Re: KASAN vs vmapped stacks

From: Andrey Ryabinin
Date: Mon Jul 11 2016 - 06:11:16 EST

On 07/10/2016 03:47 PM, Andy Lutomirski wrote:
> Hi all-
> I found two nasty issues with virtually mapped stacks if KASAN is
> enabled. The first issue is a crash: the first non-init stack is
> allocated and accessed before KASAN initializes its zero shadow
> AFAICT, which means that we switch to that stack and then blow up when
> we start recursively faulting on failed accesses to the shadow.

KASAN initialized quite early, before any non-init task exists. The crash happens
because non-init task writes to write-protected zero shadow.
Currently KASAN doesn't allocate shadow memory for vmalloc addresses, we just map single
zero page and write protect it.

> The second issue is that, even if we survive (we initialize the zero
> shadow on time), KASAN will fail to protect hte stack.
> For now, I just disabled use of virtually mapped stacks if KASAN is
> on. Do you have any easy ideas to fix it?

Allocate shadow memory which backs vmalloc/vmap allocations is the only way to fix this.
I can do this, and post the patches soon enough.

> Thanks,
> Andy