From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 865BAC0650F for ; Tue, 11 Jun 2019 17:09:20 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 3ED032086D for ; Tue, 11 Jun 2019 17:09:20 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3ED032086D Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id C9DFD6B0008; Tue, 11 Jun 2019 13:09:19 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C27736B000A; Tue, 11 Jun 2019 13:09:19 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AC8B76B000C; Tue, 11 Jun 2019 13:09:19 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from mail-ed1-f69.google.com (mail-ed1-f69.google.com [209.85.208.69]) by kanga.kvack.org (Postfix) with ESMTP id 58EC46B0008 for ; Tue, 11 Jun 2019 13:09:19 -0400 (EDT) Received: by mail-ed1-f69.google.com with SMTP id a21so21539977edt.23 for ; Tue, 11 Jun 2019 10:09:19 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:subject:to:cc :references:from:message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=NRaq99vQ+r7YdgW6CZh+zAzyCv0fh+okoy8nrVIE+vE=; b=JjdvA4jd09mwu7We/WUK0fDtp5Nqxy9s5vvOQCir+7Mf4R38wpMOR4uB3p54zdyY6U rMRGGKxc3Cq1xBOWvN82Vyr6ditouuC4GbCsCx5fD2cCko7PJu+aqFVYQKjqyMWKv39F UewiBp1PtioRY00RfdMtVBWSiAFOfmUOQBbQqwpU1Ufoot8r+VPvDfZDpFQVeKaIoo5m Kzwprk+qiD6NDndFtDkRl4BXVc1dUBqwzSxm1xGgJKj78hqDVFnRMSWBZsYacxEDIHn9 kDfl1CfPXPyi8pAzoxo+oM9tEmjaZ98M6OXjsDEN47rutiQcTw4ewPk5vvrL65Scxtk6 zm9g== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of vincenzo.frascino@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=vincenzo.frascino@arm.com X-Gm-Message-State: APjAAAWKmKoUVX2Tp6HYtGIqrwGimvTNh2QBxTx+maLIJRgT6L1vFfk9 CLwLeOl97NsUPgyEQKVAYg7e36CvlQ5zkODH28Ggtbowk8B6cnnvb0Op04osyUaiilbGUyy3tyZ m/ch2/6MBAZVacMayq1s1XHR1wu280CpL6mI4evczRP5lqt3aTBC09Cf1xbpG030R3w== X-Received: by 2002:a17:906:a59:: with SMTP id x25mr22607081ejf.293.1560272958877; Tue, 11 Jun 2019 10:09:18 -0700 (PDT) X-Google-Smtp-Source: APXvYqw1jVeirfB7ahg86mSDCbBsK2pat6e0ZoNAFQsYBCByLIOzsL1vAFmyCII0T921zBSEyK/a X-Received: by 2002:a17:906:a59:: with SMTP id x25mr22606968ejf.293.1560272957596; Tue, 11 Jun 2019 10:09:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1560272957; cv=none; d=google.com; s=arc-20160816; b=eo+11J+fJG/dMlZXGEVxJZjenFlQFK+T4kejkmyOi0OQrCiKX1Iunll8QkMsRPpQIs 6LujJE6R45NFK30PKc6X5QV1hb0rIALA8wHTdVjsBVspxnJkTYUG522Klg6wyMdQwcLM 6xxvndlDpfcpDnPlRkwzDHO/2+F9uYcf7W6wVk2E6o7SXJ6v7mLU/Zh6Beq9tm+wnTeb Qj/ZV7ANt6TlvKymzg1vXcw3gi/kN4wMsnA9seAbEIEyiPLjwgTcmuBQxE4mnI3L3Y8X v2EIy26w3PF34TzJrd+1RC3FotsBcwVpWjRigC9vWuDtVO+YFvF8sbmVWiiYdyLvNEdW wWbg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:content-language:in-reply-to:mime-version :user-agent:date:message-id:from:references:cc:to:subject; bh=NRaq99vQ+r7YdgW6CZh+zAzyCv0fh+okoy8nrVIE+vE=; b=LNUnu9pXt1Ge6oJgKUeVeMGgska0xfIyjTJ2W9DSD7G4KF/+hoN+l5Wi7OFD5HACQH U24mvUEN9Tfw1cXSSp2oLBGzW77wYjChJiYZ5rftwi+dWAFX3dU/8qWZg7DQwNeakDQl API7SN9Px3yazZw97Rjvxx+maDhRZHMGR5vZjnhdQlH0X7sS/eE+VZjk+/LSawu51VWI Ov2Izx43aEn50Y5ojnxwpTQEa2WoZ/CCCG1k8Yhwv5SX69c5Cr6JEVwfxTUlxkKd2tc+ /mFn564MdHAGyk9kToIAWrPnIVqGzouqG0WhcQilPtfbjyEoR2g74KF96bVrVmt5Ma5Y d00w== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of vincenzo.frascino@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=vincenzo.frascino@arm.com Received: from foss.arm.com (foss.arm.com. [217.140.110.172]) by mx.google.com with ESMTP id g7si3822689eda.302.2019.06.11.10.09.17 for ; Tue, 11 Jun 2019 10:09:17 -0700 (PDT) Received-SPF: pass (google.com: domain of vincenzo.frascino@arm.com designates 217.140.110.172 as permitted sender) client-ip=217.140.110.172; Authentication-Results: mx.google.com; spf=pass (google.com: domain of vincenzo.frascino@arm.com designates 217.140.110.172 as permitted sender) smtp.mailfrom=vincenzo.frascino@arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 9D92B337; Tue, 11 Jun 2019 10:09:16 -0700 (PDT) Received: from [10.1.196.72] (e119884-lin.cambridge.arm.com [10.1.196.72]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 800433F73C; Tue, 11 Jun 2019 10:09:11 -0700 (PDT) Subject: Re: [PATCH v16 02/16] arm64: untag user pointers in access_ok and __uaccess_mask_ptr To: Catalin Marinas , Andrey Konovalov Cc: Mark Rutland , kvm@vger.kernel.org, Szabolcs Nagy , Will Deacon , dri-devel@lists.freedesktop.org, linux-mm@kvack.org, Khalid Aziz , linux-kselftest@vger.kernel.org, Felix Kuehling , Jacob Bramley , Leon Romanovsky , linux-rdma@vger.kernel.org, amd-gfx@lists.freedesktop.org, Christoph Hellwig , Jason Gunthorpe , Dmitry Vyukov , Dave Martin , Evgeniy Stepanov , linux-media@vger.kernel.org, Kevin Brodsky , Kees Cook , Ruben Ayrapetyan , Ramana Radhakrishnan , Alex Williamson , Mauro Carvalho Chehab , linux-arm-kernel@lists.infradead.org, Kostya Serebryany , Greg Kroah-Hartman , Yishai Hadas , linux-kernel@vger.kernel.org, Jens Wiklander , Lee Smith , Alexander Deucher , Andrew Morton , enh , Robin Murphy , Christian Koenig , Luc Van Oostenryck References: <4327b260fb17c4776a1e3c844f388e4948cfb747.1559580831.git.andreyknvl@google.com> <20190610175326.GC25803@arrakis.emea.arm.com> <20190611145720.GA63588@arrakis.emea.arm.com> From: Vincenzo Frascino Message-ID: Date: Tue, 11 Jun 2019 18:09:10 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <20190611145720.GA63588@arrakis.emea.arm.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hi Catalin, ... > ---------8<---------------- > From 7c624777a4e545522dec1b34e60f0229cb2bd59f Mon Sep 17 00:00:00 2001 > From: Catalin Marinas > Date: Tue, 11 Jun 2019 13:03:38 +0100 > Subject: [PATCH] arm64: Introduce prctl() options to control the tagged user > addresses ABI > > It is not desirable to relax the ABI to allow tagged user addresses into > the kernel indiscriminately. This patch introduces a prctl() interface > for enabling or disabling the tagged ABI with a global sysctl control > for preventing applications from enabling the relaxed ABI (meant for > testing user-space prctl() return error checking without reconfiguring > the kernel). The ABI properties are inherited by threads of the same > application and fork()'ed children but cleared on execve(). > > The PR_SET_TAGGED_ADDR_CTRL will be expanded in the future to handle > MTE-specific settings like imprecise vs precise exceptions. > > Signed-off-by: Catalin Marinas > --- > arch/arm64/include/asm/processor.h | 6 +++ > arch/arm64/include/asm/thread_info.h | 1 + > arch/arm64/include/asm/uaccess.h | 5 ++- > arch/arm64/kernel/process.c | 67 ++++++++++++++++++++++++++++ > include/uapi/linux/prctl.h | 5 +++ > kernel/sys.c | 16 +++++++ > 6 files changed, 99 insertions(+), 1 deletion(-) > > diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h > index fcd0e691b1ea..fee457456aa8 100644 > --- a/arch/arm64/include/asm/processor.h > +++ b/arch/arm64/include/asm/processor.h > @@ -307,6 +307,12 @@ extern void __init minsigstksz_setup(void); > /* PR_PAC_RESET_KEYS prctl */ > #define PAC_RESET_KEYS(tsk, arg) ptrauth_prctl_reset_keys(tsk, arg) > > +/* PR_TAGGED_ADDR prctl */ > +long set_tagged_addr_ctrl(unsigned long arg); > +long get_tagged_addr_ctrl(void); > +#define SET_TAGGED_ADDR_CTRL(arg) set_tagged_addr_ctrl(arg) > +#define GET_TAGGED_ADDR_CTRL() get_tagged_addr_ctrl() > + > /* > * For CONFIG_GCC_PLUGIN_STACKLEAK > * > diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h > index c285d1ce7186..7263d4c973ce 100644 > --- a/arch/arm64/include/asm/thread_info.h > +++ b/arch/arm64/include/asm/thread_info.h > @@ -101,6 +101,7 @@ void arch_release_task_struct(struct task_struct *tsk); > #define TIF_SVE 23 /* Scalable Vector Extension in use */ > #define TIF_SVE_VL_INHERIT 24 /* Inherit sve_vl_onexec across exec */ > #define TIF_SSBD 25 /* Wants SSB mitigation */ > +#define TIF_TAGGED_ADDR 26 > Can you please put a comment here? > #define _TIF_SIGPENDING (1 << TIF_SIGPENDING) > #define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED) > diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h > index 9164ecb5feca..995b9ea11a89 100644 > --- a/arch/arm64/include/asm/uaccess.h > +++ b/arch/arm64/include/asm/uaccess.h > @@ -73,6 +73,9 @@ static inline unsigned long __range_ok(const void __user *addr, unsigned long si > { > unsigned long ret, limit = current_thread_info()->addr_limit; > > + if (test_thread_flag(TIF_TAGGED_ADDR)) > + addr = untagged_addr(addr); > + > __chk_user_ptr(addr); > asm volatile( > // A + B <= C + 1 for all A,B,C, in four easy steps: > @@ -94,7 +97,7 @@ static inline unsigned long __range_ok(const void __user *addr, unsigned long si > return ret; > } > > -#define access_ok(addr, size) __range_ok(untagged_addr(addr), size) > +#define access_ok(addr, size) __range_ok(addr, size) > #define user_addr_max get_fs >> #define _ASM_EXTABLE(from, to) \ > diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c > index 3767fb21a5b8..69d0be1fc708 100644 > --- a/arch/arm64/kernel/process.c > +++ b/arch/arm64/kernel/process.c > @@ -30,6 +30,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -323,6 +324,7 @@ void flush_thread(void) > fpsimd_flush_thread(); > tls_thread_flush(); > flush_ptrace_hw_breakpoint(current); > + clear_thread_flag(TIF_TAGGED_ADDR); Nit: in line we the other functions in thread_flush we could have something like "tagged_addr_thread_flush", maybe inlined. > } > > void release_thread(struct task_struct *dead_task) > @@ -552,3 +554,68 @@ void arch_setup_new_exec(void) > > ptrauth_thread_init_user(current); > } > + > +/* > + * Control the relaxed ABI allowing tagged user addresses into the kernel. > + */ > +static unsigned int tagged_addr_prctl_allowed = 1; > + > +long set_tagged_addr_ctrl(unsigned long arg) > +{ > + if (!tagged_addr_prctl_allowed) > + return -EINVAL; > + if (is_compat_task()) > + return -EINVAL; > + if (arg & ~PR_TAGGED_ADDR_ENABLE) > + return -EINVAL; > + > + if (arg & PR_TAGGED_ADDR_ENABLE) > + set_thread_flag(TIF_TAGGED_ADDR); > + else > + clear_thread_flag(TIF_TAGGED_ADDR); > + > + return 0; > +} > + > +long get_tagged_addr_ctrl(void) > +{ > + if (!tagged_addr_prctl_allowed) > + return -EINVAL; > + if (is_compat_task()) > + return -EINVAL; > + > + if (test_thread_flag(TIF_TAGGED_ADDR)) > + return PR_TAGGED_ADDR_ENABLE; > + > + return 0; > +} > + > +/* > + * Global sysctl to disable the tagged user addresses support. This control > + * only prevents the tagged address ABI enabling via prctl() and does not > + * disable it for tasks that already opted in to the relaxed ABI. > + */ > +static int zero; > +static int one = 1; > + > +static struct ctl_table tagged_addr_sysctl_table[] = { > + { > + .procname = "tagged_addr", > + .mode = 0644, > + .data = &tagged_addr_prctl_allowed, > + .maxlen = sizeof(int), > + .proc_handler = proc_dointvec_minmax, > + .extra1 = &zero, > + .extra2 = &one, > + }, > + { } > +}; > + > +static int __init tagged_addr_init(void) > +{ > + if (!register_sysctl("abi", tagged_addr_sysctl_table)) > + return -EINVAL; > + return 0; > +} > + > +core_initcall(tagged_addr_init); process.c seems already a bit "overcrowded". Probably we could move all the tagged_addr features in a separate file. What do you think? It would make easier the implementation of mte as well going forward. > diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h > index 094bb03b9cc2..2e927b3e9d6c 100644 > --- a/include/uapi/linux/prctl.h > +++ b/include/uapi/linux/prctl.h > @@ -229,4 +229,9 @@ struct prctl_mm_map { > # define PR_PAC_APDBKEY (1UL << 3) > # define PR_PAC_APGAKEY (1UL << 4) > > +/* Tagged user address controls for arm64 */ > +#define PR_SET_TAGGED_ADDR_CTRL 55 > +#define PR_GET_TAGGED_ADDR_CTRL 56 > +# define PR_TAGGED_ADDR_ENABLE (1UL << 0) > + > #endif /* _LINUX_PRCTL_H */ > diff --git a/kernel/sys.c b/kernel/sys.c > index 2969304c29fe..ec48396b4943 100644 > --- a/kernel/sys.c > +++ b/kernel/sys.c > @@ -124,6 +124,12 @@ > #ifndef PAC_RESET_KEYS > # define PAC_RESET_KEYS(a, b) (-EINVAL) > #endif > +#ifndef SET_TAGGED_ADDR_CTRL > +# define SET_TAGGED_ADDR_CTRL(a) (-EINVAL) > +#endif > +#ifndef GET_TAGGED_ADDR_CTRL > +# define GET_TAGGED_ADDR_CTRL() (-EINVAL) > +#endif > > /* > * this is where the system-wide overflow UID and GID are defined, for > @@ -2492,6 +2498,16 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, > return -EINVAL; > error = PAC_RESET_KEYS(me, arg2); > break; > + case PR_SET_TAGGED_ADDR_CTRL: > + if (arg3 || arg4 || arg5) > + return -EINVAL; > + error = SET_TAGGED_ADDR_CTRL(arg2); > + break; > + case PR_GET_TAGGED_ADDR_CTRL: > + if (arg2 || arg3 || arg4 || arg5) > + return -EINVAL; > + error = GET_TAGGED_ADDR_CTRL(); > + break; Why do we need two prctl here? We could have only one and use arg2 as set/get and arg3 as a parameter. What do you think? > default: > error = -EINVAL; > break; > -- Regards, Vincenzo