NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
TencentOS-kernel/fs
History
Miles Chen ea83114d0a proc: use untagged_addr() for pagemap_read addresses 
commit 40d6366e9d86d9a67b5642040e76082fdb5bdcf9 upstream.

When we try to visit the pagemap of a tagged userspace pointer, we find
that the start_vaddr is not correct because of the tag.
To fix it, we should untag the userspace pointers in pagemap_read().

I tested with 5.10-rc4 and the issue remains.

Explanation from Catalin in [1]:

 "Arguably, that's a user-space bug since tagged file offsets were never
  supported. In this case it's not even a tag at bit 56 as per the arm64
  tagged address ABI but rather down to bit 47. You could say that the
  problem is caused by the C library (malloc()) or whoever created the
  tagged vaddr and passed it to this function. It's not a kernel
  regression as we've never supported it.

  Now, pagemap is a special case where the offset is usually not
  generated as a classic file offset but rather derived by shifting a
  user virtual address. I guess we can make a concession for pagemap
  (only) and allow such offset with the tag at bit (56 - PAGE_SHIFT + 3)"

My test code is based on [2]:

A userspace pointer which has been tagged by 0xb4: 0xb400007662f541c8

userspace program:

  uint64 OsLayer::VirtualToPhysical(void *vaddr) {
	uint64 frame, paddr, pfnmask, pagemask;
	int pagesize = sysconf(_SC_PAGESIZE);
	off64_t off = ((uintptr_t)vaddr) / pagesize * 8; // off = 0xb400007662f541c8 / pagesize * 8 = 0x5a00003b317aa0
	int fd = open(kPagemapPath, O_RDONLY);
	...

	if (lseek64(fd, off, SEEK_SET) != off || read(fd, &frame, 8) != 8) {
		int err = errno;
		string errtxt = ErrorString(err);
		if (fd >= 0)
			close(fd);
		return 0;
	}
  ...
  }

kernel fs/proc/task_mmu.c:

  static ssize_t pagemap_read(struct file *file, char __user *buf,
		size_t count, loff_t *ppos)
  {
	...
	src = *ppos;
	svpfn = src / PM_ENTRY_BYTES; // svpfn == 0xb400007662f54
	start_vaddr = svpfn << PAGE_SHIFT; // start_vaddr == 0xb400007662f54000
	end_vaddr = mm->task_size;

	/* watch out for wraparound */
	// svpfn == 0xb400007662f54
	// (mm->task_size >> PAGE) == 0x8000000
	if (svpfn > mm->task_size >> PAGE_SHIFT) // the condition is true because of the tag 0xb4
		start_vaddr = end_vaddr;

	ret = 0;
	while (count && (start_vaddr < end_vaddr)) { // we cannot visit correct entry because start_vaddr is set to end_vaddr
		int len;
		unsigned long end;
		...
	}
	...
  }

[1] https://lore.kernel.org/patchwork/patch/1343258/
[2] https://github.com/stressapptest/stressapptest/blob/master/src/os.cc#L158

Link: https://lkml.kernel.org/r/20201204024347.8295-1-miles.chen@mediatek.com
Signed-off-by: Miles Chen <miles.chen@mediatek.com>
Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Andrey Konovalov <andreyknvl@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Will Deacon <will@kernel.org>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Song Bao Hua (Barry Song) <song.bao.hua@hisilicon.com>
Cc: <stable@vger.kernel.org>	[5.4-]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2021-03-16 16:42:14 +08:00
..
9p 9P: Cast to loff_t before multiplying 2021-03-16 16:40:11 +08:00
adfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
affs affs: fix basic permission bits to actually work 2021-03-16 16:35:42 +08:00
afs afs: Fix warning due to unadvanced marshalling pointer 2021-03-16 16:40:37 +08:00
autofs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
befs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
bfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
btrfs btrfs: fix lockdep splat when reading qgroup config on mount 2021-03-16 16:41:34 +08:00
cachefiles cachefiles: Handle readpage error correctly 2021-03-16 16:40:14 +08:00
ceph ceph: promote to unsigned long long before shifting 2021-03-16 16:40:11 +08:00
cifs cifs: fix potential use-after-free in cifs_echo_request() 2021-03-16 16:42:02 +08:00
coda Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
configfs configfs: fix config_item refcnt leak in configfs_rmdir() 2021-03-16 16:28:09 +08:00
cramfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
crypto Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
debugfs debugfs: Fix module state check condition 2021-03-16 16:36:08 +08:00
devpts Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dlm fs: dlm: fix configfs memory leak 2021-03-16 16:39:15 +08:00
ecryptfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
efivarfs efivarfs: revert "fix memory leak in efivarfs_create()" 2021-03-16 16:41:45 +08:00
efs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
erofs erofs: derive atime instead of leaving it empty 2021-03-16 16:40:51 +08:00
exportfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ext2 ext2: don't update mtime on COW faults 2021-03-16 16:35:36 +08:00
ext4 ext4: fix bogus warning in ext4_update_dx_flag() 2021-03-16 16:41:27 +08:00
f2fs f2fs: handle errors of f2fs_get_meta_page_nofail 2021-03-16 16:39:42 +08:00
fat fat: don't allow to mount if the FAT length == 0 2021-03-16 16:29:12 +08:00
freevxfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fscache Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fuse fuse: fix page dereference after free 2021-03-16 16:39:33 +08:00
gfs2 gfs2: check for empty rgrp tree in gfs2_ri_update 2021-03-16 16:42:06 +08:00
hfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hfsplus hfsplus: fix crash and filesystem corruption when deleting files 2021-03-16 16:26:16 +08:00
hostfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hpfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hugetlbfs hugetlbfs: prevent filesystem stacking of hugetlbfs 2021-03-16 16:34:53 +08:00
iomap iomap: fix WARN_ON_ONCE() from unprivileged users 2021-03-16 16:39:20 +08:00
isofs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
jbd2 jbd2: fix up sparse warnings in checkpoint code 2021-03-16 16:40:54 +08:00
jffs2 jffs2: fix UAF problem 2021-03-16 16:34:33 +08:00
jfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
kernfs kernfs: do not call fsnotify() with name without a parent 2021-03-16 16:33:35 +08:00
lockd Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
minix fs/minix: remove expected error message in block_to_path() 2021-03-16 16:34:21 +08:00
nfs NFSv4.2: support EXCHGID4_FLAG_SUPP_FENCE_OPS 4.2 EXCHANGE_ID flag 2021-03-16 16:40:07 +08:00
nfs_common Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
nfsd NFSD: Add missing NFSv2 .pc_func methods 2021-03-16 16:40:07 +08:00
nilfs2 nilfs2: fix null pointer dereference at nilfs_segctor_do_construct() 2021-03-16 16:29:04 +08:00
nls Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
notify fanotify: fix ignore mask logic for events on child and on dir 2021-03-16 16:28:58 +08:00
ntfs ntfs: add check for mft record size in superblock 2021-03-16 16:39:16 +08:00
ocfs2 ocfs2: initialize ip_next_orphan 2021-03-16 16:40:55 +08:00
omfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
openpromfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
orangefs orangefs: get rid of knob code... 2021-03-16 16:34:10 +08:00
overlayfs ovl: fix unneeded call to ovl_change_flags() 2021-03-16 16:32:10 +08:00
proc proc: use untagged_addr() for pagemap_read addresses 2021-03-16 16:42:14 +08:00
pstore pstore: Fix linking when crypto API disabled 2021-03-16 16:33:55 +08:00
qnx4 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
qnx6 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
quota quota: clear padding in v2r1_mem2diskdqb() 2021-03-16 16:38:41 +08:00
ramfs ramfs: fix nommu mmap with gaps in the page cache 2021-03-16 16:38:58 +08:00
reiserfs reiserfs: Fix memory leak in reiserfs_parse_options() 2021-03-16 16:39:23 +08:00
romfs romfs: fix uninitialized memory leak in romfs_dev_read() 2021-03-16 16:34:28 +08:00
squashfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sysfs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sysv Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tracefs Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ubifs ubifs: mount_ubifs: Release authentication resource in error handling path 2021-03-16 16:40:08 +08:00
udf udf: Fix memory leak when mounting 2021-03-16 16:40:04 +08:00
ufs fs/ufs: avoid potential u32 multiplication overflow 2021-03-16 16:34:21 +08:00
unicode Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
verity Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
xfs xfs: revert "xfs: fix rmap key and record comparison functions" 2021-03-16 16:41:23 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Kconfig.binfmt Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
aio.c aio: fix async fsync creds 2021-03-16 16:28:58 +08:00
anon_inodes.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
attr.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
bad_inode.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
binfmt_aout.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
binfmt_elf.c fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() 2021-03-16 16:28:37 +08:00
binfmt_elf_fdpic.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
binfmt_em86.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
binfmt_flat.c binfmt_flat: revert "binfmt_flat: don't offset the data start" 2021-03-16 16:34:43 +08:00
binfmt_misc.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
binfmt_script.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
block_dev.c bdev: Reduce time holding bd_mutex in sync in blkdev_close() 2021-03-16 16:37:13 +08:00
buffer.c fs: Don't invalidate page buffers in block_write_full_page() 2021-03-16 16:39:56 +08:00
char_dev.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
compat.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
compat_binfmt_elf.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
compat_ioctl.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
coredump.c coredump: fix core_pattern parse error 2021-03-16 16:42:04 +08:00
d_path.c fs: fix NULL dereference due to data race in prepend_path() 2021-03-16 16:38:47 +08:00
dax.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dcache.c fix dget_parent() fastpath race 2021-03-16 16:36:39 +08:00
dcookies.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
direct-io.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
drop_caches.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
eventfd.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
eventpoll.c ep_create_wakeup_source(): dentry name can change under you... 2021-03-16 16:37:52 +08:00
exec.c mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race 2021-03-16 16:39:40 +08:00
fcntl.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fhandle.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
file.c fix multiplication overflow in copy_fdtable() 2021-03-16 16:28:07 +08:00
file_table.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
filesystems.c fs/filesystems.c: downgrade user-reachable WARN_ONCE() to pr_warn_once() 2021-03-16 16:26:14 +08:00
fs-writeback.c writeback: Fix sync livelock due to b_dirty_time processing 2021-03-16 16:35:12 +08:00
fs_context.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fs_parser.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fs_pin.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fs_struct.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fs_types.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
fsopen.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
inode.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
internal.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
io_uring.c io_uring: Fix double list add in io_queue_async_work() 2021-03-16 16:37:53 +08:00
ioctl.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
libfs.c libfs: fix error cast of negative value in simple_attr_write() 2021-03-16 16:41:24 +08:00
locks.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mbcache.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mount.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mpage.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
namei.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
namespace.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
no-block.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
nsfs.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
open.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pipe.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
pnode.c propagate_one(): mnt_set_mountpoint() needs mount_lock 2021-03-16 16:27:06 +08:00
pnode.h Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
posix_acl.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
proc_namespace.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
read_write.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
readdir.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
select.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
seq_file.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
signalfd.c fs/signalfd.c: fix inconsistent return codes for signalfd4 2021-03-16 16:34:34 +08:00
splice.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
stack.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
stat.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
statfs.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
super.c vfs: remove lockdep bogosity in __sb_start_write 2021-03-16 16:41:11 +08:00
sync.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
timerfd.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
userfaultfd.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
utimes.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
xattr.c xattr: break delegations in {set,remove}xattr 2021-03-16 16:33:08 +08:00