linux/Documentation/arm64
Peter Collingbourne e71e2ace57 userfaultfd: do not untag user pointers
Patch series "userfaultfd: do not untag user pointers", v5.

If a user program uses userfaultfd on ranges of heap memory, it may end
up passing a tagged pointer to the kernel in the range.start field of
the UFFDIO_REGISTER ioctl.  This can happen when using an MTE-capable
allocator, or on Android if using the Tagged Pointers feature for MTE
readiness [1].

When a fault subsequently occurs, the tag is stripped from the fault
address returned to the application in the fault.address field of struct
uffd_msg.  However, from the application's perspective, the tagged
address *is* the memory address, so if the application is unaware of
memory tags, it may get confused by receiving an address that is, from
its point of view, outside of the bounds of the allocation.  We observed
this behavior in the kselftest for userfaultfd [2] but other
applications could have the same problem.

Address this by not untagging pointers passed to the userfaultfd ioctls.
Instead, let the system call fail.  Also change the kselftest to use
mmap so that it doesn't encounter this problem.

[1] https://source.android.com/devices/tech/debug/tagged-pointers
[2] tools/testing/selftests/vm/userfaultfd.c

This patch (of 2):

Do not untag pointers passed to the userfaultfd ioctls.  Instead, let
the system call fail.  This will provide an early indication of problems
with tag-unaware userspace code instead of letting the code get confused
later, and is consistent with how we decided to handle brk/mmap/mremap
in commit dcde237319 ("mm: Avoid creating virtual address aliases in
brk()/mmap()/mremap()"), as well as being consistent with the existing
tagged address ABI documentation relating to how ioctl arguments are
handled.

The code change is a revert of commit 7d0325749a ("userfaultfd: untag
user pointers") plus some fixups to some additional calls to
validate_range that have appeared since then.

[1] https://source.android.com/devices/tech/debug/tagged-pointers
[2] tools/testing/selftests/vm/userfaultfd.c

Link: https://lkml.kernel.org/r/20210714195437.118982-1-pcc@google.com
Link: https://lkml.kernel.org/r/20210714195437.118982-2-pcc@google.com
Link: https://linux-review.googlesource.com/id/I761aa9f0344454c482b83fcfcce547db0a25501b
Fixes: 63f0c60379 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
Signed-off-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Alistair Delva <adelva@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Dave Martin <Dave.Martin@arm.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Lokesh Gidra <lokeshgidra@google.com>
Cc: Mitch Phillips <mitchp@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: William McVicker <willmcvicker@google.com>
Cc: <stable@vger.kernel.org>	[5.4]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2021-07-23 17:43:28 -07:00
..
acpi_object_usage.rst Documentation: arm64/acpi : clarify arm64 support of IBFT 2021-03-22 12:43:20 +00:00
amu.rst Documentation: Chinese translation of Documentation/arm64/amu.rst 2020-09-28 15:24:24 -06:00
arm-acpi.rst arm64: Replace HTTP links with HTTPS ones 2020-07-23 14:04:37 -06:00
booting.rst arm64: Document requirement for access to FEAT_HCX 2021-05-25 19:05:28 +01:00
cpu-feature-registers.rst arm64: mte: Add Memory Tagging Extension documentation 2020-09-04 12:46:07 +01:00
elf_hwcaps.rst arm64: Fix the documented event stream frequency 2021-05-05 18:34:28 +01:00
features.rst docs: archis: add a per-architecture features list 2020-12-03 15:10:15 -07:00
hugetlbpage.rst Documentation: Chinese translation of Documentation/arm64/hugetlbpage.rst 2020-10-21 15:15:17 -06:00
index.rst docs: archis: add a per-architecture features list 2020-12-03 15:10:15 -07:00
kasan-offsets.sh arm64: mm: extend linear region for 52-bit VA configurations 2020-11-09 17:15:37 +00:00
legacy_instructions.rst docs: arm64: convert docs to ReST and rename to .rst 2019-06-14 14:20:27 -06:00
memory-tagging-extension.rst arm64: mte: Document that user PSTATE.TCO is ignored by kernel uaccess 2020-10-28 17:50:39 +00:00
memory.rst ARM: 2020-12-20 10:44:05 -08:00
perf.rst Documentation: Chinese translation of Documentation/arm64/perf.rst 2020-11-13 15:21:38 -07:00
pointer-authentication.rst arm64: Introduce prctl(PR_PAC_{SET,GET}_ENABLED_KEYS) 2021-04-13 17:31:44 +01:00
silicon-errata.rst arm64: kernel: disable CNP on Carmel 2021-03-25 10:00:23 +00:00
sve.rst It's been a busy cycle for documentation - hopefully the busiest for a 2020-08-04 22:47:54 -07:00
tagged-address-abi.rst userfaultfd: do not untag user pointers 2021-07-23 17:43:28 -07:00
tagged-pointers.rst arm64: expose FAR_EL1 tag bits in siginfo 2020-11-23 18:17:39 +00:00