| Message ID | PH7PR14MB5594801243EB482C01963A2FCEAB9@PH7PR14MB5594.namprd14.prod.outlook.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v2] riscv: don't allow write but not read page mapping request in mmap | expand |
On Mon, Jun 13, 2022 at 1:20 PM Celeste Liu <coelacanthus@outlook.com> wrote: > > When xctan tries to run one of libaio's tests > (https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t), > it encounters a strange behavior: for the same PROT_WRITE only mapping, > there was a discrepancy in whether it could be read before and after writing > (readable before writing, unreadable after writing). After some investigation, > I found that mmap allows write only mapping, an undefined behavior, on RISC-V. > > As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version > "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission > bit combination of "write+!read" is "Reserved for future use.". Hence, don't > allow such mapping request in mmap call. In the current code[2], write+exec > only is marked as invalid, but write only is not marked as invalid. > > This patch refines that judgment. > > [1]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf > [2]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1 > (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1) > > Reported-by: xctan <xc-tan@outlook.com> > Co-developed-by: dram <dramforever@live.com> > Signed-off-by: dram <dramforever@live.com> > Co-developed-by: Ruizhe Pan <c141028@gmail.com> > Signed-off-by: Ruizhe Pan <c141028@gmail.com> > Signed-off-by: Celeste Liu <coelacanthus@outlook.com> > Cc: linux-riscv@lists.infradead.org > Cc: linux-kernel@vger.kernel.org > Cc: Guo Ren <guoren@kernel.org> > Cc: Yash Shah <yash.shah@sifive.com> > --- > v2: This version adds a link to the referenced spec, and reference of the > previous related modification. > > arch/riscv/kernel/sys_riscv.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c > index 9c0194f176fc..571556bb9261 100644 > --- a/arch/riscv/kernel/sys_riscv.c > +++ b/arch/riscv/kernel/sys_riscv.c > @@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, > if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) > return -EINVAL; > > - if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) Yes, PROT_EXEC would prevent next PROT_READ check. Looks good to me. Reviewed-by: Guo Ren <guoren@kernel.org> > - if (unlikely(!(prot & PROT_READ))) > - return -EINVAL; Could we put your comment here? /* * As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version * "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission * bit combination of "write+!read" is "Reserved for future use.". Hence, don't * allow such mapping request in mmap call. In the current code[2], write+exec * only is marked as invalid, but write only is not marked as invalid. */ > + if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) > + return -EINVAL; > > return ksys_mmap_pgoff(addr, len, prot, flags, fd, > offset >> (PAGE_SHIFT - page_shift_offset)); > -- > 2.36.1 >
On 13/06/2022 06:20, Celeste Liu wrote: > [You don't often get email from coelacanthus@outlook.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] > > EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe > > When xctan tries to run one of libaio's tests > (https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t), > it encounters a strange behavior: for the same PROT_WRITE only mapping, > there was a discrepancy in whether it could be read before and after writing > (readable before writing, unreadable after writing). After some investigation, > I found that mmap allows write only mapping, an undefined behavior, on RISC-V. > > As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version > "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission > bit combination of "write+!read" is "Reserved for future use.". Hence, don't > allow such mapping request in mmap call. In the current code[2], write+exec > only is marked as invalid, but write only is not marked as invalid. > > This patch refines that judgment. > > [1]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf > [2]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1 > (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1) > > Reported-by: xctan <xc-tan@outlook.com> > Co-developed-by: dram <dramforever@live.com> > Signed-off-by: dram <dramforever@live.com> Those don't look like "real" names? https://www.kernel.org/doc/html/latest/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin > Co-developed-by: Ruizhe Pan <c141028@gmail.com> > Signed-off-by: Ruizhe Pan <c141028@gmail.com> > Signed-off-by: Celeste Liu <coelacanthus@outlook.com> > Cc: linux-riscv@lists.infradead.org > Cc: linux-kernel@vger.kernel.org > Cc: Guo Ren <guoren@kernel.org> > Cc: Yash Shah <yash.shah@sifive.com> > --- > v2: This version adds a link to the referenced spec, and reference of the > previous related modification. > > arch/riscv/kernel/sys_riscv.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) > > diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c > index 9c0194f176fc..571556bb9261 100644 > --- a/arch/riscv/kernel/sys_riscv.c > +++ b/arch/riscv/kernel/sys_riscv.c > @@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, > if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) > return -EINVAL; > > - if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) > - if (unlikely(!(prot & PROT_READ))) > - return -EINVAL; > + if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) > + return -EINVAL; > > return ksys_mmap_pgoff(addr, len, prot, flags, fd, > offset >> (PAGE_SHIFT - page_shift_offset)); > -- > 2.36.1 > > > _______________________________________________ > linux-riscv mailing list > linux-riscv@lists.infradead.org > http://lists.infradead.org/mailman/listinfo/linux-riscv
On Mon, Jun 13, 2022 at 01:44:28PM +0800, Guo Ren wrote: > Yes, PROT_EXEC would prevent next PROT_READ check. > > Looks good to me. > > Reviewed-by: Guo Ren <guoren@kernel.org> > > - if (unlikely(!(prot & PROT_READ))) > > - return -EINVAL; > Could we put your comment here? > > /* > * As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version > * "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission > * bit combination of "write+!read" is "Reserved for future use.". Hence, don't > * allow such mapping request in mmap call. In the current code[2], write+exec > * only is marked as invalid, but write only is not marked as invalid. > */ > ok, I will add it in next verison. -- Best Regards Coelacanthus
On Mon, Jun 13, 2022 at 06:25:22AM +0000, Conor.Dooley@microchip.com wrote: > Those don't look like "real" names? > https: > //www.kernel.org/doc/html/latest/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin oh, I will correct it in next version. -- Best Regards Celeste Liu
diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c index 9c0194f176fc..571556bb9261 100644 --- a/arch/riscv/kernel/sys_riscv.c +++ b/arch/riscv/kernel/sys_riscv.c @@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) return -EINVAL; - if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) - if (unlikely(!(prot & PROT_READ))) - return -EINVAL; + if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ))) + return -EINVAL; return ksys_mmap_pgoff(addr, len, prot, flags, fd, offset >> (PAGE_SHIFT - page_shift_offset));
When xctan tries to run one of libaio's tests (https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t), it encounters a strange behavior: for the same PROT_WRITE only mapping, there was a discrepancy in whether it could be read before and after writing (readable before writing, unreadable after writing). After some investigation, I found that mmap allows write only mapping, an undefined behavior, on RISC-V. As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission bit combination of "write+!read" is "Reserved for future use.". Hence, don't allow such mapping request in mmap call. In the current code[2], write+exec only is marked as invalid, but write only is not marked as invalid. This patch refines that judgment. [1]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf [2]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1 (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1) Reported-by: xctan <xc-tan@outlook.com> Co-developed-by: dram <dramforever@live.com> Signed-off-by: dram <dramforever@live.com> Co-developed-by: Ruizhe Pan <c141028@gmail.com> Signed-off-by: Ruizhe Pan <c141028@gmail.com> Signed-off-by: Celeste Liu <coelacanthus@outlook.com> Cc: linux-riscv@lists.infradead.org Cc: linux-kernel@vger.kernel.org Cc: Guo Ren <guoren@kernel.org> Cc: Yash Shah <yash.shah@sifive.com> --- v2: This version adds a link to the referenced spec, and reference of the previous related modification. arch/riscv/kernel/sys_riscv.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-)