From patchwork Wed Jun 30 23:29:31 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Collingbourne X-Patchwork-Id: 12352947 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.2 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_ADSP_CUSTOM_MED,DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7945CC11F66 for ; Wed, 30 Jun 2021 23:31:27 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 384C9613FD for ; Wed, 30 Jun 2021 23:31:27 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 384C9613FD Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Mime-Version: Message-Id:Date:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=ztjr1XoH2ubc0QlghKxgADB4Jd9bWz+aAa4+bXr4vJI=; b=U9Q yRvK+BTfOupeb1KEP8WiqjWEyBgN+nfPDqCIKZfHgnMGDpnHw6u9AVyzPbqXdP4wJwNxsjleWYJ5m 2qNEgdx+XObPYx+lZ6k+/KJOomDyY3V/dacFA8TJOde5nnr+6rRQyzrqJ+C+QlW/HNYkiRSZfK/Xj W3H1SC3uZgAmA8YAtxtLISUdZCzPU33GBeu6RPjulLr+IdWhZuJaeu7s1QVb5x7XF6fdj962frT8c RDgEezNYoUBGF4MILrMQukRB5KNDIhe4SDvUmqtpdQ8BDe2D76AfsPkGDywrm/Pnfru7Dh8p0Y+RT 2OhgDWxhlnIYzDuvko3OMMl47Y8PSPA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1lyjeJ-00FYUM-BI; Wed, 30 Jun 2021 23:29:43 +0000 Received: from mail-yb1-xb49.google.com ([2607:f8b0:4864:20::b49]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1lyjeE-00FYSq-Iu for linux-arm-kernel@lists.infradead.org; Wed, 30 Jun 2021 23:29:40 +0000 Received: by mail-yb1-xb49.google.com with SMTP id h7-20020a5b0a870000b029054c59edf217so6076843ybq.3 for ; Wed, 30 Jun 2021 16:29:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:message-id:mime-version:subject:from:to:cc; bh=m3QHt0YaV5fjryby/2MOs6T0BSYeS4ijMoP6EpEmiUY=; b=rPLyKmZBxtqRERXPdQXxzJZE9F+DY5fNjbfpqhuPCRcD7bQHjOEWdTDJGRQb+Daj61 aeZ/Jzv29QBiexXGsU5JV7G/rDglragkiYJzQpfDj2C/bcxb9IL8KZuYeGFi5ZC1fc4q p+9Bu72qvvMTvZ/WDr4iB2G0zd6nfEBpqP+XHnftZ7diT+1BJzQTZ5J+gLkuHFW49YY6 mdzqdXCaxT/eWuomw+edYO5YuKTUYYGCO7njfde/lIXjZ7m5AFGMvtJhLTn4qiDcsveW y/ozXY6Ml9n4DomDarHY8zeZnszOXihGmJC8hRVD7mm8CpPdfot9r49srQZ+JqSLfgHW ajQQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:message-id:mime-version:subject:from:to:cc; bh=m3QHt0YaV5fjryby/2MOs6T0BSYeS4ijMoP6EpEmiUY=; b=uiInjKsvNFVc9j3/hB+rUzDHKlgRTOeUPL/wd+p8O7Eyr9sJKH7J7SZ4YF7G+0+ifs 07tZ0unoZn/3oISO16S0c9CeUnlsDoZnponryIDEQrhgMj6zFXcSB5mSfrYGQH8enHEO iHt0JirpmR8Nwcs42u1VG+9XHsmS2xpf0Deo0RNEIcGIfZOxoGL+qbvuF4KaIwZSO7Im 4TU5VqPcHVtRqRiZyR5XqvH9dHKG3hcE8RqalX+zvLJNLqnJlAZzYufKoHETzK4zQzD8 CqiA+rIQ4dnGnlCAGcE1Asgg63xh6V8nXx+qulzpCce0AP004Qi2JlWqGQLNNzqeJ0TS KNdQ== X-Gm-Message-State: AOAM533NA0NtnODVmnBBRZ0QMQ3QhBF41gVQqP0X3aSyed1QOD9gQlzs AeAp3/V/b1SJsNeg2MMH1QO79nk= X-Google-Smtp-Source: ABdhPJylF+lGMZYBAXJptYRcMY9ADykrpjY8DwWNPnXoR7zBD/Kv81XSUa5vAPUhbyb8YZKflZcS4Ws= X-Received: from pcc-desktop.svl.corp.google.com ([2620:15c:2ce:200:8b00:104d:c249:d343]) (user=pcc job=sendgmr) by 2002:a25:6c54:: with SMTP id h81mr51586027ybc.184.1625095776874; Wed, 30 Jun 2021 16:29:36 -0700 (PDT) Date: Wed, 30 Jun 2021 16:29:31 -0700 Message-Id: <20210630232931.3779403-1-pcc@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.32.0.93.g670b81a890-goog Subject: [PATCH v2] userfaultfd: preserve user-supplied address tag in struct uffd_msg From: Peter Collingbourne To: Catalin Marinas , Vincenzo Frascino , Dave Martin , Will Deacon , Andrew Morton , Andrea Arcangeli Cc: Peter Collingbourne , Alistair Delva , Lokesh Gidra , William McVicker , Evgenii Stepanov , Mitch Phillips , Linux ARM , linux-mm@kvack.org, stable@vger.kernel.org X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210630_162938_692440_81B1EDCE X-CRM114-Status: GOOD ( 23.08 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org If a user program uses userfaultfd on ranges of heap memory, it may end up passing a tagged pointer to the kernel in the range.start field of the UFFDIO_REGISTER ioctl. This can happen when using an MTE-capable allocator, or on Android if using the Tagged Pointers feature for MTE readiness [1]. When a fault subsequently occurs, the tag is stripped from the fault address returned to the application in the fault.address field of struct uffd_msg. However, from the application's perspective, the tagged address *is* the memory address, so if the application is unaware of memory tags, it may get confused by receiving an address that is, from its point of view, outside of the bounds of the allocation. We observed this behavior in the kselftest for userfaultfd [2] but other applications could have the same problem. Fix this by remembering which tag was used to originally register the userfaultfd and passing that tag back in fault.address. In a future enhancement, we may want to pass back the original fault address, but like SA_EXPOSE_TAGBITS, this should be guarded by a flag. [1] https://source.android.com/devices/tech/debug/tagged-pointers [2] tools/testing/selftests/vm/userfaultfd.c Signed-off-by: Peter Collingbourne Link: https://linux-review.googlesource.com/id/I761aa9f0344454c482b83fcfcce547db0a25501b Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI") Cc: # 5.4 --- Documentation/arm64/tagged-pointers.rst | 5 +++++ fs/userfaultfd.c | 17 +++++++++++------ include/linux/mm_types.h | 3 ++- 3 files changed, 18 insertions(+), 7 deletions(-) diff --git a/Documentation/arm64/tagged-pointers.rst b/Documentation/arm64/tagged-pointers.rst index 19d284b70384..ec8e1f90b744 100644 --- a/Documentation/arm64/tagged-pointers.rst +++ b/Documentation/arm64/tagged-pointers.rst @@ -73,6 +73,11 @@ flag setting. Non-zero tags are never preserved in sigcontext.fault_address regardless of the SA_EXPOSE_TAGBITS flag setting. +When using userfaultfd the address tag supplied in the range.start +field of the UFFDIO_REGISTER ioctl is preserved and returned to +userspace via the fault.address field of struct uffd_msg, and the +tag of the original fault address is discarded. + The architecture prevents the use of a tagged PC, so the upper byte will be set to a sign-extension of bit 55 on exception return. diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index dd7a6c62b56f..adb0f7d0638a 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -110,15 +110,15 @@ static int userfaultfd_wake_function(wait_queue_entry_t *wq, unsigned mode, struct userfaultfd_wake_range *range = key; int ret; struct userfaultfd_wait_queue *uwq; - unsigned long start, len; + unsigned long start, len, addr; uwq = container_of(wq, struct userfaultfd_wait_queue, wq); ret = 0; /* len == 0 means wake all */ start = range->start; len = range->len; - if (len && (start > uwq->msg.arg.pagefault.address || - start + len <= uwq->msg.arg.pagefault.address)) + addr = untagged_addr(uwq->msg.arg.pagefault.address); + if (len && (start > addr || start + len <= addr)) goto out; WRITE_ONCE(uwq->waken, true); /* @@ -480,8 +480,9 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) init_waitqueue_func_entry(&uwq.wq, userfaultfd_wake_function); uwq.wq.private = current; - uwq.msg = userfault_msg(vmf->address, vmf->flags, reason, - ctx->features); + uwq.msg = userfault_msg( + vmf->address + vmf->vma->vm_userfaultfd_ctx.address_tag, + vmf->flags, reason, ctx->features); uwq.ctx = ctx; uwq.waken = false; @@ -1287,7 +1288,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, unsigned long vm_flags, new_flags; bool found; bool basic_ioctls; - unsigned long start, end, vma_end; + unsigned long address_tag, start, end, vma_end; user_uffdio_register = (struct uffdio_register __user *) arg; @@ -1313,6 +1314,9 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, vm_flags |= VM_UFFD_MINOR; } + address_tag = uffdio_register.range.start - + untagged_addr(uffdio_register.range.start); + ret = validate_range(mm, &uffdio_register.range.start, uffdio_register.range.len); if (ret) @@ -1462,6 +1466,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, */ vma->vm_flags = new_flags; vma->vm_userfaultfd_ctx.ctx = ctx; + vma->vm_userfaultfd_ctx.address_tag = address_tag; if (is_vm_hugetlb_page(vma) && uffd_disable_huge_pmd_share(vma)) hugetlb_unshare_all_pmds(vma); diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 8f0fb62e8975..cb93e5b17896 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -286,9 +286,10 @@ struct vm_region { }; #ifdef CONFIG_USERFAULTFD -#define NULL_VM_UFFD_CTX ((struct vm_userfaultfd_ctx) { NULL, }) +#define NULL_VM_UFFD_CTX ((struct vm_userfaultfd_ctx) { NULL, 0, }) struct vm_userfaultfd_ctx { struct userfaultfd_ctx *ctx; + unsigned long address_tag; }; #else /* CONFIG_USERFAULTFD */ #define NULL_VM_UFFD_CTX ((struct vm_userfaultfd_ctx) {})