From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFF93C4363C for ; Thu, 8 Oct 2020 06:23:30 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 5283E2076B for ; Thu, 8 Oct 2020 06:23:30 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="HxGMBLAQ"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=infradead.org header.i=@infradead.org header.b="hdRv5sr7" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5283E2076B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=infradead.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References:Message-ID: Subject:To:From:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=er+2IS8mb24XWmvkOuc2dVof14ryx6VM8q2kKScPqlM=; b=HxGMBLAQ09U+kbfqjnGwzehD0 3Pl41WguCQ7KitH3IcopqCP2y8gfCt9ShKYNKRdbcvUD0hzTpAGn/UvKcolAwZ7NGl5ta3ok8dpNc 1YUuu0LliPRgpECnNjVZ56WhN/v1UPiTUsv6OoAi+F9jkaXgaGZKn4C7ARgdfF7vqYMDzI2IE9Xf/ 1MeJStWjBsykrakg1QQQte59kUcj9rTfC2rkkG+t6gXjiNqNw+5/IoGYgr21pdSIIjbbnRgpuSVck MKeCDy1e/k/uIGE1kBH0efHgEmE/CWajACkAIWDbuZZLAN3+/8ql0cWEAXceowMTZBxgeXp04z5rG HsUPbMUAA==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kQPJD-0002It-VG; Thu, 08 Oct 2020 06:21:47 +0000 Received: from casper.infradead.org ([2001:8b0:10b:1236::1]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kQPJC-0002In-Fz for linux-arm-kernel@merlin.infradead.org; Thu, 08 Oct 2020 06:21:46 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=yUoIc9I8zBFW1l1RUkMTpa9dMjCgFjwiUO5I2agyv3s=; b=hdRv5sr7QtXVOGXnAnhUe3FNGb SRotAyEmN3rCMEJEhz3DikQcIqwCTG7CrAXiGiJWRUiku6BDUa42w6DZZiCTkfkbxFoXIe7hgn76r +C3TZkRE3oivb3DH5SBC/7jmkOXuTxXsYCUrSeefXQOupAXXmHcOAHPsplH9Um35Qqw3L/7lh0c2R i2QFfuqlGN1tfs6y+SyuJJCpyrrrN502ektDR3lor/9mvl6TtW94LyJ01rK7Nbdg2H7PMHKQIP93E NeJhUT3dXGmvhbe8Yp0AXOEET4abmXiWKvn13m9skKm3U05B8wtsNCsN+hd1Ih2h7T+f9vwrEqpAW cwLC1J/Q==; Received: from hch by casper.infradead.org with local (Exim 4.92.3 #3 (Red Hat Linux)) id 1kQPJ6-00070T-71; Thu, 08 Oct 2020 06:21:40 +0000 Date: Thu, 8 Oct 2020 07:21:40 +0100 From: Christoph Hellwig To: Jann Horn Subject: Re: [PATCH 1/2] mm/mprotect: Call arch_validate_prot under mmap_lock and with length Message-ID: <20201008062140.GA24315@infradead.org> References: <20201007073932.865218-1-jannh@google.com> <20201007123544.GA11433@infradead.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-SRS-Rewrite: SMTP reverse-path rewritten from by casper.infradead.org. See http://www.infradead.org/rpr.html X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Dave Kleikamp , Will Deacon , Linux-MM , Michael Ellerman , kernel list , Christoph Hellwig , Catalin Marinas , Khalid Aziz , Paul Mackerras , Benjamin Herrenschmidt , sparclinux@vger.kernel.org, Anthony Yznaga , Andrew Morton , linuxppc-dev@lists.ozlabs.org, "David S. Miller" , Linux ARM Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Wed, Oct 07, 2020 at 04:42:55PM +0200, Jann Horn wrote: > > > @@ -43,7 +43,7 @@ static inline long do_mmap2(unsigned long addr, size_t len, > > > { > > > long ret = -EINVAL; > > > > > > - if (!arch_validate_prot(prot, addr)) > > > + if (!arch_validate_prot(prot, addr, len)) > > > > This call isn't under mmap lock. I also find it rather weird as the > > generic code only calls arch_validate_prot from mprotect, only powerpc > > also calls it from mmap. > > > > This seems to go back to commit ef3d3246a0d0 > > ("powerpc/mm: Add Strong Access Ordering support") > > I'm _guessing_ the idea in the generic case might be that mmap() > doesn't check unknown bits in the protection flags, and therefore > maybe people wanted to avoid adding new error cases that could be > caused by random high bits being set? So while the mprotect() case > checks the flags and refuses unknown values, the mmap() code just lets > the architecture figure out which bits are actually valid to set (via > arch_calc_vm_prot_bits()) and silently ignores the rest? > > And powerpc apparently decided that they do want to error out on bogus > prot values passed to their version of mmap(), and in exchange, assume > in arch_calc_vm_prot_bits() that the protection bits are valid? The problem really is that now programs behave different on powerpc compared to all other architectures. > powerpc's arch_validate_prot() doesn't actually need the mmap lock, so > I think this is fine-ish for now (as in, while the code is a bit > unclean, I don't think I'm making it worse, and I don't think it's > actually buggy). In theory, we could move the arch_validate_prot() > call over into the mmap guts, where we're holding the lock, and gate > it on the architecture or on some feature CONFIG that powerpc can > activate in its Kconfig. But I'm not sure whether that'd be helping or > making things worse, so when I sent this patch, I deliberately left > the powerpc stuff as-is. For now I'd just duplicate the trivial logic from arch_validate_prot in the powerpc version of do_mmap2 and add a comment that this check causes a gratious incompatibility to all other architectures. And then hope that the powerpc maintainers fix it up :) _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel