linux-arm-kernel.lists.infradead.org archive mirror
 help / color / mirror / Atom feed
From: Catalin Marinas <catalin.marinas@arm.com>
To: linux-arm-kernel@lists.infradead.org
Cc: linux-arch@vger.kernel.org, Szabolcs Nagy <szabolcs.nagy@arm.com>,
	Andrey Konovalov <andreyknvl@google.com>,
	Kevin Brodsky <kevin.brodsky@arm.com>,
	Peter Collingbourne <pcc@google.com>,
	linux-mm@kvack.org, Alexander Viro <viro@zeniv.linux.org.uk>,
	Andrew Morton <akpm@linux-foundation.org>,
	Vincenzo Frascino <vincenzo.frascino@arm.com>,
	Will Deacon <will@kernel.org>,
	Dave P Martin <Dave.Martin@arm.com>
Subject: [PATCH v6 21/26] fs: Handle intra-page faults in copy_mount_options()
Date: Fri,  3 Jul 2020 16:37:13 +0100	[thread overview]
Message-ID: <20200703153718.16973-22-catalin.marinas@arm.com> (raw)
In-Reply-To: <20200703153718.16973-1-catalin.marinas@arm.com>

The copy_mount_options() function takes a user pointer argument but no
size and it tries to read up to a PAGE_SIZE. However, copy_from_user()
is not guaranteed to return all the accessible bytes if, for example,
the access crosses a page boundary and gets a fault on the second page.
To work around this, the current copy_mount_options() implementation
performs two copy_from_user() passes, first to the end of the current
page and the second to what's left in the subsequent page.

On arm64 with MTE enabled, access to a user page may trigger a fault
after part of the buffer in a page has been copied (when the user
pointer tag, bits 56-59, no longer matches the allocation tag stored in
memory). Allow copy_mount_options() to handle such intra-page faults by
resorting to byte at a time copy in case of copy_from_user() failure.

Note that copy_from_user() handles the zeroing of the kernel buffer in
case of error.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
---

Notes:
    v6:
    - Simplified logic to fall-back to byte-by-byte if the copy_from_user()
      fails.
    
    v4:
    - Rewrite to avoid arch_has_exact_copy_from_user()
    
    New in v3.

 fs/namespace.c | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/fs/namespace.c b/fs/namespace.c
index f30ed401cc6d..163ac986dc2d 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -3074,7 +3074,7 @@ static void shrink_submounts(struct mount *mnt)
 void *copy_mount_options(const void __user * data)
 {
 	char *copy;
-	unsigned size;
+	unsigned left, offset;
 
 	if (!data)
 		return NULL;
@@ -3083,16 +3083,27 @@ void *copy_mount_options(const void __user * data)
 	if (!copy)
 		return ERR_PTR(-ENOMEM);
 
-	size = PAGE_SIZE - offset_in_page(data);
+	left = copy_from_user(copy, data, PAGE_SIZE);
 
-	if (copy_from_user(copy, data, size)) {
+	/*
+	 * Not all architectures have an exact copy_form_user(). Resort to
+	 * byte at a time.
+	 */
+	offset = PAGE_SIZE - left;
+	while (left) {
+		char c;
+		if (get_user(c, (const char __user *)data + offset))
+			break;
+		copy[offset] = c;
+		left--;
+		offset++;
+	}
+
+	if (left == PAGE_SIZE) {
 		kfree(copy);
 		return ERR_PTR(-EFAULT);
 	}
-	if (size != PAGE_SIZE) {
-		if (copy_from_user(copy + size, data + size, PAGE_SIZE - size))
-			memset(copy + size, 0, PAGE_SIZE - size);
-	}
+
 	return copy;
 }
 

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  parent reply	other threads:[~2020-07-03 15:43 UTC|newest]

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-03 15:36 [PATCH v6 00/26] arm64: Memory Tagging Extension user-space support Catalin Marinas
2020-07-03 15:36 ` [PATCH v6 01/26] arm64: mte: system register definitions Catalin Marinas
2020-07-03 15:36 ` [PATCH v6 02/26] arm64: mte: CPU feature detection and initial sysreg configuration Catalin Marinas
2020-07-13 10:08   ` Steven Price
2020-07-13 17:45     ` Catalin Marinas
2020-07-03 15:36 ` [PATCH v6 03/26] arm64: mte: Use Normal Tagged attributes for the linear map Catalin Marinas
2020-07-03 15:36 ` [PATCH v6 04/26] arm64: mte: Add specific SIGSEGV codes Catalin Marinas
2020-07-03 15:36 ` [PATCH v6 05/26] arm64: mte: Handle synchronous and asynchronous tag check faults Catalin Marinas
2020-07-03 15:36 ` [PATCH v6 06/26] mm: Add PG_arch_2 page flag Catalin Marinas
2020-07-06  8:24   ` David Hildenbrand
2020-07-06 11:21     ` Catalin Marinas
2020-07-06 12:42       ` David Hildenbrand
2020-07-03 15:36 ` [PATCH v6 07/26] mm: Preserve the PG_arch_* flags in __split_huge_page_tail() Catalin Marinas
2020-07-06 14:16   ` David Hildenbrand
2020-07-06 16:30     ` Catalin Marinas
2020-07-06 17:56       ` David Hildenbrand
2020-07-08 12:17         ` Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 08/26] arm64: mte: Clear the tags when a page is mapped in user-space with PROT_MTE Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 09/26] arm64: mte: Tags-aware copy_{user_, }highpage() implementations Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 10/26] arm64: Avoid unnecessary clear_user_page() indirection Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 11/26] arm64: mte: Tags-aware aware memcmp_pages() implementation Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 12/26] mm: Introduce arch_calc_vm_flag_bits() Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 13/26] arm64: mte: Add PROT_MTE support to mmap() and mprotect() Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 14/26] mm: Introduce arch_validate_flags() Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 15/26] arm64: mte: Validate the PROT_MTE request via arch_validate_flags() Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 16/26] mm: Allow arm64 mmap(PROT_MTE) on RAM-based files Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 17/26] arm64: mte: Allow user control of the tag check mode via prctl() Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 18/26] arm64: mte: Allow user control of the generated random tags " Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 19/26] arm64: mte: Restore the GCR_EL1 register after a suspend Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 20/26] arm64: mte: Add PTRACE_{PEEK,POKE}MTETAGS support Catalin Marinas
2020-07-09 14:41   ` Luis Machado
2020-07-03 15:37 ` Catalin Marinas [this message]
2020-07-03 15:37 ` [PATCH v6 22/26] mm: Add arch hooks for saving/restoring tags Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 23/26] arm64: mte: Enable swap of tagged pages Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 24/26] arm64: mte: Save tags when hibernating Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 25/26] arm64: mte: Kconfig entry Catalin Marinas
2020-07-03 15:37 ` [PATCH v6 26/26] arm64: mte: Add Memory Tagging Extension documentation Catalin Marinas
2020-07-09  9:32   ` Szabolcs Nagy
2020-07-09 14:43     ` Catalin Marinas

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200703153718.16973-22-catalin.marinas@arm.com \
    --to=catalin.marinas@arm.com \
    --cc=Dave.Martin@arm.com \
    --cc=akpm@linux-foundation.org \
    --cc=andreyknvl@google.com \
    --cc=kevin.brodsky@arm.com \
    --cc=linux-arch@vger.kernel.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-mm@kvack.org \
    --cc=pcc@google.com \
    --cc=szabolcs.nagy@arm.com \
    --cc=vincenzo.frascino@arm.com \
    --cc=viro@zeniv.linux.org.uk \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).