[PATCH v2] riscv: don't allow write but not read page mapping request in mmap

[PATCH v2] riscv: don't allow write but not read page mapping request in mmap

[Celeste Liu]

When xctan tries to run one of libaio's tests
(https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t),
it encounters a strange behavior: for the same PROT_WRITE only mapping,
there was a discrepancy in whether it could be read before and after writing
(readable before writing, unreadable after writing). After some investigation,
I found that mmap allows write only mapping, an undefined behavior, on RISC-V.

As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
"20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission
bit combination of "write+!read" is "Reserved for future use.". Hence, don't
allow such mapping request in mmap call. In the current code[2], write+exec
only is marked as invalid, but write only is not marked as invalid.

This patch refines that judgment.

[1]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf
[2]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1
     (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1)

Reported-by: xctan <xc-tan@outlook.com>
Co-developed-by: dram <dramforever@live.com>
Signed-off-by: dram <dramforever@live.com>
Co-developed-by: Ruizhe Pan <c141028@gmail.com>
Signed-off-by: Ruizhe Pan <c141028@gmail.com>
Signed-off-by: Celeste Liu <coelacanthus@outlook.com>
Cc: linux-riscv@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Cc: Guo Ren <guoren@kernel.org>
Cc: Yash Shah <yash.shah@sifive.com>
---
v2: This version adds a link to the referenced spec, and reference of the 
previous related modification.

 arch/riscv/kernel/sys_riscv.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
index 9c0194f176fc..571556bb9261 100644
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
 	if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
 		return -EINVAL;
 
-	if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
-		if (unlikely(!(prot & PROT_READ)))
-			return -EINVAL;
+	if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
+		return -EINVAL;
 
 	return ksys_mmap_pgoff(addr, len, prot, flags, fd,
 			       offset >> (PAGE_SHIFT - page_shift_offset));
-- 
2.36.1


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH v2] riscv: don't allow write but not read page mapping request in mmap

[Guo Ren]

On Mon, Jun 13, 2022 at 1:20 PM Celeste Liu <coelacanthus@outlook.com> wrote:
>
> When xctan tries to run one of libaio's tests
> (https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t),
> it encounters a strange behavior: for the same PROT_WRITE only mapping,
> there was a discrepancy in whether it could be read before and after writing
> (readable before writing, unreadable after writing). After some investigation,
> I found that mmap allows write only mapping, an undefined behavior, on RISC-V.
>
> As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
> "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission
> bit combination of "write+!read" is "Reserved for future use.". Hence, don't
> allow such mapping request in mmap call. In the current code[2], write+exec
> only is marked as invalid, but write only is not marked as invalid.
>
> This patch refines that judgment.
>
> [1]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf
> [2]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1
>      (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1)
>
> Reported-by: xctan <xc-tan@outlook.com>
> Co-developed-by: dram <dramforever@live.com>
> Signed-off-by: dram <dramforever@live.com>
> Co-developed-by: Ruizhe Pan <c141028@gmail.com>
> Signed-off-by: Ruizhe Pan <c141028@gmail.com>
> Signed-off-by: Celeste Liu <coelacanthus@outlook.com>
> Cc: linux-riscv@lists.infradead.org
> Cc: linux-kernel@vger.kernel.org
> Cc: Guo Ren <guoren@kernel.org>
> Cc: Yash Shah <yash.shah@sifive.com>
> ---
> v2: This version adds a link to the referenced spec, and reference of the
> previous related modification.
>
>  arch/riscv/kernel/sys_riscv.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
> index 9c0194f176fc..571556bb9261 100644
> --- a/arch/riscv/kernel/sys_riscv.c
> +++ b/arch/riscv/kernel/sys_riscv.c
> @@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
>         if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
>                 return -EINVAL;
>
> -       if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
Yes, PROT_EXEC would prevent next PROT_READ check.

Looks good to me.

Reviewed-by: Guo Ren <guoren@kernel.org>

> -               if (unlikely(!(prot & PROT_READ)))
> -                       return -EINVAL;
Could we put your comment here?

/*
 * As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
 * "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission
 * bit combination of "write+!read" is "Reserved for future use.". Hence, don't
 * allow such mapping request in mmap call. In the current code[2], write+exec
 * only is marked as invalid, but write only is not marked as invalid.
 */

> +       if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
> +               return -EINVAL;
>
>         return ksys_mmap_pgoff(addr, len, prot, flags, fd,
>                                offset >> (PAGE_SHIFT - page_shift_offset));
> --
> 2.36.1
>


-- 
Best Regards
 Guo Ren

ML: https://lore.kernel.org/linux-csky/

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH v2] riscv: don't allow write but not read page mapping request in mmap

[Conor.Dooley]

On 13/06/2022 06:20, Celeste Liu wrote:
> [You don't often get email from coelacanthus@outlook.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
> 
> EXTERNAL EMAIL: Do not click links or open attachments unless you know the content is safe
> 
> When xctan tries to run one of libaio's tests
> (https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t),
> it encounters a strange behavior: for the same PROT_WRITE only mapping,
> there was a discrepancy in whether it could be read before and after writing
> (readable before writing, unreadable after writing). After some investigation,
> I found that mmap allows write only mapping, an undefined behavior, on RISC-V.
> 
> As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
> "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission
> bit combination of "write+!read" is "Reserved for future use.". Hence, don't
> allow such mapping request in mmap call. In the current code[2], write+exec
> only is marked as invalid, but write only is not marked as invalid.
> 
> This patch refines that judgment.
> 
> [1]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf
> [2]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1
>       (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1)
> 
> Reported-by: xctan <xc-tan@outlook.com>
> Co-developed-by: dram <dramforever@live.com>
> Signed-off-by: dram <dramforever@live.com>

Those don't look like "real" names?
https://www.kernel.org/doc/html/latest/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin

> Co-developed-by: Ruizhe Pan <c141028@gmail.com>
> Signed-off-by: Ruizhe Pan <c141028@gmail.com>
> Signed-off-by: Celeste Liu <coelacanthus@outlook.com>
> Cc: linux-riscv@lists.infradead.org
> Cc: linux-kernel@vger.kernel.org
> Cc: Guo Ren <guoren@kernel.org>
> Cc: Yash Shah <yash.shah@sifive.com>
> ---
> v2: This version adds a link to the referenced spec, and reference of the
> previous related modification.
> 
>   arch/riscv/kernel/sys_riscv.c | 5 ++---
>   1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
> index 9c0194f176fc..571556bb9261 100644
> --- a/arch/riscv/kernel/sys_riscv.c
> +++ b/arch/riscv/kernel/sys_riscv.c
> @@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
>          if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
>                  return -EINVAL;
> 
> -       if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
> -               if (unlikely(!(prot & PROT_READ)))
> -                       return -EINVAL;
> +       if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
> +               return -EINVAL;
> 
>          return ksys_mmap_pgoff(addr, len, prot, flags, fd,
>                                 offset >> (PAGE_SHIFT - page_shift_offset));
> --
> 2.36.1
> 
> 
> _______________________________________________
> linux-riscv mailing list
> linux-riscv@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-riscv

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH v2] riscv: don't allow write but not read page mapping request in mmap

[Celeste Liu]

[-- Attachment #1.1: Type: text/plain, Size: 812 bytes --]

On Mon, Jun 13, 2022 at 01:44:28PM +0800, Guo Ren wrote:
> Yes, PROT_EXEC would prevent next PROT_READ check.
> 
> Looks good to me.
> 
> Reviewed-by: Guo Ren <guoren@kernel.org>

> > -               if (unlikely(!(prot & PROT_READ)))
> > -                       return -EINVAL;
> Could we put your comment here?
> 
> /*
>  * As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
>  * "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission
>  * bit combination of "write+!read" is "Reserved for future use.". Hence, don't
>  * allow such mapping request in mmap call. In the current code[2], write+exec
>  * only is marked as invalid, but write only is not marked as invalid.
>  */
> 

ok, I will add it in next verison.

--
Best Regards
 Coelacanthus

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[-- Attachment #2: Type: text/plain, Size: 161 bytes --]

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

Re: [PATCH v2] riscv: don't allow write but not read page mapping request in mmap

[Coelacanthus]

[-- Attachment #1.1: Type: text/plain, Size: 313 bytes --]

On Mon, Jun 13, 2022 at 06:25:22AM +0000, Conor.Dooley@microchip.com wrote:
> Those don't look like "real" names?
> https:
> //www.kernel.org/doc/html/latest/process/submitting-patches.html#sign-your-work-the-developer-s-certificate-of-origin

oh, I will correct it in next version.

--
Best Regards
 Celeste Liu

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]

[-- Attachment #2: Type: text/plain, Size: 161 bytes --]

_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv