From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f72.google.com (mail-wm0-f72.google.com [74.125.82.72]) by kanga.kvack.org (Postfix) with ESMTP id 5BB7F6B513B for ; Thu, 30 Aug 2018 07:41:31 -0400 (EDT) Received: by mail-wm0-f72.google.com with SMTP id b186-v6so1137240wmh.8 for ; Thu, 30 Aug 2018 04:41:31 -0700 (PDT) Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id k12-v6sor4755432wrl.2.2018.08.30.04.41.30 for (Google Transport Security); Thu, 30 Aug 2018 04:41:30 -0700 (PDT) From: Andrey Konovalov Subject: [PATCH v6 06/11] arm64: untag user address in __do_user_fault Date: Thu, 30 Aug 2018 13:41:11 +0200 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: owner-linux-mm@kvack.org List-ID: To: Catalin Marinas , Will Deacon , Mark Rutland , Robin Murphy , Al Viro , Andrey Konovalov , Kees Cook , Kate Stewart , Greg Kroah-Hartman , Andrew Morton , Ingo Molnar , "Kirill A . Shutemov" , Shuah Khan , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Dmitry Vyukov , Kostya Serebryany , Evgeniy Stepanov , Lee Smith , Ramana Radhakrishnan , Jacob Bramley , Ruben Ayrapetyan , Chintan Pandya In __do_user_fault the fault address is being compared to TASK_SIZE to find out whether the address lies in the kernel or in user space. Since the fault address is coming from a user it can be tagged. Untag the pointer before comparing. Signed-off-by: Andrey Konovalov --- arch/arm64/mm/fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 50b30ff30de4..871fb3c38b23 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -313,7 +313,7 @@ static void __do_user_fault(struct siginfo *info, unsigned int esr) * type", so we ignore this wrinkle and just return the translation * fault.) */ - if (current->thread.fault_address >= TASK_SIZE) { + if (untagged_addr(current->thread.fault_address) >= TASK_SIZE) { switch (ESR_ELx_EC(esr)) { case ESR_ELx_EC_DABT_LOW: /* -- 2.19.0.rc0.228.g281dcd1b4d0-goog