These can be used to place an MTE tag at an address that is not at a page size boundary.

The kernel prior to 295cf156231c ("arm64: Avoid premature usercopy failure"), would infinite loop if an MTE tag was placed not at a PAGE_SIZE boundary. This is because the kernel checked if the pages were readable by checking the first byte of each page, but would then fault in the middle of the page due to the MTE tag.

Signed-off-by: Joey Gouly joey.gouly@arm.com Cc: Catalin Marinas catalin.marinas@arm.com Cc: Will Deacon will@kernel.org Cc: Mark Brown broonie@kernel.org Cc: Shuah Khan shuah@kernel.org Reviewed-by: Mark Brown broonie@kernel.org Tested-by: Mark Brown broonie@kernel.org Reviewed-by: Shuah Khan skhan@linuxfoundation.org --- .../selftests/arm64/mte/check_user_mem.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/tools/testing/selftests/arm64/mte/check_user_mem.c b/tools/testing/selftests/arm64/mte/check_user_mem.c index 1de7a0abd0ae..5a5a7e1f5789 100644 --- a/tools/testing/selftests/arm64/mte/check_user_mem.c +++ b/tools/testing/selftests/arm64/mte/check_user_mem.c @@ -19,7 +19,8 @@

static size_t page_sz;

-static int check_usermem_access_fault(int mem_type, int mode, int mapping) +static int check_usermem_access_fault(int mem_type, int mode, int mapping, + int tag_offset, int tag_len) { int fd, i, err; char val = 'A'; @@ -54,10 +55,12 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping) if (i < len) goto usermem_acc_err;

- /* Tag the next half of memory with different value */ - ptr_next = (void *)((unsigned long)ptr + page_sz); + if (!tag_len) + tag_len = len - tag_offset; + /* Tag a part of memory with different value */ + ptr_next = (void *)((unsigned long)ptr + tag_offset); ptr_next = mte_insert_new_tag(ptr_next); - mte_set_tag_address_range(ptr_next, page_sz); + mte_set_tag_address_range(ptr_next, tag_len);

lseek(fd, 0, 0); /* Copy from file into buffer with invalid tag */ @@ -100,14 +103,14 @@ int main(int argc, char *argv[]) /* Set test plan */ ksft_set_plan(4);

- evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_PRIVATE), + evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_PRIVATE, page_sz, 0), "Check memory access from kernel in sync mode, private mapping and mmap memory\n"); - evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_SHARED), + evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_SHARED, page_sz, 0), "Check memory access from kernel in sync mode, shared mapping and mmap memory\n");

- evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_PRIVATE), + evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_PRIVATE, page_sz, 0), "Check memory access from kernel in async mode, private mapping and mmap memory\n"); - evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_SHARED), + evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_SHARED, page_sz, 0), "Check memory access from kernel in async mode, shared mapping and mmap memory\n");

mte_restore_setup();

Future commits will have multiple iterations of tests in this function, so make the error handling assume it will pass and then bail out if there is an error.

Signed-off-by: Joey Gouly joey.gouly@arm.com Cc: Catalin Marinas catalin.marinas@arm.com Cc: Will Deacon will@kernel.org Cc: Mark Brown broonie@kernel.org Cc: Shuah Khan shuah@kernel.org Reviewed-by: Mark Brown broonie@kernel.org Tested-by: Mark Brown broonie@kernel.org Reviewed-by: Shuah Khan skhan@linuxfoundation.org --- .../selftests/arm64/mte/check_user_mem.c | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/tools/testing/selftests/arm64/mte/check_user_mem.c b/tools/testing/selftests/arm64/mte/check_user_mem.c index 5a5a7e1f5789..2afcc9fb9ae8 100644 --- a/tools/testing/selftests/arm64/mte/check_user_mem.c +++ b/tools/testing/selftests/arm64/mte/check_user_mem.c @@ -27,7 +27,7 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, size_t len, read_len; void *ptr, *ptr_next;

- err = KSFT_FAIL; + err = KSFT_PASS; len = 2 * page_sz; mte_switch_mode(mode, MTE_ALLOW_NON_ZERO_TAG); fd = create_temp_file(); @@ -71,14 +71,22 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, * mode without fault but may not fail in async mode as per the * implemented MTE userspace support in Arm64 kernel. */ - if (mode == MTE_SYNC_ERR && - !cur_mte_cxt.fault_valid && read_len < len) { - err = KSFT_PASS; - } else if (mode == MTE_ASYNC_ERR && - !cur_mte_cxt.fault_valid && read_len == len) { - err = KSFT_PASS; + if (cur_mte_cxt.fault_valid) + goto usermem_acc_err; + + if (mode == MTE_SYNC_ERR && read_len < len) { + /* test passed */ + } else if (mode == MTE_ASYNC_ERR && read_len == len) { + /* test passed */ + } else { + goto usermem_acc_err; } + + goto exit; + usermem_acc_err: + err = KSFT_FAIL; +exit: mte_free_memory((void *)ptr, len, mem_type, true); close(fd); return err;

To check there are no assumptions in the kernel about buffer sizes or alignments of user space pointers, expand the test to cover different sizes and offsets.

Signed-off-by: Joey Gouly joey.gouly@arm.com Cc: Catalin Marinas catalin.marinas@arm.com Cc: Will Deacon will@kernel.org Cc: Mark Brown broonie@kernel.org Cc: Shuah Khan shuah@kernel.org Reviewed-by: Mark Brown broonie@kernel.org Tested-by: Mark Brown broonie@kernel.org Reviewed-by: Shuah Khan skhan@linuxfoundation.org --- .../selftests/arm64/mte/check_user_mem.c | 45 +++++++++++-------- 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/tools/testing/selftests/arm64/mte/check_user_mem.c b/tools/testing/selftests/arm64/mte/check_user_mem.c index 2afcc9fb9ae8..89c861ee68fa 100644 --- a/tools/testing/selftests/arm64/mte/check_user_mem.c +++ b/tools/testing/selftests/arm64/mte/check_user_mem.c @@ -26,6 +26,8 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, char val = 'A'; size_t len, read_len; void *ptr, *ptr_next; + int fileoff, ptroff, size; + int sizes[] = {1, 2, 3, 8, 16, 32, 4096, page_sz};

err = KSFT_PASS; len = 2 * page_sz; @@ -62,24 +64,31 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, ptr_next = mte_insert_new_tag(ptr_next); mte_set_tag_address_range(ptr_next, tag_len);

- lseek(fd, 0, 0); - /* Copy from file into buffer with invalid tag */ - read_len = read(fd, ptr, len); - mte_wait_after_trig(); - /* - * Accessing user memory in kernel with invalid tag should fail in sync - * mode without fault but may not fail in async mode as per the - * implemented MTE userspace support in Arm64 kernel. - */ - if (cur_mte_cxt.fault_valid) - goto usermem_acc_err; - - if (mode == MTE_SYNC_ERR && read_len < len) { - /* test passed */ - } else if (mode == MTE_ASYNC_ERR && read_len == len) { - /* test passed */ - } else { - goto usermem_acc_err; + for (fileoff = 0; fileoff < 16; fileoff++) { + for (ptroff = 0; ptroff < 16; ptroff++) { + for (i = 0; i < ARRAY_SIZE(sizes); i++) { + size = sizes[i]; + lseek(fd, 0, 0); + /* Copy from file into buffer with invalid tag */ + read_len = read(fd, ptr + ptroff, size); + mte_wait_after_trig(); + /* + * Accessing user memory in kernel with invalid tag should fail in sync + * mode without fault but may not fail in async mode as per the + * implemented MTE userspace support in Arm64 kernel. + */ + if (cur_mte_cxt.fault_valid) { + goto usermem_acc_err; + } + if (mode == MTE_SYNC_ERR && read_len < len) { + /* test passed */ + } else if (mode == MTE_ASYNC_ERR && read_len == size) { + /* test passed */ + } else { + goto usermem_acc_err; + } + } + } }

goto exit;

The test is currently hardcoded to use the `read` syscall, this commit adds a test_type enum to support expanding the test coverage to other syscalls.

Signed-off-by: Joey Gouly joey.gouly@arm.com Cc: Catalin Marinas catalin.marinas@arm.com Cc: Will Deacon will@kernel.org Cc: Mark Brown broonie@kernel.org Cc: Shuah Khan shuah@kernel.org Reviewed-by: Mark Brown broonie@kernel.org Tested-by: Mark Brown broonie@kernel.org Reviewed-by: Shuah Khan skhan@linuxfoundation.org --- .../selftests/arm64/mte/check_user_mem.c | 38 +++++++++++++------ 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/tools/testing/selftests/arm64/mte/check_user_mem.c b/tools/testing/selftests/arm64/mte/check_user_mem.c index 89c861ee68fa..58b1b272ca80 100644 --- a/tools/testing/selftests/arm64/mte/check_user_mem.c +++ b/tools/testing/selftests/arm64/mte/check_user_mem.c @@ -19,12 +19,18 @@

static size_t page_sz;

+enum test_type { + READ_TEST, + LAST_TEST, +}; + static int check_usermem_access_fault(int mem_type, int mode, int mapping, - int tag_offset, int tag_len) + int tag_offset, int tag_len, + enum test_type test_type) { int fd, i, err; char val = 'A'; - size_t len, read_len; + ssize_t len, syscall_len; void *ptr, *ptr_next; int fileoff, ptroff, size; int sizes[] = {1, 2, 3, 8, 16, 32, 4096, page_sz}; @@ -46,9 +52,9 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, } mte_initialize_current_context(mode, (uintptr_t)ptr, len); /* Copy from file into buffer with valid tag */ - read_len = read(fd, ptr, len); + syscall_len = read(fd, ptr, len); mte_wait_after_trig(); - if (cur_mte_cxt.fault_valid || read_len < len) + if (cur_mte_cxt.fault_valid || syscall_len < len) goto usermem_acc_err; /* Verify same pattern is read */ for (i = 0; i < len; i++) @@ -69,8 +75,16 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, for (i = 0; i < ARRAY_SIZE(sizes); i++) { size = sizes[i]; lseek(fd, 0, 0); - /* Copy from file into buffer with invalid tag */ - read_len = read(fd, ptr + ptroff, size); + + /* perform file operation on buffer with invalid tag */ + switch (test_type) { + case READ_TEST: + syscall_len = read(fd, ptr + ptroff, size); + break; + case LAST_TEST: + goto usermem_acc_err; + } + mte_wait_after_trig(); /* * Accessing user memory in kernel with invalid tag should fail in sync @@ -80,9 +94,9 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, if (cur_mte_cxt.fault_valid) { goto usermem_acc_err; } - if (mode == MTE_SYNC_ERR && read_len < len) { + if (mode == MTE_SYNC_ERR && syscall_len < len) { /* test passed */ - } else if (mode == MTE_ASYNC_ERR && read_len == size) { + } else if (mode == MTE_ASYNC_ERR && syscall_len == size) { /* test passed */ } else { goto usermem_acc_err; @@ -120,14 +134,14 @@ int main(int argc, char *argv[]) /* Set test plan */ ksft_set_plan(4);

- evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_PRIVATE, page_sz, 0), + evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_PRIVATE, page_sz, 0, READ_TEST), "Check memory access from kernel in sync mode, private mapping and mmap memory\n"); - evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_SHARED, page_sz, 0), + evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_SHARED, page_sz, 0, READ_TEST), "Check memory access from kernel in sync mode, shared mapping and mmap memory\n");

- evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_PRIVATE, page_sz, 0), + evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_PRIVATE, page_sz, 0, READ_TEST), "Check memory access from kernel in async mode, private mapping and mmap memory\n"); - evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_SHARED, page_sz, 0), + evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_SHARED, page_sz, 0, READ_TEST), "Check memory access from kernel in async mode, shared mapping and mmap memory\n");

mte_restore_setup();

To expand the test coverage for MTE tags in userspace memory, also perform the test with `write`, `readv` and `writev` syscalls.

Signed-off-by: Joey Gouly joey.gouly@arm.com Cc: Catalin Marinas catalin.marinas@arm.com Cc: Will Deacon will@kernel.org Cc: Mark Brown broonie@kernel.org Cc: Shuah Khan shuah@kernel.org Reviewed-by: Mark Brown broonie@kernel.org Tested-by: Mark Brown broonie@kernel.org Reviewed-by: Shuah Khan skhan@linuxfoundation.org --- .../selftests/arm64/mte/check_user_mem.c | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+)

diff --git a/tools/testing/selftests/arm64/mte/check_user_mem.c b/tools/testing/selftests/arm64/mte/check_user_mem.c index 58b1b272ca80..bb4974c437f8 100644 --- a/tools/testing/selftests/arm64/mte/check_user_mem.c +++ b/tools/testing/selftests/arm64/mte/check_user_mem.c @@ -11,6 +11,7 @@ #include <string.h> #include <ucontext.h> #include <unistd.h> +#include <sys/uio.h> #include <sys/mman.h>

#include "kselftest.h" @@ -21,6 +22,9 @@ static size_t page_sz;

enum test_type { READ_TEST, + WRITE_TEST, + READV_TEST, + WRITEV_TEST, LAST_TEST, };

@@ -81,6 +85,23 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, case READ_TEST: syscall_len = read(fd, ptr + ptroff, size); break; + case WRITE_TEST: + syscall_len = write(fd, ptr + ptroff, size); + break; + case READV_TEST: { + struct iovec iov[1]; + iov[0].iov_base = ptr + ptroff; + iov[0].iov_len = size; + syscall_len = readv(fd, iov, 1); + break; + } + case WRITEV_TEST: { + struct iovec iov[1]; + iov[0].iov_base = ptr + ptroff; + iov[0].iov_len = size; + syscall_len = writev(fd, iov, 1); + break; + } case LAST_TEST: goto usermem_acc_err; }

Instead of hard coding a small amount of tests, generate a wider range of tests to try catch any corner cases that could show up.

These new tests test different MTE tag lengths and offsets, which previously would have caused infinite loops in the kernel. This was fixed by 295cf156231c ("arm64: Avoid premature usercopy failure"), so these are regressions tests for that corner case.

Signed-off-by: Joey Gouly joey.gouly@arm.com Cc: Catalin Marinas catalin.marinas@arm.com Cc: Will Deacon will@kernel.org Cc: Mark Brown broonie@kernel.org Cc: Shuah Khan shuah@kernel.org Reviewed-by: Mark Brown broonie@kernel.org Tested-by: Mark Brown broonie@kernel.org Reviewed-by: Shuah Khan skhan@linuxfoundation.org --- .../selftests/arm64/mte/check_user_mem.c | 94 ++++++++++++++++--- 1 file changed, 83 insertions(+), 11 deletions(-)

diff --git a/tools/testing/selftests/arm64/mte/check_user_mem.c b/tools/testing/selftests/arm64/mte/check_user_mem.c index bb4974c437f8..f4ae5f87a3b7 100644 --- a/tools/testing/selftests/arm64/mte/check_user_mem.c +++ b/tools/testing/selftests/arm64/mte/check_user_mem.c @@ -3,6 +3,7 @@

#define _GNU_SOURCE

+#include <assert.h> #include <errno.h> #include <fcntl.h> #include <signal.h> @@ -20,6 +21,8 @@

static size_t page_sz;

+#define TEST_NAME_MAX 100 + enum test_type { READ_TEST, WRITE_TEST, @@ -136,9 +139,67 @@ static int check_usermem_access_fault(int mem_type, int mode, int mapping, return err; }

+void format_test_name(char* name, int name_len, int type, int sync, int map, int len, int offset) { + const char* test_type; + const char* mte_type; + const char* map_type; + + switch (type) { + case READ_TEST: + test_type = "read"; + break; + case WRITE_TEST: + test_type = "write"; + break; + case READV_TEST: + test_type = "readv"; + break; + case WRITEV_TEST: + test_type = "writev"; + break; + default: + assert(0); + break; + } + + switch (sync) { + case MTE_SYNC_ERR: + mte_type = "MTE_SYNC_ERR"; + break; + case MTE_ASYNC_ERR: + mte_type = "MTE_ASYNC_ERR"; + break; + default: + assert(0); + break; + } + + switch (map) { + case MAP_SHARED: + map_type = "MAP_SHARED"; + break; + case MAP_PRIVATE: + map_type = "MAP_PRIVATE"; + break; + default: + assert(0); + break; + } + + snprintf(name, name_len, + "test type: %s, %s, %s, tag len: %d, tag offset: %d\n", + test_type, mte_type, map_type, len, offset); +} + int main(int argc, char *argv[]) { int err; + int t, s, m, l, o; + int mte_sync[] = {MTE_SYNC_ERR, MTE_ASYNC_ERR}; + int maps[] = {MAP_SHARED, MAP_PRIVATE}; + int tag_lens[] = {0, MT_GRANULE_SIZE}; + int tag_offsets[] = {page_sz, MT_GRANULE_SIZE}; + char test_name[TEST_NAME_MAX];

page_sz = getpagesize(); if (!page_sz) { @@ -153,17 +214,28 @@ int main(int argc, char *argv[]) mte_register_signal(SIGSEGV, mte_default_handler);

/* Set test plan */ - ksft_set_plan(4); - - evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_PRIVATE, page_sz, 0, READ_TEST), - "Check memory access from kernel in sync mode, private mapping and mmap memory\n"); - evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_SYNC_ERR, MAP_SHARED, page_sz, 0, READ_TEST), - "Check memory access from kernel in sync mode, shared mapping and mmap memory\n"); - - evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_PRIVATE, page_sz, 0, READ_TEST), - "Check memory access from kernel in async mode, private mapping and mmap memory\n"); - evaluate_test(check_usermem_access_fault(USE_MMAP, MTE_ASYNC_ERR, MAP_SHARED, page_sz, 0, READ_TEST), - "Check memory access from kernel in async mode, shared mapping and mmap memory\n"); + ksft_set_plan(64); + + for (t = 0; t < LAST_TEST; t++) { + for (s = 0; s < ARRAY_SIZE(mte_sync); s++) { + for (m = 0; m < ARRAY_SIZE(maps); m++) { + for (l = 0; l < ARRAY_SIZE(tag_lens); l++) { + for (o = 0; o < ARRAY_SIZE(tag_offsets); o++) { + int sync = mte_sync[s]; + int map = maps[m]; + int offset = tag_offsets[o]; + int tag_len = tag_lens[l]; + int res = check_usermem_access_fault(USE_MMAP, sync, + map, offset, + tag_len, t); + format_test_name(test_name, TEST_NAME_MAX, + t, sync, map, tag_len, offset); + evaluate_test(res, test_name); + } + } + } + } + }

mte_restore_setup(); ksft_print_cnts();