From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f71.google.com (mail-wm0-f71.google.com [74.125.82.71]) by kanga.kvack.org (Postfix) with ESMTP id 094286B026B for ; Mon, 6 Aug 2018 12:41:04 -0400 (EDT) Received: by mail-wm0-f71.google.com with SMTP id h14-v6so9558546wmb.4 for ; Mon, 06 Aug 2018 09:41:03 -0700 (PDT) Received: from mail-sor-f65.google.com (mail-sor-f65.google.com. [209.85.220.65]) by mx.google.com with SMTPS id f192-v6sor1632732wme.58.2018.08.06.09.41.02 for (Google Transport Security); Mon, 06 Aug 2018 09:41:02 -0700 (PDT) From: Andrey Konovalov Subject: [PATCH v5 06/10] arm64: untag user address in __do_user_fault Date: Mon, 6 Aug 2018 18:40:41 +0200 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: owner-linux-mm@kvack.org List-ID: To: Catalin Marinas , Will Deacon , Mark Rutland , Robin Murphy , Al Viro , Andrey Konovalov , Kees Cook , Kate Stewart , Greg Kroah-Hartman , Andrew Morton , Ingo Molnar , "Kirill A . Shutemov" , Shuah Khan , linux-arm-kernel@lists.infradead.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Dmitry Vyukov , Kostya Serebryany , Evgeniy Stepanov , Lee Smith , Ramana Radhakrishnan , Jacob Bramley , Ruben Ayrapetyan , Chintan Pandya In __do_user_fault the fault address is being compared to TASK_SIZE to find out whether the address lies in the kernel or in user space. Since the fault address is coming from a user it can be tagged. Untag the pointer before comparing. Signed-off-by: Andrey Konovalov --- arch/arm64/mm/fault.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index b8eecc7b9531..89033d992d28 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -313,7 +313,7 @@ static void __do_user_fault(struct siginfo *info, unsigned int esr) * type", so we ignore this wrinkle and just return the translation * fault.) */ - if (current->thread.fault_address >= TASK_SIZE) { + if (untagged_addr(current->thread.fault_address) >= TASK_SIZE) { switch (ESR_ELx_EC(esr)) { case ESR_ELx_EC_DABT_LOW: /* -- 2.18.0.597.ga71716f1ad-goog