On 12/06/2019 12:43, Andrey Konovalov wrote:
This patch is a part of a series that extends arm64 kernel ABI to allow to pass tagged user pointers (with the top byte set to something else other than 0x00) as syscall arguments.
userfaultfd code use provided user pointers for vma lookups, which can only by done with untagged pointers.
Untag user pointers in validate_range().
Reviewed-by: Catalin Marinas catalin.marinas@arm.com Reviewed-by: Kees Cook keescook@chromium.org Signed-off-by: Andrey Konovalov andreyknvl@google.com
Reviewed-by: Vincenzo Frascino vincenzo.frascino@arm.com
fs/userfaultfd.c | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-)
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 3b30301c90ec..24d68c3b5ee2 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -1263,21 +1263,23 @@ static __always_inline void wake_userfault(struct userfaultfd_ctx *ctx, } static __always_inline int validate_range(struct mm_struct *mm,
__u64 start, __u64 len)
__u64 *start, __u64 len){ __u64 task_size = mm->task_size;
- if (start & ~PAGE_MASK)
- *start = untagged_addr(*start);
- if (*start & ~PAGE_MASK) return -EINVAL; if (len & ~PAGE_MASK) return -EINVAL; if (!len) return -EINVAL;
- if (start < mmap_min_addr)
- if (*start < mmap_min_addr) return -EINVAL;
- if (start >= task_size)
- if (*start >= task_size) return -EINVAL;
- if (len > task_size - start)
- if (len > task_size - *start) return -EINVAL; return 0;
} @@ -1327,7 +1329,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, goto out; }
- ret = validate_range(mm, uffdio_register.range.start,
- ret = validate_range(mm, &uffdio_register.range.start, uffdio_register.range.len); if (ret) goto out;
@@ -1516,7 +1518,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, if (copy_from_user(&uffdio_unregister, buf, sizeof(uffdio_unregister))) goto out;
- ret = validate_range(mm, uffdio_unregister.start,
- ret = validate_range(mm, &uffdio_unregister.start, uffdio_unregister.len); if (ret) goto out;
@@ -1667,7 +1669,7 @@ static int userfaultfd_wake(struct userfaultfd_ctx *ctx, if (copy_from_user(&uffdio_wake, buf, sizeof(uffdio_wake))) goto out;
- ret = validate_range(ctx->mm, uffdio_wake.start, uffdio_wake.len);
- ret = validate_range(ctx->mm, &uffdio_wake.start, uffdio_wake.len); if (ret) goto out;
@@ -1707,7 +1709,7 @@ static int userfaultfd_copy(struct userfaultfd_ctx *ctx, sizeof(uffdio_copy)-sizeof(__s64))) goto out;
- ret = validate_range(ctx->mm, uffdio_copy.dst, uffdio_copy.len);
- ret = validate_range(ctx->mm, &uffdio_copy.dst, uffdio_copy.len); if (ret) goto out; /*
@@ -1763,7 +1765,7 @@ static int userfaultfd_zeropage(struct userfaultfd_ctx *ctx, sizeof(uffdio_zeropage)-sizeof(__s64))) goto out;
- ret = validate_range(ctx->mm, uffdio_zeropage.range.start,
- ret = validate_range(ctx->mm, &uffdio_zeropage.range.start, uffdio_zeropage.range.len); if (ret) goto out;