudicepkg35dmm@node.shutemov.name> References: <20170710141713.7aox3edx6o7lrrie@node.shutemov.name> <03A6D7ED-300C-4431-9EB5-67C7A3EA4A2E@amacapital.net> <20170710184704.realchrhzpblqqlk@node.shutemov.name> <20170710212403.7ycczkhhki3vrgac@node.shutemov.name> <20170711103548.mkv5w7dd5gpdenne@node.shutemov.name> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: User-Agent: NeoMutt/20170609 (1.8.3) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1010 Lines: 25 On Tue, Jul 11, 2017 at 07:45:48PM +0300, Andrey Ryabinin wrote: > On 07/11/2017 06:15 PM, Andrey Ryabinin wrote: > > > > I reproduced this, and this is kasan bug: > > > > │0xffffffff84864897 mov $0xffffffff83f1d0b8,%rdi > > │0xffffffff8486489e movabs $0xdffffc0000000000,%rax > > │0xffffffff848648a8 push %rbp > > │0xffffffff848648a9 mov %rdi,%rdx > > │0xffffffff848648ac shr $0x3,%rdx > > │0xffffffff848648b0 mov %rsp,%rbp > > >│0xffffffff848648b3 mov (%rdx,%rax,1),%al > > > > we crash on the last move which is a read from shadow > > > Ughh, I forgot about phys_base. Thanks! Works for me. Can use your Signed-off-by for a [cleaned up version of your] patch? -- Kirill A. Shutemov