From patchwork Mon Mar 8 16:14:34 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vincenzo Frascino X-Patchwork-Id: 12122899 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-17.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2C99CC433E6 for ; Mon, 8 Mar 2021 16:17:51 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AC74965215 for ; Mon, 8 Mar 2021 16:17:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AC74965215 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:Cc:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=IwjeQbUYBCBEpogfAC14b/Qgj6Macl/Uwqn0oLjNoP8=; b=fe/ubgcIdy1+LzBVHCSLzY96P cteEX9FcPMHRwppwBl5iKcC80dIbgY44Fm3OSUQaGha0PE01We0mso8lHZ3MxIOLbe0GtDYhKujyX zWmA9l7Xmrr+ioLYcYL8NJfzSUBFjIU2kar3NXUKTUlBAuXQ18pxnkRf1C8lyTBaw1sqlRnCjN8uE tb1FQHSGtQPXwcSh7CnAwCK8XZuLUv/aKc7YNYmlDua9mElqV/1nwsXlJjtoVeV1pa9PdcE356D6b qCSiNL53LDJ4GzG42BWo1EoJraIR0zZk7gjxfE+fziG01vTiQ+5rTSYvIIDBE1HTEBfz5J4zHSzay gHHg4D8fQ==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lJIYI-000v0y-Me; Mon, 08 Mar 2021 16:16:14 +0000 Received: from casper.infradead.org ([2001:8b0:10b:1236::1]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lJIXj-000uem-GS for linux-arm-kernel@desiato.infradead.org; Mon, 08 Mar 2021 16:15:39 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From:Sender:Reply-To: Content-Type:Content-ID:Content-Description; bh=T03MtvbpaPlQelBLOigL3a4Mq7YEU1PTkqsjk6/wW6g=; b=vSWLFq3jpp1ZHkUSjhyrFm4qm3 NQOkrAa92Lse0OwiZ2hDDTpUpQcsc2E61rysZAY705qY5xIUTcTgQh18QbdSP7XEMHi4C0jsGZCJm L/jMX3rXfo4cLpSmUpvidJcxM94nA3jqPXXtNqy3CDsjvF1fptxBTd9QDiU33gmcdvvWKMaloxh4f MBIhBSg1XQGHZEA1X1KMDcUnldroUV0QoFbOtkM67Ix+i6mIVc1Sqny2xVWzzKL3DnaCyaFTD5vCt HcWDoiLebxCknATYJxU+rbl21tyriWnMfMslan9i/SbApqohXloG2Yvwct5NwJWTOxPkX4eoNqWcY hVT/vGZQ==; Received: from foss.arm.com ([217.140.110.172]) by casper.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lJIXR-00FgW4-Kx for linux-arm-kernel@lists.infradead.org; Mon, 08 Mar 2021 16:15:32 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id BC3671042; Mon, 8 Mar 2021 08:15:16 -0800 (PST) Received: from e119884-lin.cambridge.arm.com (e119884-lin.cambridge.arm.com [10.1.196.72]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id D92963F73C; Mon, 8 Mar 2021 08:15:09 -0800 (PST) From: Vincenzo Frascino To: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com Cc: Vincenzo Frascino , Andrew Morton , Catalin Marinas , Will Deacon , Dmitry Vyukov , Andrey Ryabinin , Alexander Potapenko , Marco Elver , Evgenii Stepanov , Branislav Rankov , Andrey Konovalov , Lorenzo Pieralisi Subject: [PATCH v14 8/8] kselftest/arm64: Verify that TCO is enabled in load_unaligned_zeropad() Date: Mon, 8 Mar 2021 16:14:34 +0000 Message-Id: <20210308161434.33424-9-vincenzo.frascino@arm.com> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210308161434.33424-1-vincenzo.frascino@arm.com> References: <20210308161434.33424-1-vincenzo.frascino@arm.com> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210308_161524_019058_D0D9BD85 X-CRM114-Status: GOOD ( 16.33 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org load_unaligned_zeropad() and __get/put_kernel_nofault() functions can read passed some buffer limits which may include some MTE granule with a different tag. When MTE async mode is enable, the load operation crosses the boundaries and the next granule has a different tag the PE sets the TFSR_EL1.TF1 bit as if an asynchronous tag fault is happened: ================================================================== BUG: KASAN: invalid-access Asynchronous mode enabled: no access details available CPU: 0 PID: 1 Comm: init Not tainted 5.12.0-rc1-ge1045c86620d-dirty #8 Hardware name: FVP Base RevC (DT) Call trace: dump_backtrace+0x0/0x1c0 show_stack+0x18/0x24 dump_stack+0xcc/0x14c kasan_report_async+0x54/0x70 mte_check_tfsr_el1+0x48/0x4c exit_to_user_mode+0x18/0x38 finish_ret_to_user+0x4/0x15c ================================================================== Verify that Tag Check Override (TCO) is enabled in these functions before the load and disable it afterwards to prevent this to happen. Note: The issue has been observed only with an MTE enabled userspace. Cc: Catalin Marinas Cc: Will Deacon Reported-by: Branislav Rankov Signed-off-by: Vincenzo Frascino --- .../arm64/mte/check_read_beyond_buffer.c | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 tools/testing/selftests/arm64/mte/check_read_beyond_buffer.c diff --git a/tools/testing/selftests/arm64/mte/check_read_beyond_buffer.c b/tools/testing/selftests/arm64/mte/check_read_beyond_buffer.c new file mode 100644 index 000000000000..eb03cd52a58e --- /dev/null +++ b/tools/testing/selftests/arm64/mte/check_read_beyond_buffer.c @@ -0,0 +1,78 @@ +// SPDX-License-Identifier: GPL-2.0 +// Copyright (C) 2020 ARM Limited + +#define _GNU_SOURCE + +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +#include "kselftest.h" +#include "mte_common_util.h" +#include "mte_def.h" + +#define NUM_DEVICES 8 + +static char *dev[NUM_DEVICES] = { + "/proc/cmdline", + "/fstab.fvp", + "/dev/null", + "/proc/mounts", + "/proc/filesystems", + "/proc/cmdline", + "/proc/device-tre", /* incorrect path */ + "", +}; + +#define FAKE_PERMISSION 0x88000 +#define MAX_DESCRIPTOR 0xffffffff + +int mte_read_beyond_buffer_test(void) +{ + int fd[NUM_DEVICES]; + unsigned int _desc, _dev; + + for (_desc = 0; _desc <= MAX_DESCRIPTOR; _desc++) { + for (_dev = 0; _dev < NUM_DEVICES; _dev++) { +#ifdef _TEST_DEBUG + printf("[TEST]: openat(0x%x, %s, 0x%x)\n", _desc, dev[_dev], FAKE_PERMISSION); +#endif + + fd[_dev] = openat(_desc, dev[_dev], FAKE_PERMISSION); + } + + for (_dev = 0; _dev <= NUM_DEVICES; _dev++) + close(fd[_dev]); + } + + return KSFT_PASS; +} + +int main(int argc, char *argv[]) +{ + int err; + + err = mte_default_setup(); + if (err) + return err; + + ksft_set_plan(1); + + evaluate_test(mte_read_beyond_buffer_test(), + "Verify that TCO is enabled correctly if a read beyond buffer occurs\n"); + + mte_restore_setup(); + ksft_print_cnts(); + + return ksft_get_fail_cnt() == 0 ? KSFT_PASS : KSFT_FAIL; +}