Re: KASAN vs vmapped stacks

[Andrey Ryabinin]

On 07/10/2016 03:47 PM, Andy Lutomirski wrote:
> Hi all-
> 
> I found two nasty issues with virtually mapped stacks if KASAN is
> enabled.  The first issue is a crash: the first non-init stack is
> allocated and accessed before KASAN initializes its zero shadow
> AFAICT, which means that we switch to that stack and then blow up when
> we start recursively faulting on failed accesses to the shadow.
> 

KASAN initialized quite early, before any non-init task exists. The crash happens
because non-init task writes to write-protected zero shadow.
Currently KASAN doesn't allocate shadow memory for vmalloc addresses, we just map single
zero page and write protect it. 


> The second issue is that, even if we survive (we initialize the zero
> shadow on time), KASAN will fail to protect hte stack.
> 
> For now, I just disabled use of virtually mapped stacks if KASAN is
> on.  Do you have any easy ideas to fix it?
> 

Allocate shadow memory which backs vmalloc/vmap allocations is the only way to fix this.
I can do this, and post the patches soon enough.


> Thanks,
> Andy
>