[PATCH 4/6] mm, arm64: untag user addresses in mm/gup.c

On Tue, May 8, 2018 at 5:11 PM, Catalin Marinas [off-list ref] wrote:

On Wed, May 02, 2018 at 07:25:17PM +0200, Andrey Konovalov wrote:

quoted

On Wed, May 2, 2018 at 5:36 PM, Kirill A. Shutemov
[off-list ref] wrote:

quoted

On Wed, May 02, 2018 at 02:38:42PM +0000, Andrey Konovalov wrote:

quoted

quoted

Does having a tagged address here makes any difference? I couldn't hit a
failure with my simple tests (LD_PRELOAD a library that randomly adds
tags to pointers returned by malloc).

I think you're right, follow_page_mask is only called from
__get_user_pages, which already untagged the address. I'll remove
untagging here.

It also called from follow_page(). Have you covered all its callers?

Oh, missed that, will take a look.

Thinking about that, would it make sense to add untagging to find_vma
(and others) instead of trying to cover all find_vma callers?

I don't think adding the untagging to find_vma() is sufficient. In many
cases the caller does a subsequent check like 'start < vma->vm_start'
(see sys_msync() as an example, there are a few others as well).

OK.

What I
did in my tests was a WARN_ON_ONCE() in find_vma() if the address is
tagged.

So this is similar to what I did.

Do you think trying to find "all places where we cast out __user" with
static analysis as Kirill suggested is something I should pursue? Or
is this patchset is good as is as the first approximation, since we
can fix more things where untagging is needed as we discover them one
by one?