Subject: Re: linux/master crashes on boot with KASAN=y
To: Jakub Kicinski <kubakici@wp.pl>, Andy Lutomirski <luto@kernel.org>
Cc: Thomas Gleixner <tglx@linutronix.de>, Ingo Molnar <mingo@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
References: <20171223000143.0af3366d@cakuba.netronome.com>
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
Message-ID: <41c68406-ad05-1db7-b0dd-a2e616448ee1@virtuozzo.com>
Date: Sat, 23 Dec 2017 15:41:27 +0300
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <20171223000143.0af3366d@cakuba.netronome.com>
Content-Type: text/plain; charset=windows-1252
Content-Language: en-US
Content-Transfer-Encoding: 7bit
SpamDiagnosticOutput: 1:99
SpamDiagnosticMetadata: NSPM
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Dec 2017 12:44:45.1154 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 567e61e2-e3f0-499f-2b42-08d54a02f233
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f
X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB2829
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org
Content-Length: 2429
Lines: 68

On 12/23/2017 11:01 AM, Jakub Kicinski wrote:
> Hi!
> 
> I bisected a crash on boot to this:
> 
> commit 21506525fb8ddb0342f2a2370812d47f6a1f3833 (HEAD, refs/bisect/bad)
> Author: Andy Lutomirski <luto@kernel.org>
> Date:   Mon Dec 4 15:07:16 2017 +0100
> 
>     x86/kasan/64: Teach KASAN about the cpu_entry_area


Thanks.
There is nothing wrong with this patch, it just uncovered older bug.
The actual problem comes from f06bdd4001c2 ("x86/mm: Adapt MODULES_END based on fixmap section size")
which is made kasan_mem_to_shadow(MODULES_END) potentially unaligned to page boundary.
And when we feed unaligned address to kasan_populate_zero_shadow() it doesn't do the right thing.

Could you tell me if the fix bellow works for you?

---
 arch/x86/include/asm/kasan.h            | 8 ++++++++
 arch/x86/include/asm/pgtable_64_types.h | 4 +++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/arch/x86/include/asm/kasan.h b/arch/x86/include/asm/kasan.h
index b577dd0916aa..0c580e4b2ccc 100644
--- a/arch/x86/include/asm/kasan.h
+++ b/arch/x86/include/asm/kasan.h
@@ -5,6 +5,14 @@
 #include <linux/const.h>
 #define KASAN_SHADOW_OFFSET _AC(CONFIG_KASAN_SHADOW_OFFSET, UL)
 
+#ifndef KASAN_SHADOW_SCALE_SHIFT
+# ifdef CONFIG_KASAN
+#  define KASAN_SHADOW_SCALE_SHIFT 3
+# else
+#  define KASAN_SHADOW_SCALE_SHIFT 0
+# endif
+#endif
+
 /*
  * Compiler uses shadow offset assuming that addresses start
  * from 0. Kernel addresses don't start from 0, so shadow
diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
index 6d5f45dcd4a1..d34a90d6c374 100644
--- a/arch/x86/include/asm/pgtable_64_types.h
+++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -6,6 +6,7 @@
 
 #ifndef __ASSEMBLY__
 #include <linux/types.h>
+#include <asm/kasan.h>
 #include <asm/kaslr.h>
 
 /*
@@ -96,7 +97,8 @@ typedef struct { pteval_t pte; } pte_t;
 #define VMALLOC_END	(VMALLOC_START + _AC((VMALLOC_SIZE_TB << 40) - 1, UL))
 #define MODULES_VADDR    (__START_KERNEL_map + KERNEL_IMAGE_SIZE)
 /* The module sections ends with the start of the fixmap */
-#define MODULES_END   __fix_to_virt(__end_of_fixed_addresses + 1)
+#define MODULES_END   (__fix_to_virt(__end_of_fixed_addresses + 1) & \
+			~((PAGE_SIZE << KASAN_SHADOW_SCALE_SHIFT) - 1))
 #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
 #define ESPFIX_PGD_ENTRY _AC(-2, UL)
 #define ESPFIX_BASE_ADDR (ESPFIX_PGD_ENTRY << P4D_SHIFT)
-- 
2.13.6