| Message ID | ff30b0afe6005fd046f9ac72bfb71822aedccd89.1610731872.git.andreyknvl@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | kasan: fixes for 5.11-rc | expand |
On Fri, Jan 15, 2021 at 06:41:53PM +0100, Andrey Konovalov wrote: > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > Fix up the pointer tag for kernel pointers in do_tag_check_fault by > setting them to the same value as bit 55. Explicitly use __untagged_addr() > instead of untagged_addr(), as the latter doesn't affect TTBR1 addresses. > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> Unless there are other comments, I'll queue this for -rc5 through the arm64 tree (I already finalised the arm64 for-next/fixes branch for this week).
On 1/15/21 5:41 PM, Andrey Konovalov wrote: > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > Fix up the pointer tag for kernel pointers in do_tag_check_fault by > setting them to the same value as bit 55. Explicitly use __untagged_addr() > instead of untagged_addr(), as the latter doesn't affect TTBR1 addresses. > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") > Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") > Signed-off-by: Andrey Konovalov <andreyknvl@google.com> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> > --- > arch/arm64/mm/fault.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c > index 3c40da479899..35d75c60e2b8 100644 > --- a/arch/arm64/mm/fault.c > +++ b/arch/arm64/mm/fault.c > @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, > struct pt_regs *regs) > { > /* > - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag > - * check faults. Mask them out now so that userspace doesn't see them. > + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN > + * for tag check faults. Set them to corresponding bits in the untagged > + * address. > */ > - far &= (1UL << 60) - 1; > + far = (__untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK); > do_bad_area(far, esr, regs); > return 0; > } >
On Fri, Jan 15, 2021 at 6:59 PM Catalin Marinas <catalin.marinas@arm.com> wrote: > > On Fri, Jan 15, 2021 at 06:41:53PM +0100, Andrey Konovalov wrote: > > As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address > > that is passed to report_tag_fault has pointer tags in the format of 0x0X, > > while KASAN uses 0xFX format (note the difference in the top 4 bits). > > > > Fix up the pointer tag for kernel pointers in do_tag_check_fault by > > setting them to the same value as bit 55. Explicitly use __untagged_addr() > > instead of untagged_addr(), as the latter doesn't affect TTBR1 addresses. > > > > Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 > > Reviewed-by: Catalin Marinas <catalin.marinas@arm.com> > > Unless there are other comments, I'll queue this for -rc5 through the > arm64 tree (I already finalised the arm64 for-next/fixes branch for this > week). Sounds good, thank you!
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 3c40da479899..35d75c60e2b8 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -709,10 +709,11 @@ static int do_tag_check_fault(unsigned long far, unsigned int esr, struct pt_regs *regs) { /* - * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN for tag - * check faults. Mask them out now so that userspace doesn't see them. + * The architecture specifies that bits 63:60 of FAR_EL1 are UNKNOWN + * for tag check faults. Set them to corresponding bits in the untagged + * address. */ - far &= (1UL << 60) - 1; + far = (__untagged_addr(far) & ~MTE_TAG_MASK) | (far & MTE_TAG_MASK); do_bad_area(far, esr, regs); return 0; }
As of the "arm64: expose FAR_EL1 tag bits in siginfo" patch, the address that is passed to report_tag_fault has pointer tags in the format of 0x0X, while KASAN uses 0xFX format (note the difference in the top 4 bits). Fix up the pointer tag for kernel pointers in do_tag_check_fault by setting them to the same value as bit 55. Explicitly use __untagged_addr() instead of untagged_addr(), as the latter doesn't affect TTBR1 addresses. Link: https://linux-review.googlesource.com/id/I9ced973866036d8679e8f4ae325de547eb969649 Fixes: dceec3ff7807 ("arm64: expose FAR_EL1 tag bits in siginfo") Fixes: 4291e9ee6189 ("kasan, arm64: print report from tag fault handler") Signed-off-by: Andrey Konovalov <andreyknvl@google.com> --- arch/arm64/mm/fault.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)