Re: [PATCH 1/2] x86/kmsan: Fix CPU entry area metadata lookup

[Alexander Potapenko]

On Tue, Oct 6, 2026 at 8:10 PM Viorel Cernateanu via B4 Relay
<devnull+vrilutza.gmail.com@xxxxxxxxxx> wrote:
>
> From: Viorel Cernateanu <vrilutza@xxxxxxxxx>
>
> arch_kmsan_get_meta_or_null() works out which CPU owns an address in the
> CPU entry area as (addr - CPU_ENTRY_AREA_BASE) / CPU_ENTRY_AREA_SIZE.
> That is wrong in two ways:
>
>  - With KASLR, init_cea_offsets() puts each CPU's area in a random slot,
>    so the result is a slot number, usually far above NR_CPUS, and
>    get_cpu_entry_area() reads past the end of __per_cpu_offset[].

Thanks for noticing this!
I find the O(n) lookup per each memory access to the cpu_entry_area
excessive. Could we disable the randomization in
arch/x86/mm/cpu_entry_area.c

        if (!kaslr_enabled() || IS_ENABLED(CONFIG_KMSAN)) {
                for_each_possible_cpu(i)
                        per_cpu(_cea_offset, i) = i;
                return;
        }

(there's a similar precedent for KASAN in arch/x86/include/asm/setup.h already)

Peter, what do you think?

>
>  - The per-CPU areas start one page higher, at CPU_ENTRY_AREA_PER_CPU.
>    Even without KASLR, the last page of each area is attributed to the
>    next CPU, so KMSAN loses that page, and for the last CPU the lookup
>    uses a CPU that does not exist.

I guess this part still needs fixing after we disable the randomization.