stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Khalid Aziz <khalid.aziz@oracle.com>,
	Jann Horn <jannh@google.com>,
	Christoph Hellwig <hch@infradead.org>,
	Catalin Marinas <catalin.marinas@arm.com>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>,
	sparclinux@vger.kernel.org
Subject: [PATCH AUTOSEL 5.10 24/47] sparc64: Use arch_validate_flags() to validate ADI flag
Date: Tue,  2 Mar 2021 06:56:23 -0500	[thread overview]
Message-ID: <20210302115646.62291-24-sashal@kernel.org> (raw)
In-Reply-To: <20210302115646.62291-1-sashal@kernel.org>

From: Khalid Aziz <khalid.aziz@oracle.com>

[ Upstream commit 147d8622f2a26ef34beacc60e1ed8b66c2fa457f ]

When userspace calls mprotect() to enable ADI on an address range,
do_mprotect_pkey() calls arch_validate_prot() to validate new
protection flags. arch_validate_prot() for sparc looks at the first
VMA associated with address range to verify if ADI can indeed be
enabled on this address range. This has two issues - (1) Address
range might cover multiple VMAs while arch_validate_prot() looks at
only the first VMA, (2) arch_validate_prot() peeks at VMA without
holding mmap lock which can result in race condition.

arch_validate_flags() from commit c462ac288f2c ("mm: Introduce
arch_validate_flags()") allows for VMA flags to be validated for all
VMAs that cover the address range given by user while holding mmap
lock. This patch updates sparc code to move the VMA check from
arch_validate_prot() to arch_validate_flags() to fix above two
issues.

Suggested-by: Jann Horn <jannh@google.com>
Suggested-by: Christoph Hellwig <hch@infradead.org>
Suggested-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Khalid Aziz <khalid.aziz@oracle.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/sparc/include/asm/mman.h | 54 +++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 25 deletions(-)

diff --git a/arch/sparc/include/asm/mman.h b/arch/sparc/include/asm/mman.h
index f94532f25db1..274217e7ed70 100644
--- a/arch/sparc/include/asm/mman.h
+++ b/arch/sparc/include/asm/mman.h
@@ -57,35 +57,39 @@ static inline int sparc_validate_prot(unsigned long prot, unsigned long addr)
 {
 	if (prot & ~(PROT_READ | PROT_WRITE | PROT_EXEC | PROT_SEM | PROT_ADI))
 		return 0;
-	if (prot & PROT_ADI) {
-		if (!adi_capable())
-			return 0;
+	return 1;
+}
 
-		if (addr) {
-			struct vm_area_struct *vma;
+#define arch_validate_flags(vm_flags) arch_validate_flags(vm_flags)
+/* arch_validate_flags() - Ensure combination of flags is valid for a
+ *	VMA.
+ */
+static inline bool arch_validate_flags(unsigned long vm_flags)
+{
+	/* If ADI is being enabled on this VMA, check for ADI
+	 * capability on the platform and ensure VMA is suitable
+	 * for ADI
+	 */
+	if (vm_flags & VM_SPARC_ADI) {
+		if (!adi_capable())
+			return false;
 
-			vma = find_vma(current->mm, addr);
-			if (vma) {
-				/* ADI can not be enabled on PFN
-				 * mapped pages
-				 */
-				if (vma->vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
-					return 0;
+		/* ADI can not be enabled on PFN mapped pages */
+		if (vm_flags & (VM_PFNMAP | VM_MIXEDMAP))
+			return false;
 
-				/* Mergeable pages can become unmergeable
-				 * if ADI is enabled on them even if they
-				 * have identical data on them. This can be
-				 * because ADI enabled pages with identical
-				 * data may still not have identical ADI
-				 * tags on them. Disallow ADI on mergeable
-				 * pages.
-				 */
-				if (vma->vm_flags & VM_MERGEABLE)
-					return 0;
-			}
-		}
+		/* Mergeable pages can become unmergeable
+		 * if ADI is enabled on them even if they
+		 * have identical data on them. This can be
+		 * because ADI enabled pages with identical
+		 * data may still not have identical ADI
+		 * tags on them. Disallow ADI on mergeable
+		 * pages.
+		 */
+		if (vm_flags & VM_MERGEABLE)
+			return false;
 	}
-	return 1;
+	return true;
 }
 #endif /* CONFIG_SPARC64 */
 
-- 
2.30.1


  parent reply	other threads:[~2021-03-03  0:21 UTC|newest]

Thread overview: 50+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-03-02 11:56 [PATCH AUTOSEL 5.10 01/47] i2c: rcar: faster irq code to minimize HW race condition Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 02/47] i2c: rcar: optimize cacheline " Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 03/47] scsi: ufs: Add a quirk to permit overriding UniPro defaults Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 04/47] scsi: ufs: WB is only available on LUN #0 to #7 Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 05/47] scsi: ufs: Introduce a quirk to allow only page-aligned sg entries Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 06/47] udf: fix silent AED tagLocation corruption Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 07/47] iommu/vt-d: Clear PRQ overflow only when PRQ is empty Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 08/47] mmc: mxs-mmc: Fix a resource leak in an error handling path in 'mxs_mmc_probe()' Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 09/47] mmc: sdhci-of-dwcmshc: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 10/47] mmc: mediatek: fix race condition between msdc_request_timeout and irq Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 11/47] mmc: sdhci-iproc: Add ACPI bindings for the RPi Sasha Levin
2021-03-02 16:16   ` Jeremy Linton
2021-03-12 22:12     ` Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 12/47] Platform: OLPC: Fix probe error handling Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 13/47] powerpc/pci: Add ppc_md.discover_phbs() Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 14/47] HID: i2c-hid: Add I2C_HID_QUIRK_NO_IRQ_AFTER_RESET for ITE8568 EC on Voyo Winpad A15 Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 15/47] spi: stm32: make spurious and overrun interrupts visible Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 16/47] powerpc: improve handling of unrecoverable system reset Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 17/47] powerpc/perf: Record counter overflow always if SAMPLE_IP is unset Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 18/47] kunit: tool: fix unit test cleanup handling Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 19/47] HID: logitech-dj: add support for the new lightspeed connection iteration Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 20/47] powerpc/64: Fix stack trace not displaying final frame Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 21/47] iommu/amd: Fix performance counter initialization Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 22/47] clk: qcom: gdsc: Implement NO_RET_PERIPH flag Sasha Levin
2021-03-02 23:04   ` Stephen Boyd
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 23/47] sparc32: Limit memblock allocation to low memory Sasha Levin
2021-03-02 11:56 ` Sasha Levin [this message]
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 25/47] ACPICA: Fix race in generic_serial_bus (I2C) and GPIO op_region parameter handling Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 26/47] Input: applespi - don't wait for responses to commands indefinitely Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 27/47] x86, build: use objtool mcount Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 28/47] PCI: xgene-msi: Fix race in installing chained irq handler Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 29/47] misc: eeprom_93xx46: Add quirk to support Microchip 93LC46B eeprom Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 30/47] PCI: mediatek: Add missing of_node_put() to fix reference leak Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 31/47] drivers/base: build kunit tests without structleak plugin Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 32/47] drm/msm/a5xx: Remove overwriting A5XX_PC_DBG_ECO_CNTL register Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 33/47] PCI/LINK: Remove bandwidth notification Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 34/47] ext4: don't try to processed freed blocks until mballoc is initialized Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 35/47] PCI: cadence: Retrain Link to work around Gen2 training defect Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 36/47] kbuild: clamp SUBLEVEL to 255 Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 37/47] PCI: Fix pci_register_io_range() memory leak Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 38/47] i40e: Fix memory leak in i40e_probe Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 39/47] kasan: fix memory corruption in kasan_bitops_tags test Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 40/47] riscv: Get rid of MAX_EARLY_MAPPING_SIZE Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 41/47] s390/smp: __smp_rescan_cpus() - move cpumask away from stack Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 42/47] drivers/base/memory: don't store phys_device in memory blocks Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 43/47] sysctl.c: fix underflow value setting risk in vm_table Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 44/47] scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 45/47] nbd: handle device refs for DESTROY_ON_DISCONNECT properly Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 46/47] scsi: target: core: Add cmd length set before cmd complete Sasha Levin
2021-03-02 11:56 ` [PATCH AUTOSEL 5.10 47/47] scsi: target: core: Prevent underflow for service actions Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210302115646.62291-24-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=catalin.marinas@arm.com \
    --cc=davem@davemloft.net \
    --cc=hch@infradead.org \
    --cc=jannh@google.com \
    --cc=khalid.aziz@oracle.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=sparclinux@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).