[RFC PATCH] riscv: kasan: Flush TLB after switching to temporary page table

[Mingfeng Lin]

kasan_init() switches satp to tmp_pg_dir before clearing the early
KASAN mappings from swapper_pg_dir. Both page-table roots use ASID 0.

A write to satp neither invalidates address-translation caches nor
orders page-table updates with subsequent address translations. An
out-of-order implementation can have speculative memory accesses and
their page-table walks in flight when satp is written. Without an
SFENCE.VMA after the switch, such a walk can complete later and install
a translation derived from swapper_pg_dir while that page table is being
cleared.

This is especially problematic with KASAN. Compiler-inserted checks read
KASAN shadow memory before ordinary accesses. If an obsolete or faulting
translation for the shadow is installed, the shadow load raises a page
fault. The RISC-V page-fault handler is itself KASAN-instrumented, so it
performs another shadow access before it can handle the original fault.
The same bad translation can therefore cause recursive page faults and
prevent kasan_init() from reaching the final satp switch and TLB flush.

Flush the local TLB after installing tmp_pg_dir and before clearing
swapper_pg_dir. This also orders the writes that initialized tmp_pg_dir
before subsequent implicit page-table accesses.

Fixes: 96f9d4daf745 ("riscv: Rework kasan population functions")
Signed-off-by: Mingfeng Lin <mingfe...@redrisc.com>
---
arch/riscv/mm/kasan_init.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/arch/riscv/mm/kasan_init.c b/arch/riscv/mm/kasan_init.c
index c4a2a9e5586e..a2a1051590e3 100644
--- a/arch/riscv/mm/kasan_init.c
+++ b/arch/riscv/mm/kasan_init.c
@@ -487,6 +487,7 @@ void __init kasan_init(void)

create_tmp_mapping();
csr_write(CSR_SATP, PFN_DOWN(__pa(tmp_pg_dir)) | satp_mode);
+ local_flush_tlb_all();

kasan_early_clear_pgd(pgd_offset_k(KASAN_SHADOW_START),
KASAN_SHADOW_START, KASAN_SHADOW_END);
--
2.53.0