From: Celeste Liu <coelacanthus@outlook.com>
To: Palmer Dabbelt <palmer@rivosinc.com>,
Paul Walmsley <paul.walmsley@sifive.com>,
Albert Ou <aou@eecs.berkeley.edu>, Guo Ren <guoren@kernel.org>,
linux-riscv@lists.infradead.org
Cc: Celeste Liu <coelacanthus@outlook.com>,
Xiongchuan Tan <xc-tan@outlook.com>,
Wang Ruikang <dramforever@live.com>,
Ruizhe Pan <c141028@gmail.com>,
linux-kernel@vger.kernel.org, Yash Shah <yash.shah@sifive.com>
Subject: [PATCH v3 RESEND] riscv: don't allow write but not read page mapping
Date: Wed, 22 Jun 2022 01:39:37 +0800 [thread overview]
Message-ID: <PH7PR14MB5594762EF0A4B69A1C31D1B0CEB39@PH7PR14MB5594.namprd14.prod.outlook.com> (raw)
When Xiongchuan Tan tries to run one of libaio's tests[1], it encounters a strange
behavior: for the same PROT_WRITE only mapping, there was a discrepancy
in whether it could be read before and after writing (readable before
writing, unreadable after writing). After some investigation,
I found that mmap allows write only mapping, an undefined behavior, on RISC-V.
As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
"20211203 Privileged Architecture v1.12, Ratified"[2], the PTE permission
bit combination of "write+!read" is "Reserved for future use.". Hence, don't
allow such mapping request in mmap call. In the current code[3], write+exec
only is marked as invalid, but write only is not marked as invalid.
This patch refines that judgment.
[1]: https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t
[2]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf
[3]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1
(https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1)
Reported-by: Xiongchuan Tan <xc-tan@outlook.com>
Co-developed-by: Wang Ruikang <dramforever@live.com>
Signed-off-by: Wang Ruikang <dramforever@live.com>
Co-developed-by: Ruizhe Pan <c141028@gmail.com>
Signed-off-by: Ruizhe Pan <c141028@gmail.com>
Signed-off-by: Celeste Liu <coelacanthus@outlook.com>
Reviewed-by: Guo Ren <guoren@kernel.org>
Cc: linux-riscv@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Cc: Guo Ren <guoren@kernel.org>
Cc: Yash Shah <yash.shah@sifive.com>
---
arch/riscv/kernel/sys_riscv.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
index 9c0194f176fc..e55281b497cf 100644
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -18,9 +18,14 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
return -EINVAL;
- if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
- if (unlikely(!(prot & PROT_READ)))
- return -EINVAL;
+ /*
+ * As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
+ * "20211203 Privileged Architecture v1.12, Ratified", the PTE permission
+ * bit combination of "write+!read" is "Reserved for future use.". Hence, don't
+ * allow such mapping request in mmap call.
+ */
+ if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
+ return -EINVAL;
return ksys_mmap_pgoff(addr, len, prot, flags, fd,
offset >> (PAGE_SHIFT - page_shift_offset));
--
2.36.1
reply other threads:[~2022-06-21 17:40 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=PH7PR14MB5594762EF0A4B69A1C31D1B0CEB39@PH7PR14MB5594.namprd14.prod.outlook.com \
--to=coelacanthus@outlook.com \
--cc=aou@eecs.berkeley.edu \
--cc=c141028@gmail.com \
--cc=dramforever@live.com \
--cc=guoren@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=palmer@rivosinc.com \
--cc=paul.walmsley@sifive.com \
--cc=xc-tan@outlook.com \
--cc=yash.shah@sifive.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).