From: Peter Collingbourne <pcc@google.com> To: Catalin Marinas <catalin.marinas@arm.com>, Vincenzo Frascino <vincenzo.frascino@arm.com>, Dave Martin <Dave.Martin@arm.com>, Will Deacon <will@kernel.org>, Andrew Morton <akpm@linux-foundation.org>, Andrea Arcangeli <aarcange@redhat.com> Cc: Peter Collingbourne <pcc@google.com>, Alistair Delva <adelva@google.com>, Lokesh Gidra <lokeshgidra@google.com>, William McVicker <willmcvicker@google.com>, Evgenii Stepanov <eugenis@google.com>, Mitch Phillips <mitchp@google.com>, Linux ARM <linux-arm-kernel@lists.infradead.org>, linux-mm@kvack.org, Andrey Konovalov <andreyknvl@gmail.com> Subject: [PATCH v3 0/2] userfaultfd: do not untag user pointers Date: Fri, 2 Jul 2021 15:57:03 -0700 [thread overview] Message-ID: <20210702225705.2477947-1-pcc@google.com> (raw) If a user program uses userfaultfd on ranges of heap memory, it may end up passing a tagged pointer to the kernel in the range.start field of the UFFDIO_REGISTER ioctl. This can happen when using an MTE-capable allocator, or on Android if using the Tagged Pointers feature for MTE readiness [1]. When a fault subsequently occurs, the tag is stripped from the fault address returned to the application in the fault.address field of struct uffd_msg. However, from the application's perspective, the tagged address *is* the memory address, so if the application is unaware of memory tags, it may get confused by receiving an address that is, from its point of view, outside of the bounds of the allocation. We observed this behavior in the kselftest for userfaultfd [2] but other applications could have the same problem. Address this by not untagging pointers passed to the userfaultfd ioctls. Instead, let the system call fail. Also change the kselftest to use mmap so that it doesn't encounter this problem. [1] https://source.android.com/devices/tech/debug/tagged-pointers [2] tools/testing/selftests/vm/userfaultfd.c Peter Collingbourne (2): userfaultfd: do not untag user pointers selftest: use mmap instead of posix_memalign to allocate memory Documentation/arm64/tagged-address-abi.rst | 25 +++++++++++++++------- fs/userfaultfd.c | 22 +++++++++---------- tools/testing/selftests/vm/userfaultfd.c | 6 ++++-- 3 files changed, 31 insertions(+), 22 deletions(-) -- 2.32.0.93.g670b81a890-goog
WARNING: multiple messages have this Message-ID (diff)
From: Peter Collingbourne <pcc@google.com> To: Catalin Marinas <catalin.marinas@arm.com>, Vincenzo Frascino <vincenzo.frascino@arm.com>, Dave Martin <Dave.Martin@arm.com>, Will Deacon <will@kernel.org>, Andrew Morton <akpm@linux-foundation.org>, Andrea Arcangeli <aarcange@redhat.com> Cc: Peter Collingbourne <pcc@google.com>, Alistair Delva <adelva@google.com>, Lokesh Gidra <lokeshgidra@google.com>, William McVicker <willmcvicker@google.com>, Evgenii Stepanov <eugenis@google.com>, Mitch Phillips <mitchp@google.com>, Linux ARM <linux-arm-kernel@lists.infradead.org>, linux-mm@kvack.org, Andrey Konovalov <andreyknvl@gmail.com> Subject: [PATCH v3 0/2] userfaultfd: do not untag user pointers Date: Fri, 2 Jul 2021 15:57:03 -0700 [thread overview] Message-ID: <20210702225705.2477947-1-pcc@google.com> (raw) If a user program uses userfaultfd on ranges of heap memory, it may end up passing a tagged pointer to the kernel in the range.start field of the UFFDIO_REGISTER ioctl. This can happen when using an MTE-capable allocator, or on Android if using the Tagged Pointers feature for MTE readiness [1]. When a fault subsequently occurs, the tag is stripped from the fault address returned to the application in the fault.address field of struct uffd_msg. However, from the application's perspective, the tagged address *is* the memory address, so if the application is unaware of memory tags, it may get confused by receiving an address that is, from its point of view, outside of the bounds of the allocation. We observed this behavior in the kselftest for userfaultfd [2] but other applications could have the same problem. Address this by not untagging pointers passed to the userfaultfd ioctls. Instead, let the system call fail. Also change the kselftest to use mmap so that it doesn't encounter this problem. [1] https://source.android.com/devices/tech/debug/tagged-pointers [2] tools/testing/selftests/vm/userfaultfd.c Peter Collingbourne (2): userfaultfd: do not untag user pointers selftest: use mmap instead of posix_memalign to allocate memory Documentation/arm64/tagged-address-abi.rst | 25 +++++++++++++++------- fs/userfaultfd.c | 22 +++++++++---------- tools/testing/selftests/vm/userfaultfd.c | 6 ++++-- 3 files changed, 31 insertions(+), 22 deletions(-) -- 2.32.0.93.g670b81a890-goog _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next reply other threads:[~2021-07-02 22:57 UTC|newest] Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top 2021-07-02 22:57 Peter Collingbourne [this message] 2021-07-02 22:57 ` [PATCH v3 0/2] userfaultfd: do not untag user pointers Peter Collingbourne 2021-07-02 22:57 ` [PATCH v3 1/2] " Peter Collingbourne 2021-07-02 22:57 ` Peter Collingbourne 2021-07-02 22:57 ` Peter Collingbourne 2021-07-03 2:46 ` kernel test robot 2021-07-03 2:46 ` kernel test robot 2021-07-03 3:06 ` kernel test robot 2021-07-03 3:06 ` kernel test robot 2021-07-03 5:02 ` kernel test robot 2021-07-03 5:02 ` kernel test robot 2021-07-03 9:05 ` kernel test robot 2021-07-03 9:05 ` kernel test robot 2021-07-04 15:39 ` Andrey Konovalov 2021-07-04 15:39 ` Andrey Konovalov 2021-07-04 15:39 ` Andrey Konovalov 2021-07-02 22:57 ` [PATCH v3 2/2] selftest: use mmap instead of posix_memalign to allocate memory Peter Collingbourne 2021-07-02 22:57 ` Peter Collingbourne 2021-07-02 22:57 ` Peter Collingbourne
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20210702225705.2477947-1-pcc@google.com \ --to=pcc@google.com \ --cc=Dave.Martin@arm.com \ --cc=aarcange@redhat.com \ --cc=adelva@google.com \ --cc=akpm@linux-foundation.org \ --cc=andreyknvl@gmail.com \ --cc=catalin.marinas@arm.com \ --cc=eugenis@google.com \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-mm@kvack.org \ --cc=lokeshgidra@google.com \ --cc=mitchp@google.com \ --cc=vincenzo.frascino@arm.com \ --cc=will@kernel.org \ --cc=willmcvicker@google.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.