[PATCH 4/6] mm, arm64: untag user addresses in mm/gup.c

On Thu, May 3, 2018 at 5:24 PM, Kirill A. Shutemov [off-list ref] wrote:

On Thu, May 03, 2018 at 04:09:56PM +0200, Andrey Konovalov wrote:

quoted

On Wed, May 2, 2018 at 7:25 PM, Andrey Konovalov [off-list ref] wrote:

quoted

I wasn't able to find anything that calls follow_page with pointers
passed from userspace except for the memory subsystem syscalls, and we
deliberately don't add untagging in those.

I guess I missed this part, but could you elaborate on this? Why?
Not yet or not ever?

Check out the discussion here:
https://www.spinics.net/lists/arm-kernel/msg640936.html

Also I wounder if we can find (with sparse?) all places where we cast out
__user. This would give a nice list of places where to pay attention.

The way I tested this is I added BUG_ON(top byte tag is set) to
find_vma and find_extend_vma and ran a modified version of syzkaller
that embeds tags into pointers overnight. The only crashes that I saw
were coming from memory subsystem syscalls. I then temporarily added
untagging to suppress those crashes
(https://gist.github.com/xairy/3aa1f57798fa62522c8ac53fad9b74ca), and
didn't see any crashes after that.