From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933005AbcBPREH (ORCPT ); Tue, 16 Feb 2016 12:04:07 -0500 Received: from foss.arm.com ([217.140.101.70]:55300 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932341AbcBPREF (ORCPT ); Tue, 16 Feb 2016 12:04:05 -0500 Date: Tue, 16 Feb 2016 17:04:09 +0000 From: Will Deacon To: Catalin Marinas Cc: Robin Murphy , EunTaik Lee , "vladimir.murzin@arm.com" , "suzuki.poulose@arm.com" , "linux-kernel@vger.kernel.org" , "salyzyn@android.com" , "riandrews@android.com" , "james.morse@arm.com" , "Dave.Martin@arm.com" , "linux-arm-kernel@lists.infradead.org" , torvalds@linux-foundation.org, hpa@zytor.com, arjan@linux.intel.com, peterz@infradead.org Subject: Re: [PATCH v2] arm64: add alignment fault hanling Message-ID: <20160216170408.GL14509@arm.com> References: <329817481.954581455597874663.JavaMail.weblogic@epmlwas08c> <20160216103104.GC14509@arm.com> <56C300AD.8070505@arm.com> <20160216122153.GD19413@e104818-lin.cambridge.arm.com> <20160216160055.GH14509@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160216160055.GH14509@arm.com> User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [replying to self and adding some x86 people] Background: Euntaik reports a problem where userspace has ended up with a memory page mapped adjacent to an MMIO page (e.g. from /dev/mem or a PCI memory bar from someplace in /sys). strncpy_from_user happens with the word-at-a-time implementation, and we end up reading into the MMIO page. Question: Does x86 guarantee that this faults? (Arjan reckoned no, but wasn't 100%). On Tue, Feb 16, 2016 at 04:00:55PM +0000, Will Deacon wrote: > On Tue, Feb 16, 2016 at 12:21:53PM +0000, Catalin Marinas wrote: > > On Tue, Feb 16, 2016 at 10:57:49AM +0000, Robin Murphy wrote: > > > On 16/02/16 10:31, Will Deacon wrote: > > > >On Tue, Feb 16, 2016 at 04:44:35AM +0000, EunTaik Lee wrote: > > > >>Userspace memory is mapped as below: > > > >>F2A7F000--F2A7FFFF Normal Memory > > > >>F2A80000--F2A80FFF Device nGnRnE > > > >> > > > >>And that userspace application makes a system call > > > >>as below: > > > >> > > > >>-009 |do_strncpy_from_user(inline) > > > >>-009 |strncpy_from_user() > > > >>-010 |getname_flags() > > > >>-011 |user_path_at_empty() > > > >>-012 |user_path_at() > > > >>-013 |SYSC_faccessat(inline) > > > >>-013 |sys_faccessat() > > > >>-014 |__sys_trace(asm) > > > >> --> |exception > > > >> > > > >>The string spans from 0xF2A7FFC1 to 0xF2A7FFFB. > > > >> > > > >>When do_strncpy_from_user() reads the last (unsigned long) > > > >>value, the alignement fault is triggered. The 8 byte > > > >>from 0xF2A7FFC1 spans to the next page that is mapped as > > > >>Device nGnRnE, which does not allow an unaligned access, > > > >>causes the abort. > > > >> > > > >>The instruction which caused the alignment fault is registered > > > >>in the fixup table but the exception handler does not reach there. > > > >> > > > >>This patch registers a alignment fault handler and fixes up the > > > >>pc if appropriate. > > > > > > > >As discussed with Catalin previously, we should solve this by adding a > > > >guard page rather than handling the fault. > > > > I don't think we can trivially add this without implementing an arm64 > > specific arch_get_unmapped_area(). > > Even overriding arch_get_unmapped_area doesn't help as much as you might > like since, in the case of something like /dev/mem, the memory is remapped > using remap_pfn_range later on, so you can't necessarily tell what the > final attributes are likely to be when you initially allocate the virtual > space. Thinking more about this, we could spit out a guard page between every VMA, but it's likely to hamper any VMA merging. Will