* [PATCH v13 01/20] uaccess: add untagged_addr definition for other arches
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 02/20] arm64: untag user pointers in access_ok and __uaccess_mask_ptr Andrey Konovalov
` (18 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
To allow arm64 syscalls to accept tagged pointers from userspace, we must
untag them when they are passed to the kernel. Since untagging is done in
generic parts of the kernel, the untagged_addr macro needs to be defined
for all architectures.
Define it as a noop for architectures other than arm64.
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
include/linux/mm.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 76769749b5a5..4d674518d392 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -99,6 +99,10 @@ extern int mmap_rnd_compat_bits __read_mostly;
#include <asm/pgtable.h>
#include <asm/processor.h>
+#ifndef untagged_addr
+#define untagged_addr(addr) (addr)
+#endif
+
#ifndef __pa_symbol
#define __pa_symbol(x) __pa(RELOC_HIDE((unsigned long)(x), 0))
#endif
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 02/20] arm64: untag user pointers in access_ok and __uaccess_mask_ptr
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 01/20] uaccess: add untagged_addr definition for other arches Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 03/20] lib, arm64: untag user pointers in strn*_user Andrey Konovalov
` (17 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
copy_from_user (and a few other similar functions) are used to copy data
from user memory into the kernel memory or vice versa. Since a user can
provided a tagged pointer to one of the syscalls that use copy_from_user,
we need to correctly handle such pointers.
Do this by untagging user pointers in access_ok and in __uaccess_mask_ptr,
before performing access validity checks.
Note, that this patch only temporarily untags the pointers to perform the
checks, but then passes them as is into the kernel internals.
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
arch/arm64/include/asm/uaccess.h | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index e5d5f31c6d36..9164ecb5feca 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -94,7 +94,7 @@ static inline unsigned long __range_ok(const void __user *addr, unsigned long si
return ret;
}
-#define access_ok(addr, size) __range_ok(addr, size)
+#define access_ok(addr, size) __range_ok(untagged_addr(addr), size)
#define user_addr_max get_fs
#define _ASM_EXTABLE(from, to) \
@@ -226,7 +226,8 @@ static inline void uaccess_enable_not_uao(void)
/*
* Sanitise a uaccess pointer such that it becomes NULL if above the
- * current addr_limit.
+ * current addr_limit. In case the pointer is tagged (has the top byte set),
+ * untag the pointer before checking.
*/
#define uaccess_mask_ptr(ptr) (__typeof__(ptr))__uaccess_mask_ptr(ptr)
static inline void __user *__uaccess_mask_ptr(const void __user *ptr)
@@ -234,10 +235,11 @@ static inline void __user *__uaccess_mask_ptr(const void __user *ptr)
void __user *safe_ptr;
asm volatile(
- " bics xzr, %1, %2\n"
+ " bics xzr, %3, %2\n"
" csel %0, %1, xzr, eq\n"
: "=&r" (safe_ptr)
- : "r" (ptr), "r" (current_thread_info()->addr_limit)
+ : "r" (ptr), "r" (current_thread_info()->addr_limit),
+ "r" (untagged_addr(ptr))
: "cc");
csdb();
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 03/20] lib, arm64: untag user pointers in strn*_user
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 01/20] uaccess: add untagged_addr definition for other arches Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 02/20] arm64: untag user pointers in access_ok and __uaccess_mask_ptr Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 04/20] mm, arm64: untag user pointers passed to memory syscalls Andrey Konovalov
` (16 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
strncpy_from_user and strnlen_user accept user addresses as arguments, and
do not go through the same path as copy_from_user and others, so here we
need to handle the case of tagged user addresses separately.
Untag user pointers passed to these functions.
Note, that this patch only temporarily untags the pointers to perform
validity checks, but then uses them as is to perform user memory accesses.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
lib/strncpy_from_user.c | 3 ++-
lib/strnlen_user.c | 3 ++-
2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/lib/strncpy_from_user.c b/lib/strncpy_from_user.c
index 58eacd41526c..6209bb9507c7 100644
--- a/lib/strncpy_from_user.c
+++ b/lib/strncpy_from_user.c
@@ -6,6 +6,7 @@
#include <linux/uaccess.h>
#include <linux/kernel.h>
#include <linux/errno.h>
+#include <linux/mm.h>
#include <asm/byteorder.h>
#include <asm/word-at-a-time.h>
@@ -107,7 +108,7 @@ long strncpy_from_user(char *dst, const char __user *src, long count)
return 0;
max_addr = user_addr_max();
- src_addr = (unsigned long)src;
+ src_addr = (unsigned long)untagged_addr(src);
if (likely(src_addr < max_addr)) {
unsigned long max = max_addr - src_addr;
long retval;
diff --git a/lib/strnlen_user.c b/lib/strnlen_user.c
index 1c1a1b0e38a5..8ca3d2ac32ec 100644
--- a/lib/strnlen_user.c
+++ b/lib/strnlen_user.c
@@ -2,6 +2,7 @@
#include <linux/kernel.h>
#include <linux/export.h>
#include <linux/uaccess.h>
+#include <linux/mm.h>
#include <asm/word-at-a-time.h>
@@ -109,7 +110,7 @@ long strnlen_user(const char __user *str, long count)
return 0;
max_addr = user_addr_max();
- src_addr = (unsigned long)str;
+ src_addr = (unsigned long)untagged_addr(str);
if (likely(src_addr < max_addr)) {
unsigned long max = max_addr - src_addr;
long retval;
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 04/20] mm, arm64: untag user pointers passed to memory syscalls
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (2 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 03/20] lib, arm64: untag user pointers in strn*_user Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 05/20] mm, arm64: untag user pointers in mm/gup.c Andrey Konovalov
` (15 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
This patch allows tagged pointers to be passed to the following memory
syscalls: madvise, mbind, get_mempolicy, mincore, mlock, mlock2, brk,
mmap_pgoff, old_mmap, munmap, remap_file_pages, mprotect, pkey_mprotect,
mremap, msync and shmdt.
This is done by untagging pointers passed to these syscalls in the
prologues of their handlers.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
ipc/shm.c | 2 ++
mm/madvise.c | 2 ++
mm/mempolicy.c | 5 +++++
mm/migrate.c | 1 +
mm/mincore.c | 2 ++
mm/mlock.c | 5 +++++
mm/mmap.c | 7 +++++++
mm/mprotect.c | 1 +
mm/mremap.c | 2 ++
mm/msync.c | 2 ++
10 files changed, 29 insertions(+)
diff --git a/ipc/shm.c b/ipc/shm.c
index ce1ca9f7c6e9..7af8951e6c41 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -1593,6 +1593,7 @@ SYSCALL_DEFINE3(shmat, int, shmid, char __user *, shmaddr, int, shmflg)
unsigned long ret;
long err;
+ shmaddr = untagged_addr(shmaddr);
err = do_shmat(shmid, shmaddr, shmflg, &ret, SHMLBA);
if (err)
return err;
@@ -1732,6 +1733,7 @@ long ksys_shmdt(char __user *shmaddr)
SYSCALL_DEFINE1(shmdt, char __user *, shmaddr)
{
+ shmaddr = untagged_addr(shmaddr);
return ksys_shmdt(shmaddr);
}
diff --git a/mm/madvise.c b/mm/madvise.c
index 21a7881a2db4..64e6d34a7f9b 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -809,6 +809,8 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
size_t len;
struct blk_plug plug;
+ start = untagged_addr(start);
+
if (!madvise_behavior_valid(behavior))
return error;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index af171ccb56a2..31691737c59c 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1334,6 +1334,7 @@ static long kernel_mbind(unsigned long start, unsigned long len,
int err;
unsigned short mode_flags;
+ start = untagged_addr(start);
mode_flags = mode & MPOL_MODE_FLAGS;
mode &= ~MPOL_MODE_FLAGS;
if (mode >= MPOL_MAX)
@@ -1491,6 +1492,8 @@ static int kernel_get_mempolicy(int __user *policy,
int uninitialized_var(pval);
nodemask_t nodes;
+ addr = untagged_addr(addr);
+
if (nmask != NULL && maxnode < nr_node_ids)
return -EINVAL;
@@ -1576,6 +1579,8 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len,
unsigned long nr_bits, alloc_size;
nodemask_t bm;
+ start = untagged_addr(start);
+
nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
diff --git a/mm/migrate.c b/mm/migrate.c
index ac6f4939bb59..ecc6dcdefb1f 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1612,6 +1612,7 @@ static int do_pages_move(struct mm_struct *mm, nodemask_t task_nodes,
if (get_user(node, nodes + i))
goto out_flush;
addr = (unsigned long)p;
+ addr = untagged_addr(addr);
err = -ENODEV;
if (node < 0 || node >= MAX_NUMNODES)
diff --git a/mm/mincore.c b/mm/mincore.c
index 218099b5ed31..c4a3f4484b6b 100644
--- a/mm/mincore.c
+++ b/mm/mincore.c
@@ -228,6 +228,8 @@ SYSCALL_DEFINE3(mincore, unsigned long, start, size_t, len,
unsigned long pages;
unsigned char *tmp;
+ start = untagged_addr(start);
+
/* Check the start address: needs to be page-aligned.. */
if (start & ~PAGE_MASK)
return -EINVAL;
diff --git a/mm/mlock.c b/mm/mlock.c
index 080f3b36415b..6934ec92bf39 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -715,6 +715,7 @@ static __must_check int do_mlock(unsigned long start, size_t len, vm_flags_t fla
SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
{
+ start = untagged_addr(start);
return do_mlock(start, len, VM_LOCKED);
}
@@ -722,6 +723,8 @@ SYSCALL_DEFINE3(mlock2, unsigned long, start, size_t, len, int, flags)
{
vm_flags_t vm_flags = VM_LOCKED;
+ start = untagged_addr(start);
+
if (flags & ~MLOCK_ONFAULT)
return -EINVAL;
@@ -735,6 +738,8 @@ SYSCALL_DEFINE2(munlock, unsigned long, start, size_t, len)
{
int ret;
+ start = untagged_addr(start);
+
len = PAGE_ALIGN(len + (offset_in_page(start)));
start &= PAGE_MASK;
diff --git a/mm/mmap.c b/mm/mmap.c
index 41eb48d9b527..512c679c7f33 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -199,6 +199,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
bool downgraded = false;
LIST_HEAD(uf);
+ brk = untagged_addr(brk);
+
if (down_write_killable(&mm->mmap_sem))
return -EINTR;
@@ -1571,6 +1573,8 @@ unsigned long ksys_mmap_pgoff(unsigned long addr, unsigned long len,
struct file *file = NULL;
unsigned long retval;
+ addr = untagged_addr(addr);
+
if (!(flags & MAP_ANONYMOUS)) {
audit_mmap_fd(fd, flags);
file = fget(fd);
@@ -2867,6 +2871,7 @@ EXPORT_SYMBOL(vm_munmap);
SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len)
{
+ addr = untagged_addr(addr);
profile_munmap(addr);
return __vm_munmap(addr, len, true);
}
@@ -2885,6 +2890,8 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
unsigned long ret = -EINVAL;
struct file *file;
+ start = untagged_addr(start);
+
pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.rst.\n",
current->comm, current->pid);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 028c724dcb1a..3c2b11629f89 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -468,6 +468,7 @@ static int do_mprotect_pkey(unsigned long start, size_t len,
if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
return -EINVAL;
+ start = untagged_addr(start);
if (start & ~PAGE_MASK)
return -EINVAL;
if (!len)
diff --git a/mm/mremap.c b/mm/mremap.c
index e3edef6b7a12..6422aeee65bb 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c
@@ -605,6 +605,8 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len,
LIST_HEAD(uf_unmap_early);
LIST_HEAD(uf_unmap);
+ addr = untagged_addr(addr);
+
if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
return ret;
diff --git a/mm/msync.c b/mm/msync.c
index ef30a429623a..c3bd3e75f687 100644
--- a/mm/msync.c
+++ b/mm/msync.c
@@ -37,6 +37,8 @@ SYSCALL_DEFINE3(msync, unsigned long, start, size_t, len, int, flags)
int unmapped_error = 0;
int error = -EINVAL;
+ start = untagged_addr(start);
+
if (flags & ~(MS_ASYNC | MS_INVALIDATE | MS_SYNC))
goto out;
if (offset_in_page(start))
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 05/20] mm, arm64: untag user pointers in mm/gup.c
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (3 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 04/20] mm, arm64: untag user pointers passed to memory syscalls Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 06/20] mm, arm64: untag user pointers in get_vaddr_frames Andrey Konovalov
` (14 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
mm/gup.c provides a kernel interface that accepts user addresses and
manipulates user pages directly (for example get_user_pages, that is used
by the futex syscall). Since a user can provided tagged addresses, we need
to handle this case.
Add untagging to gup.c functions that use user addresses for vma lookups.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
mm/gup.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/mm/gup.c b/mm/gup.c
index f84e22685aaa..3192741e0b3a 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -686,6 +686,8 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
if (!nr_pages)
return 0;
+ start = untagged_addr(start);
+
VM_BUG_ON(!!pages != !!(gup_flags & FOLL_GET));
/*
@@ -848,6 +850,8 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
struct vm_area_struct *vma;
vm_fault_t ret, major = 0;
+ address = untagged_addr(address);
+
if (unlocked)
fault_flags |= FAULT_FLAG_ALLOW_RETRY;
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 06/20] mm, arm64: untag user pointers in get_vaddr_frames
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (4 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 05/20] mm, arm64: untag user pointers in mm/gup.c Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 07/20] fs, arm64: untag user pointers in copy_mount_options Andrey Konovalov
` (13 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
get_vaddr_frames uses provided user pointers for vma lookups, which can
only by done with untagged pointers. Instead of locating and changing
all callers of this function, perform untagging in it.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
mm/frame_vector.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/mm/frame_vector.c b/mm/frame_vector.c
index c64dca6e27c2..c431ca81dad5 100644
--- a/mm/frame_vector.c
+++ b/mm/frame_vector.c
@@ -46,6 +46,8 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames,
if (WARN_ON_ONCE(nr_frames > vec->nr_allocated))
nr_frames = vec->nr_allocated;
+ start = untagged_addr(start);
+
down_read(&mm->mmap_sem);
locked = 1;
vma = find_vma_intersection(mm, start, start + 1);
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 07/20] fs, arm64: untag user pointers in copy_mount_options
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (5 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 06/20] mm, arm64: untag user pointers in get_vaddr_frames Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 08/20] fs, arm64: untag user pointers in fs/userfaultfd.c Andrey Konovalov
` (12 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
In copy_mount_options a user address is being subtracted from TASK_SIZE.
If the address is lower than TASK_SIZE, the size is calculated to not
allow the exact_copy_from_user() call to cross TASK_SIZE boundary.
However if the address is tagged, then the size will be calculated
incorrectly.
Untag the address before subtracting.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
fs/namespace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/namespace.c b/fs/namespace.c
index c9cab307fa77..c27e5713bf04 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2825,7 +2825,7 @@ void *copy_mount_options(const void __user * data)
* the remainder of the page.
*/
/* copy_from_user cannot cross TASK_SIZE ! */
- size = TASK_SIZE - (unsigned long)data;
+ size = TASK_SIZE - (unsigned long)untagged_addr(data);
if (size > PAGE_SIZE)
size = PAGE_SIZE;
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 08/20] fs, arm64: untag user pointers in fs/userfaultfd.c
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (6 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 07/20] fs, arm64: untag user pointers in copy_mount_options Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 09/20] net, arm64: untag user pointers in tcp_zerocopy_receive Andrey Konovalov
` (11 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
userfaultfd_register() and userfaultfd_unregister() use provided user
pointers for vma lookups, which can only by done with untagged pointers.
Untag user pointers in these functions.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
fs/userfaultfd.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 89800fc7dc9d..a3b70e0d9756 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -1320,6 +1320,9 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx,
goto out;
}
+ uffdio_register.range.start =
+ untagged_addr(uffdio_register.range.start);
+
ret = validate_range(mm, uffdio_register.range.start,
uffdio_register.range.len);
if (ret)
@@ -1507,6 +1510,8 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx,
if (copy_from_user(&uffdio_unregister, buf, sizeof(uffdio_unregister)))
goto out;
+ uffdio_unregister.start = untagged_addr(uffdio_unregister.start);
+
ret = validate_range(mm, uffdio_unregister.start,
uffdio_unregister.len);
if (ret)
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 09/20] net, arm64: untag user pointers in tcp_zerocopy_receive
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (7 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 08/20] fs, arm64: untag user pointers in fs/userfaultfd.c Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 10/20] kernel, arm64: untag user pointers in prctl_set_mm* Andrey Konovalov
` (10 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
tcp_zerocopy_receive() uses provided user pointers for vma lookups, which
can only by done with untagged pointers.
Untag user pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
net/ipv4/tcp.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 6baa6dc1b13b..855a1f68c1ea 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1761,6 +1761,8 @@ static int tcp_zerocopy_receive(struct sock *sk,
if (address & (PAGE_SIZE - 1) || address != zc->address)
return -EINVAL;
+ address = untagged_addr(address);
+
if (sk->sk_state == TCP_LISTEN)
return -ENOTCONN;
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 10/20] kernel, arm64: untag user pointers in prctl_set_mm*
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (8 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 09/20] net, arm64: untag user pointers in tcp_zerocopy_receive Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-21 17:52 ` Kevin Brodsky
2019-03-20 14:51 ` [PATCH v13 11/20] tracing, arm64: untag user pointers in seq_print_user_ip Andrey Konovalov
` (9 subsequent siblings)
19 siblings, 1 reply; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
prctl_set_mm() and prctl_set_mm_map() use provided user pointers for vma
lookups and do some pointer comparisons to perform validation, which can
only by done with untagged pointers.
Untag user pointers in these functions for vma lookup and validity checks.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
kernel/sys.c | 44 ++++++++++++++++++++++++++++++--------------
1 file changed, 30 insertions(+), 14 deletions(-)
diff --git a/kernel/sys.c b/kernel/sys.c
index 12df0e5434b8..fe26ccf3c9e6 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1885,11 +1885,12 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
* WARNING: we don't require any capability here so be very careful
* in what is allowed for modification from userspace.
*/
-static int validate_prctl_map(struct prctl_mm_map *prctl_map)
+static int validate_prctl_map(struct prctl_mm_map *tagged_prctl_map)
{
unsigned long mmap_max_addr = TASK_SIZE;
struct mm_struct *mm = current->mm;
int error = -EINVAL, i;
+ struct prctl_mm_map prctl_map;
static const unsigned char offsets[] = {
offsetof(struct prctl_mm_map, start_code),
@@ -1905,12 +1906,25 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
offsetof(struct prctl_mm_map, env_end),
};
+ memcpy(&prctl_map, tagged_prctl_map, sizeof(prctl_map));
+ prctl_map.start_code = untagged_addr(prctl_map.start_code);
+ prctl_map.end_code = untagged_addr(prctl_map.end_code);
+ prctl_map.start_data = untagged_addr(prctl_map.start_data);
+ prctl_map.end_data = untagged_addr(prctl_map.end_data);
+ prctl_map.start_brk = untagged_addr(prctl_map.start_brk);
+ prctl_map.brk = untagged_addr(prctl_map.brk);
+ prctl_map.start_stack = untagged_addr(prctl_map.start_stack);
+ prctl_map.arg_start = untagged_addr(prctl_map.arg_start);
+ prctl_map.arg_end = untagged_addr(prctl_map.arg_end);
+ prctl_map.env_start = untagged_addr(prctl_map.env_start);
+ prctl_map.env_end = untagged_addr(prctl_map.env_end);
+
/*
* Make sure the members are not somewhere outside
* of allowed address space.
*/
for (i = 0; i < ARRAY_SIZE(offsets); i++) {
- u64 val = *(u64 *)((char *)prctl_map + offsets[i]);
+ u64 val = *(u64 *)((char *)&prctl_map + offsets[i]);
if ((unsigned long)val >= mmap_max_addr ||
(unsigned long)val < mmap_min_addr)
@@ -1921,8 +1935,8 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
* Make sure the pairs are ordered.
*/
#define __prctl_check_order(__m1, __op, __m2) \
- ((unsigned long)prctl_map->__m1 __op \
- (unsigned long)prctl_map->__m2) ? 0 : -EINVAL
+ ((unsigned long)prctl_map.__m1 __op \
+ (unsigned long)prctl_map.__m2) ? 0 : -EINVAL
error = __prctl_check_order(start_code, <, end_code);
error |= __prctl_check_order(start_data, <, end_data);
error |= __prctl_check_order(start_brk, <=, brk);
@@ -1937,23 +1951,24 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
/*
* @brk should be after @end_data in traditional maps.
*/
- if (prctl_map->start_brk <= prctl_map->end_data ||
- prctl_map->brk <= prctl_map->end_data)
+ if (prctl_map.start_brk <= prctl_map.end_data ||
+ prctl_map.brk <= prctl_map.end_data)
goto out;
/*
* Neither we should allow to override limits if they set.
*/
- if (check_data_rlimit(rlimit(RLIMIT_DATA), prctl_map->brk,
- prctl_map->start_brk, prctl_map->end_data,
- prctl_map->start_data))
+ if (check_data_rlimit(rlimit(RLIMIT_DATA), prctl_map.brk,
+ prctl_map.start_brk, prctl_map.end_data,
+ prctl_map.start_data))
goto out;
/*
* Someone is trying to cheat the auxv vector.
*/
- if (prctl_map->auxv_size) {
- if (!prctl_map->auxv || prctl_map->auxv_size > sizeof(mm->saved_auxv))
+ if (prctl_map.auxv_size) {
+ if (!prctl_map.auxv || prctl_map.auxv_size >
+ sizeof(mm->saved_auxv))
goto out;
}
@@ -1962,7 +1977,7 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
* change /proc/pid/exe link: only local sys admin should
* be allowed to.
*/
- if (prctl_map->exe_fd != (u32)-1) {
+ if (prctl_map.exe_fd != (u32)-1) {
if (!ns_capable(current_user_ns(), CAP_SYS_ADMIN))
goto out;
}
@@ -2120,13 +2135,14 @@ static int prctl_set_mm(int opt, unsigned long addr,
if (opt == PR_SET_MM_AUXV)
return prctl_set_auxv(mm, addr, arg4);
- if (addr >= TASK_SIZE || addr < mmap_min_addr)
+ if (untagged_addr(addr) >= TASK_SIZE ||
+ untagged_addr(addr) < mmap_min_addr)
return -EINVAL;
error = -EINVAL;
down_write(&mm->mmap_sem);
- vma = find_vma(mm, addr);
+ vma = find_vma(mm, untagged_addr(addr));
prctl_map.start_code = mm->start_code;
prctl_map.end_code = mm->end_code;
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* Re: [PATCH v13 10/20] kernel, arm64: untag user pointers in prctl_set_mm*
2019-03-20 14:51 ` [PATCH v13 10/20] kernel, arm64: untag user pointers in prctl_set_mm* Andrey Konovalov
@ 2019-03-21 17:52 ` Kevin Brodsky
0 siblings, 0 replies; 22+ messages in thread
From: Kevin Brodsky @ 2019-03-21 17:52 UTC (permalink / raw)
To: Andrey Konovalov, Catalin Marinas, Will Deacon, Mark Rutland,
Robin Murphy, Kees Cook, Kate Stewart, Greg Kroah-Hartman,
Andrew Morton, Ingo Molnar, Kirill A . Shutemov, Shuah Khan,
Vincenzo Frascino, Eric Dumazet, David S. Miller,
Alexei Starovoitov, Daniel Borkmann, Steven Rostedt, Ingo Molnar,
Peter Zijlstra, Arnaldo Carvalho de Melo, Alex Deucher,
Christian König, David (ChunMing) Zhou, Yishai Hadas,
Mauro Carvalho Chehab, Jens Wiklander, Alex Williamson,
linux-arm-kernel, linux-mm, linux-arch, netdev, bpf, amd-gfx,
dri-devel, linux-rdma, linux-media, kvm, linux-kselftest,
linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Szabolcs Nagy
On 20/03/2019 14:51, Andrey Konovalov wrote:
> This patch is a part of a series that extends arm64 kernel ABI to allow to
> pass tagged user pointers (with the top byte set to something else other
> than 0x00) as syscall arguments.
>
> prctl_set_mm() and prctl_set_mm_map() use provided user pointers for vma
> lookups and do some pointer comparisons to perform validation, which can
> only by done with untagged pointers.
>
> Untag user pointers in these functions for vma lookup and validity checks.
>
> Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
> ---
> kernel/sys.c | 44 ++++++++++++++++++++++++++++++--------------
> 1 file changed, 30 insertions(+), 14 deletions(-)
>
> diff --git a/kernel/sys.c b/kernel/sys.c
> index 12df0e5434b8..fe26ccf3c9e6 100644
> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -1885,11 +1885,12 @@ static int prctl_set_mm_exe_file(struct mm_struct *mm, unsigned int fd)
> * WARNING: we don't require any capability here so be very careful
> * in what is allowed for modification from userspace.
> */
> -static int validate_prctl_map(struct prctl_mm_map *prctl_map)
> +static int validate_prctl_map(struct prctl_mm_map *tagged_prctl_map)
> {
> unsigned long mmap_max_addr = TASK_SIZE;
> struct mm_struct *mm = current->mm;
> int error = -EINVAL, i;
> + struct prctl_mm_map prctl_map;
>
> static const unsigned char offsets[] = {
> offsetof(struct prctl_mm_map, start_code),
> @@ -1905,12 +1906,25 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
> offsetof(struct prctl_mm_map, env_end),
> };
>
> + memcpy(&prctl_map, tagged_prctl_map, sizeof(prctl_map));
> + prctl_map.start_code = untagged_addr(prctl_map.start_code);
> + prctl_map.end_code = untagged_addr(prctl_map.end_code);
> + prctl_map.start_data = untagged_addr(prctl_map.start_data);
> + prctl_map.end_data = untagged_addr(prctl_map.end_data);
> + prctl_map.start_brk = untagged_addr(prctl_map.start_brk);
> + prctl_map.brk = untagged_addr(prctl_map.brk);
> + prctl_map.start_stack = untagged_addr(prctl_map.start_stack);
> + prctl_map.arg_start = untagged_addr(prctl_map.arg_start);
> + prctl_map.arg_end = untagged_addr(prctl_map.arg_end);
> + prctl_map.env_start = untagged_addr(prctl_map.env_start);
> + prctl_map.env_end = untagged_addr(prctl_map.env_end);
> +
> /*
> * Make sure the members are not somewhere outside
> * of allowed address space.
> */
> for (i = 0; i < ARRAY_SIZE(offsets); i++) {
> - u64 val = *(u64 *)((char *)prctl_map + offsets[i]);
> + u64 val = *(u64 *)((char *)&prctl_map + offsets[i]);
>
> if ((unsigned long)val >= mmap_max_addr ||
> (unsigned long)val < mmap_min_addr)
> @@ -1921,8 +1935,8 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
> * Make sure the pairs are ordered.
> */
> #define __prctl_check_order(__m1, __op, __m2) \
> - ((unsigned long)prctl_map->__m1 __op \
> - (unsigned long)prctl_map->__m2) ? 0 : -EINVAL
> + ((unsigned long)prctl_map.__m1 __op \
> + (unsigned long)prctl_map.__m2) ? 0 : -EINVAL
> error = __prctl_check_order(start_code, <, end_code);
> error |= __prctl_check_order(start_data, <, end_data);
> error |= __prctl_check_order(start_brk, <=, brk);
> @@ -1937,23 +1951,24 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
> /*
> * @brk should be after @end_data in traditional maps.
> */
> - if (prctl_map->start_brk <= prctl_map->end_data ||
> - prctl_map->brk <= prctl_map->end_data)
> + if (prctl_map.start_brk <= prctl_map.end_data ||
> + prctl_map.brk <= prctl_map.end_data)
> goto out;
>
> /*
> * Neither we should allow to override limits if they set.
> */
> - if (check_data_rlimit(rlimit(RLIMIT_DATA), prctl_map->brk,
> - prctl_map->start_brk, prctl_map->end_data,
> - prctl_map->start_data))
> + if (check_data_rlimit(rlimit(RLIMIT_DATA), prctl_map.brk,
> + prctl_map.start_brk, prctl_map.end_data,
> + prctl_map.start_data))
> goto out;
>
> /*
> * Someone is trying to cheat the auxv vector.
> */
> - if (prctl_map->auxv_size) {
> - if (!prctl_map->auxv || prctl_map->auxv_size > sizeof(mm->saved_auxv))
> + if (prctl_map.auxv_size) {
> + if (!prctl_map.auxv || prctl_map.auxv_size >
> + sizeof(mm->saved_auxv))
> goto out;
> }
>
> @@ -1962,7 +1977,7 @@ static int validate_prctl_map(struct prctl_mm_map *prctl_map)
> * change /proc/pid/exe link: only local sys admin should
> * be allowed to.
> */
> - if (prctl_map->exe_fd != (u32)-1) {
> + if (prctl_map.exe_fd != (u32)-1) {
> if (!ns_capable(current_user_ns(), CAP_SYS_ADMIN))
> goto out;
> }
> @@ -2120,13 +2135,14 @@ static int prctl_set_mm(int opt, unsigned long addr,
> if (opt == PR_SET_MM_AUXV)
> return prctl_set_auxv(mm, addr, arg4);
>
> - if (addr >= TASK_SIZE || addr < mmap_min_addr)
> + if (untagged_addr(addr) >= TASK_SIZE ||
> + untagged_addr(addr) < mmap_min_addr)
> return -EINVAL;
>
> error = -EINVAL;
>
> down_write(&mm->mmap_sem);
> - vma = find_vma(mm, addr);
> + vma = find_vma(mm, untagged_addr(addr));
>
> prctl_map.start_code = mm->start_code;
> prctl_map.end_code = mm->end_code;
I think this new version is consistent w.r.t. tagged/untagged pointer usage. However,
I also note that a significant change has been introduced: it is now possible to set
MM fields to tagged addresses (tags are ignored by validate_prctl_map()). I am not
opposed to this as such, but have you considered the implications? Does it make sense
to have a tagged value for e.g. prctl_map.arg_start? Is the kernel able to handle
tagged values in those fields? I have the feeling that it's safer to discard tags for
now, and if necessary allow them to be preserved later on.
Kevin
^ permalink raw reply [flat|nested] 22+ messages in thread
* [PATCH v13 11/20] tracing, arm64: untag user pointers in seq_print_user_ip
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (9 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 10/20] kernel, arm64: untag user pointers in prctl_set_mm* Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 12/20] uprobes, arm64: untag user pointers in find_active_uprobe Andrey Konovalov
` (8 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
seq_print_user_ip() uses provided user pointers for vma lookups, which
can only by done with untagged pointers.
Untag user pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
kernel/trace/trace_output.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index 54373d93e251..6376bee93c84 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -370,6 +370,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
{
struct file *file = NULL;
unsigned long vmstart = 0;
+ unsigned long untagged_ip = untagged_addr(ip);
int ret = 1;
if (s->full)
@@ -379,7 +380,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
const struct vm_area_struct *vma;
down_read(&mm->mmap_sem);
- vma = find_vma(mm, ip);
+ vma = find_vma(mm, untagged_ip);
if (vma) {
file = vma->vm_file;
vmstart = vma->vm_start;
@@ -388,7 +389,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm,
ret = trace_seq_path(s, &file->f_path);
if (ret)
trace_seq_printf(s, "[+0x%lx]",
- ip - vmstart);
+ untagged_ip - vmstart);
}
up_read(&mm->mmap_sem);
}
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 12/20] uprobes, arm64: untag user pointers in find_active_uprobe
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (10 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 11/20] tracing, arm64: untag user pointers in seq_print_user_ip Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 13/20] bpf, arm64: untag user pointers in stack_map_get_build_id_offset Andrey Konovalov
` (7 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
find_active_uprobe() uses user pointers (obtained via
instruction_pointer(regs)) for vma lookups, which can only by done with
untagged pointers.
Untag user pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
kernel/events/uprobes.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index c5cde87329c7..d3a2716a813a 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -1992,6 +1992,8 @@ static struct uprobe *find_active_uprobe(unsigned long bp_vaddr, int *is_swbp)
struct uprobe *uprobe = NULL;
struct vm_area_struct *vma;
+ bp_vaddr = untagged_addr(bp_vaddr);
+
down_read(&mm->mmap_sem);
vma = find_vma(mm, bp_vaddr);
if (vma && vma->vm_start <= bp_vaddr) {
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 13/20] bpf, arm64: untag user pointers in stack_map_get_build_id_offset
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (11 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 12/20] uprobes, arm64: untag user pointers in find_active_uprobe Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 14/20] drm/amdgpu, arm64: untag user pointers in amdgpu_ttm_tt_get_user_pages Andrey Konovalov
` (6 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
stack_map_get_build_id_offset() uses provided user pointers for vma
lookups, which can only by done with untagged pointers.
Untag user pointers in this function for doing the lookup and
calculating the offset, but save as is in the bpf_stack_build_id
struct.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
kernel/bpf/stackmap.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 950ab2f28922..bb89341d3faf 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -320,7 +320,9 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
}
for (i = 0; i < trace_nr; i++) {
- vma = find_vma(current->mm, ips[i]);
+ u64 untagged_ip = untagged_addr(ips[i]);
+
+ vma = find_vma(current->mm, untagged_ip);
if (!vma || stack_map_get_build_id(vma, id_offs[i].build_id)) {
/* per entry fall back to ips */
id_offs[i].status = BPF_STACK_BUILD_ID_IP;
@@ -328,7 +330,7 @@ static void stack_map_get_build_id_offset(struct bpf_stack_build_id *id_offs,
memset(id_offs[i].build_id, 0, BPF_BUILD_ID_SIZE);
continue;
}
- id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + ips[i]
+ id_offs[i].offset = (vma->vm_pgoff << PAGE_SHIFT) + untagged_ip
- vma->vm_start;
id_offs[i].status = BPF_STACK_BUILD_ID_VALID;
}
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 14/20] drm/amdgpu, arm64: untag user pointers in amdgpu_ttm_tt_get_user_pages
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (12 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 13/20] bpf, arm64: untag user pointers in stack_map_get_build_id_offset Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 15/20] drm/radeon, arm64: untag user pointers in radeon_ttm_tt_pin_userptr Andrey Konovalov
` (5 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
amdgpu_ttm_tt_get_user_pages() uses provided user pointers for vma
lookups, which can only by done with untagged pointers.
Untag user pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
index 73e71e61dc99..891b027fa33b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
@@ -751,10 +751,11 @@ int amdgpu_ttm_tt_get_user_pages(struct ttm_tt *ttm, struct page **pages)
* check that we only use anonymous memory to prevent problems
* with writeback
*/
- unsigned long end = gtt->userptr + ttm->num_pages * PAGE_SIZE;
+ unsigned long userptr = untagged_addr(gtt->userptr);
+ unsigned long end = userptr + ttm->num_pages * PAGE_SIZE;
struct vm_area_struct *vma;
- vma = find_vma(mm, gtt->userptr);
+ vma = find_vma(mm, userptr);
if (!vma || vma->vm_file || vma->vm_end < end) {
up_read(&mm->mmap_sem);
return -EPERM;
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 15/20] drm/radeon, arm64: untag user pointers in radeon_ttm_tt_pin_userptr
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (13 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 14/20] drm/amdgpu, arm64: untag user pointers in amdgpu_ttm_tt_get_user_pages Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 16/20] IB/mlx4, arm64: untag user pointers in mlx4_get_umem_mr Andrey Konovalov
` (4 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
radeon_ttm_tt_pin_userptr() uses provided user pointers for vma
lookups, which can only by done with untagged pointers.
Untag user pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
drivers/gpu/drm/radeon/radeon_ttm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 9920a6fc11bf..872a98796117 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -497,9 +497,10 @@ static int radeon_ttm_tt_pin_userptr(struct ttm_tt *ttm)
if (gtt->userflags & RADEON_GEM_USERPTR_ANONONLY) {
/* check that we only pin down anonymous memory
to prevent problems with writeback */
- unsigned long end = gtt->userptr + ttm->num_pages * PAGE_SIZE;
+ unsigned long userptr = untagged_addr(gtt->userptr);
+ unsigned long end = userptr + ttm->num_pages * PAGE_SIZE;
struct vm_area_struct *vma;
- vma = find_vma(gtt->usermm, gtt->userptr);
+ vma = find_vma(gtt->usermm, userptr);
if (!vma || vma->vm_file || vma->vm_end < end)
return -EPERM;
}
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 16/20] IB/mlx4, arm64: untag user pointers in mlx4_get_umem_mr
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (14 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 15/20] drm/radeon, arm64: untag user pointers in radeon_ttm_tt_pin_userptr Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 17/20] media/v4l2-core, arm64: untag user pointers in videobuf_dma_contig_user_get Andrey Konovalov
` (3 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
mlx4_get_umem_mr() uses provided user pointers for vma lookups, which can
only by done with untagged pointers.
Untag user pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
drivers/infiniband/hw/mlx4/mr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 395379a480cb..9a35ed2c6a6f 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -378,6 +378,7 @@ static struct ib_umem *mlx4_get_umem_mr(struct ib_udata *udata, u64 start,
* again
*/
if (!ib_access_writable(access_flags)) {
+ unsigned long untagged_start = untagged_addr(start);
struct vm_area_struct *vma;
down_read(¤t->mm->mmap_sem);
@@ -386,9 +387,9 @@ static struct ib_umem *mlx4_get_umem_mr(struct ib_udata *udata, u64 start,
* cover the memory, but for now it requires a single vma to
* entirely cover the MR to support RO mappings.
*/
- vma = find_vma(current->mm, start);
- if (vma && vma->vm_end >= start + length &&
- vma->vm_start <= start) {
+ vma = find_vma(current->mm, untagged_start);
+ if (vma && vma->vm_end >= untagged_start + length &&
+ vma->vm_start <= untagged_start) {
if (vma->vm_flags & VM_WRITE)
access_flags |= IB_ACCESS_LOCAL_WRITE;
} else {
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 17/20] media/v4l2-core, arm64: untag user pointers in videobuf_dma_contig_user_get
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (15 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 16/20] IB/mlx4, arm64: untag user pointers in mlx4_get_umem_mr Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 18/20] tee/optee, arm64: untag user pointers in check_mem_type Andrey Konovalov
` (2 subsequent siblings)
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
videobuf_dma_contig_user_get() uses provided user pointers for vma
lookups, which can only by done with untagged pointers.
Untag the pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
drivers/media/v4l2-core/videobuf-dma-contig.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/media/v4l2-core/videobuf-dma-contig.c b/drivers/media/v4l2-core/videobuf-dma-contig.c
index e1bf50df4c70..8a1ddd146b17 100644
--- a/drivers/media/v4l2-core/videobuf-dma-contig.c
+++ b/drivers/media/v4l2-core/videobuf-dma-contig.c
@@ -160,6 +160,7 @@ static void videobuf_dma_contig_user_put(struct videobuf_dma_contig_memory *mem)
static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
struct videobuf_buffer *vb)
{
+ unsigned long untagged_baddr = untagged_addr(vb->baddr);
struct mm_struct *mm = current->mm;
struct vm_area_struct *vma;
unsigned long prev_pfn, this_pfn;
@@ -167,22 +168,22 @@ static int videobuf_dma_contig_user_get(struct videobuf_dma_contig_memory *mem,
unsigned int offset;
int ret;
- offset = vb->baddr & ~PAGE_MASK;
+ offset = untagged_baddr & ~PAGE_MASK;
mem->size = PAGE_ALIGN(vb->size + offset);
ret = -EINVAL;
down_read(&mm->mmap_sem);
- vma = find_vma(mm, vb->baddr);
+ vma = find_vma(mm, untagged_baddr);
if (!vma)
goto out_up;
- if ((vb->baddr + mem->size) > vma->vm_end)
+ if ((untagged_baddr + mem->size) > vma->vm_end)
goto out_up;
pages_done = 0;
prev_pfn = 0; /* kill warning */
- user_address = vb->baddr;
+ user_address = untagged_baddr;
while (pages_done < (mem->size >> PAGE_SHIFT)) {
ret = follow_pfn(vma, user_address, &this_pfn);
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 18/20] tee/optee, arm64: untag user pointers in check_mem_type
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (16 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 17/20] media/v4l2-core, arm64: untag user pointers in videobuf_dma_contig_user_get Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 19/20] vfio/type1, arm64: untag user pointers in vaddr_get_pfn Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 20/20] selftests, arm64: add a selftest for passing tagged pointers to kernel Andrey Konovalov
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
check_mem_type() uses provided user pointers for vma lookups (via
__check_mem_type()), which can only by done with untagged pointers.
Untag user pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
drivers/tee/optee/call.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/tee/optee/call.c b/drivers/tee/optee/call.c
index a5afbe6dee68..e3be20264092 100644
--- a/drivers/tee/optee/call.c
+++ b/drivers/tee/optee/call.c
@@ -563,6 +563,7 @@ static int check_mem_type(unsigned long start, size_t num_pages)
int rc;
down_read(&mm->mmap_sem);
+ start = untagged_addr(start);
rc = __check_mem_type(find_vma(mm, start),
start + num_pages * PAGE_SIZE);
up_read(&mm->mmap_sem);
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 19/20] vfio/type1, arm64: untag user pointers in vaddr_get_pfn
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (17 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 18/20] tee/optee, arm64: untag user pointers in check_mem_type Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
2019-03-20 14:51 ` [PATCH v13 20/20] selftests, arm64: add a selftest for passing tagged pointers to kernel Andrey Konovalov
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
vaddr_get_pfn() uses provided user pointers for vma lookups, which can
only by done with untagged pointers.
Untag user pointers in this function.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
drivers/vfio/vfio_iommu_type1.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 73652e21efec..e556caa64f83 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -376,6 +376,8 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr,
down_read(&mm->mmap_sem);
+ vaddr = untagged_addr(vaddr);
+
vma = find_vma_intersection(mm, vaddr, vaddr + 1);
if (vma && vma->vm_flags & VM_PFNMAP) {
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread
* [PATCH v13 20/20] selftests, arm64: add a selftest for passing tagged pointers to kernel
2019-03-20 14:51 [PATCH v13 00/20] arm64: untag user pointers passed to the kernel Andrey Konovalov
` (18 preceding siblings ...)
2019-03-20 14:51 ` [PATCH v13 19/20] vfio/type1, arm64: untag user pointers in vaddr_get_pfn Andrey Konovalov
@ 2019-03-20 14:51 ` Andrey Konovalov
19 siblings, 0 replies; 22+ messages in thread
From: Andrey Konovalov @ 2019-03-20 14:51 UTC (permalink / raw)
To: Catalin Marinas, Will Deacon, Mark Rutland, Robin Murphy,
Kees Cook, Kate Stewart, Greg Kroah-Hartman, Andrew Morton,
Ingo Molnar, Kirill A . Shutemov, Shuah Khan, Vincenzo Frascino,
Eric Dumazet, David S. Miller, Alexei Starovoitov,
Daniel Borkmann, Steven Rostedt, Ingo Molnar, Peter Zijlstra,
Arnaldo Carvalho de Melo, Alex Deucher, Christian König,
David (ChunMing) Zhou, Yishai Hadas, Mauro Carvalho Chehab,
Jens Wiklander, Alex Williamson, linux-arm-kernel, linux-mm,
linux-arch, netdev, bpf, amd-gfx, dri-devel, linux-rdma,
linux-media, kvm, linux-kselftest, linux-kernel
Cc: Dmitry Vyukov, Kostya Serebryany, Evgeniy Stepanov, Lee Smith,
Ramana Radhakrishnan, Jacob Bramley, Ruben Ayrapetyan,
Chintan Pandya, Luc Van Oostenryck, Dave Martin, Kevin Brodsky,
Szabolcs Nagy, Andrey Konovalov
This patch is a part of a series that extends arm64 kernel ABI to allow to
pass tagged user pointers (with the top byte set to something else other
than 0x00) as syscall arguments.
This patch adds a simple test, that calls the uname syscall with a
tagged user pointer as an argument. Without the kernel accepting tagged
user pointers the test fails with EFAULT.
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
---
tools/testing/selftests/arm64/.gitignore | 1 +
tools/testing/selftests/arm64/Makefile | 11 ++++++++++
.../testing/selftests/arm64/run_tags_test.sh | 12 +++++++++++
tools/testing/selftests/arm64/tags_test.c | 21 +++++++++++++++++++
4 files changed, 45 insertions(+)
create mode 100644 tools/testing/selftests/arm64/.gitignore
create mode 100644 tools/testing/selftests/arm64/Makefile
create mode 100755 tools/testing/selftests/arm64/run_tags_test.sh
create mode 100644 tools/testing/selftests/arm64/tags_test.c
diff --git a/tools/testing/selftests/arm64/.gitignore b/tools/testing/selftests/arm64/.gitignore
new file mode 100644
index 000000000000..e8fae8d61ed6
--- /dev/null
+++ b/tools/testing/selftests/arm64/.gitignore
@@ -0,0 +1 @@
+tags_test
diff --git a/tools/testing/selftests/arm64/Makefile b/tools/testing/selftests/arm64/Makefile
new file mode 100644
index 000000000000..a61b2e743e99
--- /dev/null
+++ b/tools/testing/selftests/arm64/Makefile
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-2.0
+
+# ARCH can be overridden by the user for cross compiling
+ARCH ?= $(shell uname -m 2>/dev/null || echo not)
+
+ifneq (,$(filter $(ARCH),aarch64 arm64))
+TEST_GEN_PROGS := tags_test
+TEST_PROGS := run_tags_test.sh
+endif
+
+include ../lib.mk
diff --git a/tools/testing/selftests/arm64/run_tags_test.sh b/tools/testing/selftests/arm64/run_tags_test.sh
new file mode 100755
index 000000000000..745f11379930
--- /dev/null
+++ b/tools/testing/selftests/arm64/run_tags_test.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+# SPDX-License-Identifier: GPL-2.0
+
+echo "--------------------"
+echo "running tags test"
+echo "--------------------"
+./tags_test
+if [ $? -ne 0 ]; then
+ echo "[FAIL]"
+else
+ echo "[PASS]"
+fi
diff --git a/tools/testing/selftests/arm64/tags_test.c b/tools/testing/selftests/arm64/tags_test.c
new file mode 100644
index 000000000000..2bd1830a7ebe
--- /dev/null
+++ b/tools/testing/selftests/arm64/tags_test.c
@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <stdint.h>
+#include <sys/utsname.h>
+
+#define SHIFT_TAG(tag) ((uint64_t)(tag) << 56)
+#define SET_TAG(ptr, tag) (((uint64_t)(ptr) & ~SHIFT_TAG(0xff)) | \
+ SHIFT_TAG(tag))
+
+int main(void)
+{
+ struct utsname *ptr = (struct utsname *)malloc(sizeof(*ptr));
+ void *tagged_ptr = (void *)SET_TAG(ptr, 0x42);
+ int err = uname(tagged_ptr);
+
+ free(ptr);
+ return err;
+}
--
2.21.0.225.g810b269d1ac-goog
^ permalink raw reply related [flat|nested] 22+ messages in thread