On Fri, Nov 13, 2020 at 11:20PM +0100, Andrey Konovalov wrote:
> Hardware tag-based KASAN mode is intended to eventually be used in
> production as a security mitigation. Therefore there's a need for finer
> control over KASAN features and for an existence of a kill switch.
>
> This change adds a few boot parameters for hardware tag-based KASAN that
> allow to disable or otherwise control particular KASAN features.
>
> The features that can be controlled are:
>
> 1. Whether KASAN is enabled at all.
> 2. Whether KASAN collects and saves alloc/free stacks.
> 3. Whether KASAN panics on a detected bug or not.
>
> With this change a new boot parameter kasan.mode allows to choose one of
> three main modes:
>
> - kasan.mode=off - KASAN is disabled, no tag checks are performed
> - kasan.mode=prod - only essential production features are enabled
> - kasan.mode=full - all KASAN features are enabled
>
> The chosen mode provides default control values for the features mentioned
> above. However it's also possible to override the default values by
> providing:
>
> - kasan.stacktrace=off/on - enable alloc/free stack collection
> (default: on for mode=full, otherwise off)
> - kasan.fault=report/panic - only report tag fault or also panic
> (default: report)
>
> If kasan.mode parameter is not provided, it defaults to full when
> CONFIG_DEBUG_KERNEL is enabled, and to prod otherwise.
>
> It is essential that switching between these modes doesn't require
> rebuilding the kernel with different configs, as this is required by
> the Android GKI (Generic Kernel Image) initiative [1].
>
> [1]
> https://source.android.com/devices/architecture/kernel/generic-kernel-image
>
> Signed-off-by: Andrey Konovalov <andreyk...@google.com>
> Link:
> https://linux-review.googlesource.com/id/If7d37003875b2ed3e0935702c8015c223d6416a4
Reviewed-by: Marco Elver <el...@google.com>
> ---
> mm/kasan/common.c | 22 +++++--
> mm/kasan/hw_tags.c | 151 +++++++++++++++++++++++++++++++++++++++++++++
> mm/kasan/kasan.h | 16 +++++
> mm/kasan/report.c | 14 ++++-
> 4 files changed, 196 insertions(+), 7 deletions(-)
>
> diff --git a/mm/kasan/common.c b/mm/kasan/common.c
> index 1ac4f435c679..a11e3e75eb08 100644
> --- a/mm/kasan/common.c
> +++ b/mm/kasan/common.c
> @@ -135,6 +135,11 @@ void kasan_cache_create(struct kmem_cache *cache,
> unsigned int *size,
> unsigned int redzone_size;
> int redzone_adjust;
>
> + if (!kasan_stack_collection_enabled()) {
> + *flags |= SLAB_KASAN;
> + return;
> + }
> +
> /* Add alloc meta. */
> cache->kasan_info.alloc_meta_offset = *size;
> *size += sizeof(struct kasan_alloc_meta);
> @@ -171,6 +176,8 @@ void kasan_cache_create(struct kmem_cache *cache,
> unsigned int *size,
>
> size_t kasan_metadata_size(struct kmem_cache *cache)
> {
> + if (!kasan_stack_collection_enabled())
> + return 0;
> return (cache->kasan_info.alloc_meta_offset ?
> sizeof(struct kasan_alloc_meta) : 0) +
> (cache->kasan_info.free_meta_offset ?
> @@ -263,11 +270,13 @@ void * __must_check kasan_init_slab_obj(struct
> kmem_cache *cache,
> {
> struct kasan_alloc_meta *alloc_meta;
>
> - if (!(cache->flags & SLAB_KASAN))
> - return (void *)object;
> + if (kasan_stack_collection_enabled()) {
> + if (!(cache->flags & SLAB_KASAN))
> + return (void *)object;
>
> - alloc_meta = kasan_get_alloc_meta(cache, object);
> - __memset(alloc_meta, 0, sizeof(*alloc_meta));
> + alloc_meta = kasan_get_alloc_meta(cache, object);
> + __memset(alloc_meta, 0, sizeof(*alloc_meta));
> + }
>
> if (IS_ENABLED(CONFIG_KASAN_SW_TAGS) ||
> IS_ENABLED(CONFIG_KASAN_HW_TAGS))
> object = set_tag(object, assign_tag(cache, object, true,
> false));
> @@ -307,6 +316,9 @@ static bool __kasan_slab_free(struct kmem_cache *cache,
> void *object,
> rounded_up_size = round_up(cache->object_size, KASAN_GRANULE_SIZE);
> poison_range(object, rounded_up_size, KASAN_KMALLOC_FREE);
>
> + if (!kasan_stack_collection_enabled())
> + return false;
> +
> if ((IS_ENABLED(CONFIG_KASAN_GENERIC) && !quarantine) ||
> unlikely(!(cache->flags & SLAB_KASAN)))
> return false;
> @@ -357,7 +369,7 @@ static void *__kasan_kmalloc(struct kmem_cache *cache,
> const void *object,
> poison_range((void *)redzone_start, redzone_end - redzone_start,
> KASAN_KMALLOC_REDZONE);
>
> - if (cache->flags & SLAB_KASAN)
> + if (kasan_stack_collection_enabled() && (cache->flags & SLAB_KASAN))
> set_alloc_info(cache, (void *)object, flags);
>
> return set_tag(object, tag);
> diff --git a/mm/kasan/hw_tags.c b/mm/kasan/hw_tags.c
> index 863fed4edd3f..30ce88935e9d 100644
> --- a/mm/kasan/hw_tags.c
> +++ b/mm/kasan/hw_tags.c
> @@ -8,18 +8,115 @@
>
> #define pr_fmt(fmt) "kasan: " fmt
>
> +#include <linux/init.h>
> #include <linux/kasan.h>
> #include <linux/kernel.h>
> #include <linux/memory.h>
> #include <linux/mm.h>
> +#include <linux/static_key.h>
> #include <linux/string.h>
> #include <linux/types.h>
>
> #include "kasan.h"
>
> +enum kasan_arg_mode {
> + KASAN_ARG_MODE_DEFAULT,
> + KASAN_ARG_MODE_OFF,
> + KASAN_ARG_MODE_PROD,
> + KASAN_ARG_MODE_FULL,
> +};
> +
> +enum kasan_arg_stacktrace {
> + KASAN_ARG_STACKTRACE_DEFAULT,
> + KASAN_ARG_STACKTRACE_OFF,
> + KASAN_ARG_STACKTRACE_ON,
> +};
> +
> +enum kasan_arg_fault {
> + KASAN_ARG_FAULT_DEFAULT,
> + KASAN_ARG_FAULT_REPORT,
> + KASAN_ARG_FAULT_PANIC,
> +};
> +
> +static enum kasan_arg_mode kasan_arg_mode __ro_after_init;
> +static enum kasan_arg_stacktrace kasan_arg_stacktrace __ro_after_init;
> +static enum kasan_arg_fault kasan_arg_fault __ro_after_init;
> +
> +/* Whether KASAN is enabled at all. */
> +DEFINE_STATIC_KEY_FALSE_RO(kasan_flag_enabled);
> +EXPORT_SYMBOL(kasan_flag_enabled);
> +
> +/* Whether to collect alloc/free stack traces. */
> +DEFINE_STATIC_KEY_FALSE_RO(kasan_flag_stacktrace);
> +
> +/* Whether panic or disable tag checking on fault. */
> +bool kasan_flag_panic __ro_after_init;
> +
> +/* kasan.mode=off/prod/full */
> +static int __init early_kasan_mode(char *arg)
> +{
> + if (!arg)
> + return -EINVAL;
> +
> + if (!strcmp(arg, "off"))
> + kasan_arg_mode = KASAN_ARG_MODE_OFF;
> + else if (!strcmp(arg, "prod"))
> + kasan_arg_mode = KASAN_ARG_MODE_PROD;
> + else if (!strcmp(arg, "full"))
> + kasan_arg_mode = KASAN_ARG_MODE_FULL;
> + else
> + return -EINVAL;
> +
> + return 0;
> +}
> +early_param("kasan.mode", early_kasan_mode);
> +
> +/* kasan.stack=off/on */
> +static int __init early_kasan_flag_stacktrace(char *arg)
> +{
> + if (!arg)
> + return -EINVAL;
> +
> + if (!strcmp(arg, "off"))
> + kasan_arg_stacktrace = KASAN_ARG_STACKTRACE_OFF;
> + else if (!strcmp(arg, "on"))
> + kasan_arg_stacktrace = KASAN_ARG_STACKTRACE_ON;
> + else
> + return -EINVAL;
> +
> + return 0;
> +}
> +early_param("kasan.stacktrace", early_kasan_flag_stacktrace);
> +
> +/* kasan.fault=report/panic */
> +static int __init early_kasan_fault(char *arg)
> +{
> + if (!arg)
> + return -EINVAL;
> +
> + if (!strcmp(arg, "report"))
> + kasan_arg_fault = KASAN_ARG_FAULT_REPORT;
> + else if (!strcmp(arg, "panic"))
> + kasan_arg_fault = KASAN_ARG_FAULT_PANIC;
> + else
> + return -EINVAL;
> +
> + return 0;
> +}
> +early_param("kasan.fault", early_kasan_fault);
> +
> /* kasan_init_hw_tags_cpu() is called for each CPU. */
> void kasan_init_hw_tags_cpu(void)
> {
> + /*
> + * There's no need to check that the hardware is MTE-capable here,
> + * as this function is only called for MTE-capable hardware.
> + */
> +
> + /* If KASAN is disabled, do nothing. */
> + if (kasan_arg_mode == KASAN_ARG_MODE_OFF)
> + return;
> +
> hw_init_tags(KASAN_TAG_MAX);
> hw_enable_tagging();
> }
> @@ -27,6 +124,60 @@ void kasan_init_hw_tags_cpu(void)
> /* kasan_init_hw_tags() is called once on boot CPU. */
> void __init kasan_init_hw_tags(void)
> {
> + /* If hardware doesn't support MTE, do nothing. */
> + if (!system_supports_mte())
> + return;
> +
> + /* Choose KASAN mode if kasan boot parameter is not provided. */
> + if (kasan_arg_mode == KASAN_ARG_MODE_DEFAULT) {
> + if (IS_ENABLED(CONFIG_DEBUG_KERNEL))
> + kasan_arg_mode = KASAN_ARG_MODE_FULL;
> + else
> + kasan_arg_mode = KASAN_ARG_MODE_PROD;
> + }
> +
> + /* Preset parameter values based on the mode. */
> + switch (kasan_arg_mode) {
> + case KASAN_ARG_MODE_DEFAULT:
> + /* Shouldn't happen as per the check above. */
> + WARN_ON(1);
> + return;
> + case KASAN_ARG_MODE_OFF:
> + /* If KASAN is disabled, do nothing. */
> + return;
> + case KASAN_ARG_MODE_PROD:
> + static_branch_enable(&kasan_flag_enabled);
> + break;
> + case KASAN_ARG_MODE_FULL:
> + static_branch_enable(&kasan_flag_enabled);
> + static_branch_enable(&kasan_flag_stacktrace);
> + break;
> + }
> +
> + /* Now, optionally override the presets. */
> +
> + switch (kasan_arg_stacktrace) {
> + case KASAN_ARG_STACKTRACE_DEFAULT:
> + break;
> + case KASAN_ARG_STACKTRACE_OFF:
> + static_branch_disable(&kasan_flag_stacktrace);
> + break;
> + case KASAN_ARG_STACKTRACE_ON:
> + static_branch_enable(&kasan_flag_stacktrace);
> + break;
> + }
> +
> + switch (kasan_arg_fault) {
> + case KASAN_ARG_FAULT_DEFAULT:
> + break;
> + case KASAN_ARG_FAULT_REPORT:
> + kasan_flag_panic = false;
> + break;
> + case KASAN_ARG_FAULT_PANIC:
> + kasan_flag_panic = true;
> + break;
> + }
> +
> pr_info("KernelAddressSanitizer initialized\n");
> }
>
> diff --git a/mm/kasan/kasan.h b/mm/kasan/kasan.h
> index 8aa83b7ad79e..d01a5ac34f70 100644
> --- a/mm/kasan/kasan.h
> +++ b/mm/kasan/kasan.h
> @@ -6,6 +6,22 @@
> #include <linux/kfence.h>
> #include <linux/stackdepot.h>
>
> +#ifdef CONFIG_KASAN_HW_TAGS
> +#include <linux/static_key.h>
> +DECLARE_STATIC_KEY_FALSE(kasan_flag_stacktrace);
> +static inline bool kasan_stack_collection_enabled(void)
> +{
> + return static_branch_unlikely(&kasan_flag_stacktrace);
> +}
> +#else
> +static inline bool kasan_stack_collection_enabled(void)
> +{
> + return true;
> +}
> +#endif
> +
> +extern bool kasan_flag_panic __ro_after_init;
> +
> #if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
> #define KASAN_GRANULE_SIZE (1UL << KASAN_SHADOW_SCALE_SHIFT)
> #else
> diff --git a/mm/kasan/report.c b/mm/kasan/report.c
> index 76a0e3ae2049..ffa6076b1710 100644
> --- a/mm/kasan/report.c
> +++ b/mm/kasan/report.c
> @@ -99,6 +99,10 @@ static void end_report(unsigned long *flags)
> panic_on_warn = 0;
> panic("panic_on_warn set ...\n");
> }
> +#ifdef CONFIG_KASAN_HW_TAGS
> + if (kasan_flag_panic)
> + panic("kasan.fault=panic set ...\n");
> +#endif
> kasan_enable_current();
> }
>
> @@ -161,8 +165,8 @@ static void describe_object_addr(struct kmem_cache
> *cache, void *object,
> (void *)(object_addr + cache->object_size));
> }
>
> -static void describe_object(struct kmem_cache *cache, void *object,
> - const void *addr, u8 tag)
> +static void describe_object_stacks(struct kmem_cache *cache, void *object,
> + const void *addr, u8 tag)
> {
> struct kasan_alloc_meta *alloc_meta = kasan_get_alloc_meta(cache,
> object);
>
> @@ -190,7 +194,13 @@ static void describe_object(struct kmem_cache *cache,
> void *object,
> }
> #endif
> }
> +}
>
> +static void describe_object(struct kmem_cache *cache, void *object,
> + const void *addr, u8 tag)
> +{
> + if (kasan_stack_collection_enabled())
> + describe_object_stacks(cache, object, addr, tag);
> describe_object_addr(cache, object, addr);
> }
>
> --
> 2.29.2.299.gdc1121823c-goog
>
