From patchwork Mon Nov 19 17:26:29 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrey Konovalov X-Patchwork-Id: 10689039 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id AEBD714DB for ; Mon, 19 Nov 2018 17:27:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 920452A2C0 for ; Mon, 19 Nov 2018 17:27:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 862DE2A2CD; Mon, 19 Nov 2018 17:27:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.5 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE, USER_IN_DEF_DKIM_WL autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E2C962A2C0 for ; Mon, 19 Nov 2018 17:27:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5ECBA6B1B8D; Mon, 19 Nov 2018 12:27:18 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 5C41D6B1B8E; Mon, 19 Nov 2018 12:27:18 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 462E06B1B8F; Mon, 19 Nov 2018 12:27:18 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by kanga.kvack.org (Postfix) with ESMTP id E11E86B1B8D for ; Mon, 19 Nov 2018 12:27:17 -0500 (EST) Received: by mail-wr1-f69.google.com with SMTP id w4so5598385wrt.21 for ; Mon, 19 Nov 2018 09:27:17 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:dkim-signature:from:to:cc:subject:date :message-id:in-reply-to:references:mime-version :content-transfer-encoding; bh=4UxJd/TD5dhnni0EdJsiBbVNK+EVuSfLspufPfY8Op0=; b=nBn+0W+N2hI31XDt6wxYjaL2YecN9FahGgqsoqQqCC234AiAd/7FpyJ+PtyQ4GpmVC 45602JS0J5f4BRPvZKyyLFOEELz5NYX2q86Zhn8o7aJRfBuU6UY9bdVn/Ipmf1BFVfve coRsmeB0uq2I8YemOhu7xKI6+AH0vjbLKYVxJ6Oz6COXf94yOqSfIyGmG09+76ZGL9/O 9sfDA/HapoYx+j9t3ZN8LhkVp6CgNqHNS4svB6Mopkct3pkY/B8ESYthjxKepZUBC7cu qypLYLtME+6nTk1zCwCgeffHplgC3HTQ7ZSZUZvBsoXz3I4ffKt28B6JSXovyTi5B8tD FUJg== X-Gm-Message-State: AGRZ1gJljtsUz+YGEmI1qUhu+L/QHIIXcO22temhDrxXXf89OUUqog5B lwy6QASwmd8xnVP5bLXbPBLaZcdx79e7yqmCh1dkZZ38d+r09Yu6FxTxjb2Vie9BMC2GE8t6yo+ 2dg6ZOm7BF+ueRUAdHkM9E5EDVnSovG51zrUuOHTSFC9FaUz+oGQMsJAfnK5DmtIC2QJxqdmkvw b0L71GDnCmbEbp0fFto6HSzj3lVXneZMMwjXXv1g1PVJQKof+CecoGmlStqDzz2meNYqdkgMUd0 eqc05mPi2dwStU/Xb/zXPZ6zf6UK3IJEKWypw0qh+AcaLGGO8Y/74J1qEVBoboqjP+VTLL10Av+ ymGaNmzOcfoO8W6/WpszPTEWi59QItm8EYGz3TJQpgQhBEuue/9iph43ou92ROyRxoIDDVs5rc7 q X-Received: by 2002:a5d:4406:: with SMTP id z6-v6mr18982604wrq.294.1542648437424; Mon, 19 Nov 2018 09:27:17 -0800 (PST) X-Received: by 2002:a5d:4406:: with SMTP id z6-v6mr18982556wrq.294.1542648436521; Mon, 19 Nov 2018 09:27:16 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1542648436; cv=none; d=google.com; s=arc-20160816; b=Y2wz/yVVdd+j3nEvCUzSXZ63pI5bVtXunqaSSEhNb5JroWPZMYzeYzz9hiaKhg+vKx Z9BHzlETZUcGzminTj39a3/OgVGU4j/r/QR2gBNag+uSwYI/5QJEUm+xnyhrfI8AxOsr uarIWY/5iZxf4zv86kk535xMFfv/c6IdO0c1eIViImoqlYzd/ApDSP2APq9+3+sR5pix dWOupzJSWoIZcAh1Fz9gc8uMs2keHU3lijt3B8i7mF5Q4Zk7RsHH9t+JtK6lbzoMh9nf EDZ9u1IemWQ0sXsSjdnrxxP/KLV1Ry2DyCWWiULOSy/Ur2HotOc7BKayJEy+8ZDuleoT 03WA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=4UxJd/TD5dhnni0EdJsiBbVNK+EVuSfLspufPfY8Op0=; b=DR2vChRtuQoz9fXIrejUAwnefZvxjqgWp+9p5XvqVKfFHusv1RY9tFqYdrEqbD66rN Z8yT5HVr1EF+FBAkslgnP81zgpPfJrh6x2oO0WxVmOnm/4gRV6+pW6e6TAz4H88bmrvm oMbe+SLfmFxCz84ZmMQ3yck+PRyYruwv+QuTCD7msTGVoEYz7Z5/RqNBYJBxw36oYKok 1+OTDvSb0VOnLsgBS+ctkJFZmAqEBPrODU4jJgwNIlxNeuaAuqRJqnzmWrzJXtSO7yVb GzIploN4ZRYeVPPalfM1CksOR6ucEnby+4ZwnFaQJCdBDqag+5gH4lQ98mnyy/pFs56a qFrg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=ezP0ESTG; spf=pass (google.com: domain of andreyknvl@google.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=andreyknvl@google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id i74sor7048772wmd.20.2018.11.19.09.27.16 for (Google Transport Security); Mon, 19 Nov 2018 09:27:16 -0800 (PST) Received-SPF: pass (google.com: domain of andreyknvl@google.com designates 209.85.220.65 as permitted sender) client-ip=209.85.220.65; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20161025 header.b=ezP0ESTG; spf=pass (google.com: domain of andreyknvl@google.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=andreyknvl@google.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=4UxJd/TD5dhnni0EdJsiBbVNK+EVuSfLspufPfY8Op0=; b=ezP0ESTGIDPD6PIZXaeQ1HQvAtE12YKEKXk2IQhb30r0JyeclvTIkALJudtga1L/Q3 sfSqapZGnhPLM3BAb3PXOYLm/bZTb1MZ54ZRnv6h5/3IlejoIUHx/AaGd5qfhPuKxnpn GsnYAXIpMb9ohJGYhY0zD2xvR+T/Aku8msHLcEukSHopb9SGDZXGijaVWkpc9CKGUaiu VLTlA6dJNpc7t3wdP5GQdvZ/cbM0ca5EE+ZdL+ZEBNJjVa09dOGeUYw8b0oESjRUAScJ k2aoTr6qOxO96slc3aQpZ9kDtYvc9TSHsfhmZQgS17UlDgmj7Ll18teQgR09yy1V1Gpr QcAg== X-Google-Smtp-Source: AJdET5f/CWAArcyhbvqSSe7+ZirG+qS0xHVggXGTUB5W8Aw5Wyx6utJIbL2GhHlD46DxV8W80eGl3Q== X-Received: by 2002:a1c:f514:: with SMTP id t20-v6mr7673551wmh.129.1542648436015; Mon, 19 Nov 2018 09:27:16 -0800 (PST) Received: from andreyknvl0.muc.corp.google.com ([2a00:79e0:15:10:3180:41f8:3010:ff61]) by smtp.gmail.com with ESMTPSA id l143-v6sm23685190wmb.23.2018.11.19.09.27.14 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 19 Nov 2018 09:27:15 -0800 (PST) From: Andrey Konovalov To: Andrey Ryabinin , Alexander Potapenko , Dmitry Vyukov , Catalin Marinas , Will Deacon , Christoph Lameter , Andrew Morton , Mark Rutland , Nick Desaulniers , Marc Zyngier , Dave Martin , Ard Biesheuvel , "Eric W . Biederman" , Ingo Molnar , Paul Lawrence , Geert Uytterhoeven , Arnd Bergmann , "Kirill A . Shutemov" , Greg Kroah-Hartman , Kate Stewart , Mike Rapoport , kasan-dev@googlegroups.com, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-sparse@vger.kernel.org, linux-mm@kvack.org, linux-kbuild@vger.kernel.org Cc: Kostya Serebryany , Evgeniy Stepanov , Lee Smith , Ramana Radhakrishnan , Jacob Bramley , Ruben Ayrapetyan , Jann Horn , Mark Brand , Chintan Pandya , Vishwath Mohan , Andrey Konovalov Subject: [PATCH v11 13/24] kasan, arm64: fix up fault handling logic Date: Mon, 19 Nov 2018 18:26:29 +0100 Message-Id: <99c747edfba8ea4b93d9c70aac47ea86ef258b86.1542648335.git.andreyknvl@google.com> X-Mailer: git-send-email 2.19.1.1215.g8438c0b245-goog In-Reply-To: References: MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Right now arm64 fault handling code removes pointer tags from addresses covered by TTBR0 in faults taken from both EL0 and EL1, but doesn't do that for pointers covered by TTBR1. This patch adds two helper functions is_ttbr0_addr() and is_ttbr1_addr(), where the latter one accounts for the fact that TTBR1 pointers might be tagged when tag-based KASAN is in use, and uses these helper functions to perform pointer checks in arch/arm64/mm/fault.c. Suggested-by: Mark Rutland Signed-off-by: Andrey Konovalov --- arch/arm64/mm/fault.c | 31 ++++++++++++++++++++++--------- 1 file changed, 22 insertions(+), 9 deletions(-) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 7d9571f4ae3d..6023d4752701 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -40,6 +40,7 @@ #include #include #include +#include #include #include #include @@ -132,6 +133,18 @@ static void mem_abort_decode(unsigned int esr) data_abort_decode(esr); } +static inline bool is_ttbr0_addr(unsigned long addr) +{ + /* entry assembly clears tags for TTBR0 addrs */ + return addr < TASK_SIZE; +} + +static inline bool is_ttbr1_addr(unsigned long addr) +{ + /* TTBR1 addresses may have a tag if KASAN_SW_TAGS is in use */ + return arch_kasan_reset_tag(addr) >= VA_START; +} + /* * Dump out the page tables associated with 'addr' in the currently active mm. */ @@ -141,7 +154,7 @@ void show_pte(unsigned long addr) pgd_t *pgdp; pgd_t pgd; - if (addr < TASK_SIZE) { + if (is_ttbr0_addr(addr)) { /* TTBR0 */ mm = current->active_mm; if (mm == &init_mm) { @@ -149,7 +162,7 @@ void show_pte(unsigned long addr) addr); return; } - } else if (addr >= VA_START) { + } else if (is_ttbr1_addr(addr)) { /* TTBR1 */ mm = &init_mm; } else { @@ -254,7 +267,7 @@ static inline bool is_el1_permission_fault(unsigned long addr, unsigned int esr, if (fsc_type == ESR_ELx_FSC_PERM) return true; - if (addr < TASK_SIZE && system_uses_ttbr0_pan()) + if (is_ttbr0_addr(addr) && system_uses_ttbr0_pan()) return fsc_type == ESR_ELx_FSC_FAULT && (regs->pstate & PSR_PAN_BIT); @@ -319,7 +332,7 @@ static void set_thread_esr(unsigned long address, unsigned int esr) * type", so we ignore this wrinkle and just return the translation * fault.) */ - if (current->thread.fault_address >= TASK_SIZE) { + if (!is_ttbr0_addr(current->thread.fault_address)) { switch (ESR_ELx_EC(esr)) { case ESR_ELx_EC_DABT_LOW: /* @@ -455,7 +468,7 @@ static int __kprobes do_page_fault(unsigned long addr, unsigned int esr, mm_flags |= FAULT_FLAG_WRITE; } - if (addr < TASK_SIZE && is_el1_permission_fault(addr, esr, regs)) { + if (is_ttbr0_addr(addr) && is_el1_permission_fault(addr, esr, regs)) { /* regs->orig_addr_limit may be 0 if we entered from EL0 */ if (regs->orig_addr_limit == KERNEL_DS) die_kernel_fault("access to user memory with fs=KERNEL_DS", @@ -603,7 +616,7 @@ static int __kprobes do_translation_fault(unsigned long addr, unsigned int esr, struct pt_regs *regs) { - if (addr < TASK_SIZE) + if (is_ttbr0_addr(addr)) return do_page_fault(addr, esr, regs); do_bad_area(addr, esr, regs); @@ -758,7 +771,7 @@ asmlinkage void __exception do_el0_ia_bp_hardening(unsigned long addr, * re-enabled IRQs. If the address is a kernel address, apply * BP hardening prior to enabling IRQs and pre-emption. */ - if (addr > TASK_SIZE) + if (!is_ttbr0_addr(addr)) arm64_apply_bp_hardening(); local_daif_restore(DAIF_PROCCTX); @@ -771,7 +784,7 @@ asmlinkage void __exception do_sp_pc_abort(unsigned long addr, struct pt_regs *regs) { if (user_mode(regs)) { - if (instruction_pointer(regs) > TASK_SIZE) + if (!is_ttbr0_addr(instruction_pointer(regs))) arm64_apply_bp_hardening(); local_daif_restore(DAIF_PROCCTX); } @@ -825,7 +838,7 @@ asmlinkage int __exception do_debug_exception(unsigned long addr, if (interrupts_enabled(regs)) trace_hardirqs_off(); - if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE) + if (user_mode(regs) && !is_ttbr0_addr(instruction_pointer(regs))) arm64_apply_bp_hardening(); if (!inf->fn(addr, esr, regs)) {