Re: [PATCH v16 06/16] mm, arm64: untag user pointers in mm/gup.c

Kees Cook
2019-06-08T03:59:23Z

On Mon, Jun 03, 2019 at 06:55:08PM +0200, Andrey Konovalov wrote:
> This patch is a part of a series that extends arm64 kernel ABI to allow to
> pass tagged user pointers (with the top byte set to something else other
> than 0x00) as syscall arguments.
>
> mm/gup.c provides a kernel interface that accepts user addresses and
> manipulates user pages directly (for example get_user_pages, that is used
> by the futex syscall). Since a user can provided tagged addresses, we need
> to handle this case.
>
> Add untagging to gup.c functions that use user addresses for vma lookups.
>
> Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
> Signed-off-by: Andrey Konovalov <andreyknvl@google.com>

Reviewed-by: Kees Cook <keescook@chromium.org>

-Kees

> ---
> mm/gup.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/mm/gup.c b/mm/gup.c
> index ddde097cf9e4..c37df3d455a2 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -802,6 +802,8 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
> if (!nr_pages)
> return 0;
>
> + start = untagged_addr(start);
> +
> VM_BUG_ON(!!pages != !!(gup_flags & FOLL_GET));
>
> /*
> @@ -964,6 +966,8 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
> struct vm_area_struct *vma;
> vm_fault_t ret, major = 0;
>
> + address = untagged_addr(address);
> +
> if (unlocked)
> fault_flags |= FAULT_FLAG_ALLOW_RETRY;
>
> --
> 2.22.0.rc1.311.g5d7573a151-goog
>

--
Kees Cook