Hi Peter,
On Wed, Jun 30, 2021 at 04:29:31PM -0700, Peter Collingbourne wrote:
If a user program uses userfaultfd on ranges of heap memory, it may
end up passing a tagged pointer to the kernel in the range.start
field of the UFFDIO_REGISTER ioctl. This can happen when using an
MTE-capable allocator, or on Android if using the Tagged Pointers
feature for MTE readiness [1].
When we added the tagged addr ABI, we realised it's nearly impossible to
sort out all ioctls, so we added a note to the documentation that any
address other than pointer to user structures as arguments to ioctl()
should be untagged. Arguably, userfaultfd is not a random device but if
we place it in the same category as mmap/mremap/brk, those don't allow
tagged pointers either. And we do expect some apps to break when they
rely on malloc() to return untagged pointers.
When a fault subsequently occurs, the tag is stripped from the fault
address returned to the application in the fault.address field
of struct uffd_msg. However, from the application's perspective,
the tagged address *is* the memory address, so if the application
is unaware of memory tags, it may get confused by receiving an
address that is, from its point of view, outside of the bounds of the
allocation. We observed this behavior in the kselftest for userfaultfd
[2] but other applications could have the same problem.
Just curious, what's generating the tagged pointers in the kselftest? Is
it posix_memalign()?
Fix this by remembering which tag was used to originally register the
userfaultfd and passing that tag back in fault.address. In a future
enhancement, we may want to pass back the original fault address,
but like SA_EXPOSE_TAGBITS, this should be guarded by a flag.
I don't see exposing the tagged fault address vs making up a tag (from
the original request) that different. I find the former cleaner from an
ABI perspective, though it's a bit more intrusive to pass the tagged
address via handle_mm_fault().
My preference is to fix this in user-space entirely, by explicit
untagging of the malloc'ed pointer either before being passed to
userfaultfd or when handling the userfaultfd message. How common is it
for apps to register malloc'ed pointers with userfaultfd? I was hoping
that's more of an (anonymous) mmap() play.
--
Catalin
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel