From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932441AbeCIOz6 (ORCPT ); Fri, 9 Mar 2018 09:55:58 -0500 Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:53238 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932207AbeCIOzx (ORCPT ); Fri, 9 Mar 2018 09:55:53 -0500 Date: Fri, 9 Mar 2018 14:55:47 +0000 From: Mark Rutland To: Andrey Konovalov Cc: Catalin Marinas , Will Deacon , Robin Murphy , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, Arnd Bergmann , linux-arch@vger.kernel.org, Dmitry Vyukov , Kostya Serebryany , Evgeniy Stepanov , Lee Smith , Ramana Radhakrishnan , Jacob Bramley , Ruben Ayrapetyan Subject: Re: [RFC PATCH 0/6] arm64: untag user pointers passed to the kernel Message-ID: <20180309145547.r25eis5ejy6d6xzu@lakrids.cambridge.arm.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20170113 (1.7.2) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, [trimming Ccs] On Fri, Mar 09, 2018 at 03:01:58PM +0100, Andrey Konovalov wrote: > arm64 has a feature called Top Byte Ignore, which allows to embed pointer > tags into the top byte of each pointer. Userspace programs (such as > HWASan, a memory debugging tool [1]) might use this feature and pass > tagged user pointers to the kernel through syscalls or other interfaces. > > This patch makes a few of the kernel interfaces accept tagged user > pointers. The kernel is already able to handle user faults with tagged > pointers and has the untagged_addr macro, which this patchset reuses. > > We're not trying to cover all possible ways the kernel accepts user > pointers in one patchset, so this one should be considered as a start. > It would be nice to learn about the interfaces that I missed though. There are many ways that user pointers can be passed to the kernel, and I'm not sure that it's feasible to catch them all, especially as user pointers are often passed in data structures (e.g. iovecs) rather than direct syscall arguments. If we *really* want the kernel to support taking tagged addresses, anything with a __user annotation (or cast to something with a __user annotation) requires tag removal somewhere in the kernel. It looks like there are plenty uapi structures and syscalls to look at: [mark@lakrids:~/src/linux]% git grep __user -- include/uapi | wc -l 216 [mark@lakrids:~/src/linux]% git grep __user | grep SYSCALL_DEFINE | wc -l 308 ... in addition to special syscalls like ioctl which multiplex a number of operations with different arguments, where the tag stripping would have to occur elsewhere (e.g. in particular drivers). I also wonder if we ever write any of these pointers back to userspace memory. If so, we have a nasty ABI problem, since we'll have to marshal the original tag along with the pointer, to ensure userspace pointer comparisons continue to work. Thanks, Mark. From mboxrd@z Thu Jan 1 00:00:00 1970 From: mark.rutland@arm.com (Mark Rutland) Date: Fri, 9 Mar 2018 14:55:47 +0000 Subject: [RFC PATCH 0/6] arm64: untag user pointers passed to the kernel In-Reply-To: References: Message-ID: <20180309145547.r25eis5ejy6d6xzu@lakrids.cambridge.arm.com> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org Hi, [trimming Ccs] On Fri, Mar 09, 2018 at 03:01:58PM +0100, Andrey Konovalov wrote: > arm64 has a feature called Top Byte Ignore, which allows to embed pointer > tags into the top byte of each pointer. Userspace programs (such as > HWASan, a memory debugging tool [1]) might use this feature and pass > tagged user pointers to the kernel through syscalls or other interfaces. > > This patch makes a few of the kernel interfaces accept tagged user > pointers. The kernel is already able to handle user faults with tagged > pointers and has the untagged_addr macro, which this patchset reuses. > > We're not trying to cover all possible ways the kernel accepts user > pointers in one patchset, so this one should be considered as a start. > It would be nice to learn about the interfaces that I missed though. There are many ways that user pointers can be passed to the kernel, and I'm not sure that it's feasible to catch them all, especially as user pointers are often passed in data structures (e.g. iovecs) rather than direct syscall arguments. If we *really* want the kernel to support taking tagged addresses, anything with a __user annotation (or cast to something with a __user annotation) requires tag removal somewhere in the kernel. It looks like there are plenty uapi structures and syscalls to look at: [mark at lakrids:~/src/linux]% git grep __user -- include/uapi | wc -l 216 [mark at lakrids:~/src/linux]% git grep __user | grep SYSCALL_DEFINE | wc -l 308 ... in addition to special syscalls like ioctl which multiplex a number of operations with different arguments, where the tag stripping would have to occur elsewhere (e.g. in particular drivers). I also wonder if we ever write any of these pointers back to userspace memory. If so, we have a nasty ABI problem, since we'll have to marshal the original tag along with the pointer, to ensure userspace pointer comparisons continue to work. Thanks, Mark.