From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20F8BC11F64 for ; Thu, 1 Jul 2021 15:53:37 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id D460B61418 for ; Thu, 1 Jul 2021 15:53:36 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D460B61418 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=arm.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=Bv4BcbCBS7Z4LwD1WnOxVSTUyN0qtUeIL6Z7fW/x/lM=; b=LRVgjqdM3/9Utu YUNVtFjzRWJpUFmcSfy4tW5oPeGounRiTCUvHzq019JQ/TPbsdWhZjHq25W1mSER+IjeJSOyQYb7q DY8wfzGG+NpPfqQ8W87tAPCzgNl5iQ+mG8LUft+0I7v6ny8DdFjSkj71SlWi5QjrOuhwwm3FIhS0j ImyY6ghxft3BHZBaqVdRGnFbSTN553gL/SocIEDKzqAK+QwsviYYdviMnR8mHiEWQx7G9qq1QMRpk xHZJzfkw4mJvZAuGRP88oNjrYnpE7UFkEdDL/VNVR2R7UGjjjLldRRZ3oMv9gUHsMiJHPJR+QmWk0 76oIykndnThWpxvUnjnA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1lyyyx-000KCn-Ec; Thu, 01 Jul 2021 15:52:03 +0000 Received: from mail.kernel.org ([198.145.29.99]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1lyyyt-000KBe-P5 for linux-arm-kernel@lists.infradead.org; Thu, 01 Jul 2021 15:52:01 +0000 Received: by mail.kernel.org (Postfix) with ESMTPSA id 9ECE661413; Thu, 1 Jul 2021 15:51:51 +0000 (UTC) Date: Thu, 1 Jul 2021 16:51:49 +0100 From: Catalin Marinas To: Peter Collingbourne Cc: Vincenzo Frascino , Dave Martin , Will Deacon , Andrew Morton , Andrea Arcangeli , Alistair Delva , Lokesh Gidra , William McVicker , Evgenii Stepanov , Mitch Phillips , Linux ARM , linux-mm@kvack.org, stable@vger.kernel.org Subject: Re: [PATCH v2] userfaultfd: preserve user-supplied address tag in struct uffd_msg Message-ID: <20210701155148.GB12484@arm.com> References: <20210630232931.3779403-1-pcc@google.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20210630232931.3779403-1-pcc@google.com> User-Agent: Mutt/1.10.1 (2018-07-13) X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210701_085159_870807_C9BB9437 X-CRM114-Status: GOOD ( 23.37 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org Hi Peter, On Wed, Jun 30, 2021 at 04:29:31PM -0700, Peter Collingbourne wrote: > If a user program uses userfaultfd on ranges of heap memory, it may > end up passing a tagged pointer to the kernel in the range.start > field of the UFFDIO_REGISTER ioctl. This can happen when using an > MTE-capable allocator, or on Android if using the Tagged Pointers > feature for MTE readiness [1]. When we added the tagged addr ABI, we realised it's nearly impossible to sort out all ioctls, so we added a note to the documentation that any address other than pointer to user structures as arguments to ioctl() should be untagged. Arguably, userfaultfd is not a random device but if we place it in the same category as mmap/mremap/brk, those don't allow tagged pointers either. And we do expect some apps to break when they rely on malloc() to return untagged pointers. > When a fault subsequently occurs, the tag is stripped from the fault > address returned to the application in the fault.address field > of struct uffd_msg. However, from the application's perspective, > the tagged address *is* the memory address, so if the application > is unaware of memory tags, it may get confused by receiving an > address that is, from its point of view, outside of the bounds of the > allocation. We observed this behavior in the kselftest for userfaultfd > [2] but other applications could have the same problem. Just curious, what's generating the tagged pointers in the kselftest? Is it posix_memalign()? > Fix this by remembering which tag was used to originally register the > userfaultfd and passing that tag back in fault.address. In a future > enhancement, we may want to pass back the original fault address, > but like SA_EXPOSE_TAGBITS, this should be guarded by a flag. I don't see exposing the tagged fault address vs making up a tag (from the original request) that different. I find the former cleaner from an ABI perspective, though it's a bit more intrusive to pass the tagged address via handle_mm_fault(). My preference is to fix this in user-space entirely, by explicit untagging of the malloc'ed pointer either before being passed to userfaultfd or when handling the userfaultfd message. How common is it for apps to register malloc'ed pointers with userfaultfd? I was hoping that's more of an (anonymous) mmap() play. -- Catalin _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel