lkml.org 
[lkml]   [2023]   [Mar]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v14 1/4] asm-generic,arm64: create task variant of access_ok
    On Wed, Mar 29, 2023 at 05:22:49PM +0100, Catalin Marinas wrote:
    > On Tue, Mar 28, 2023 at 12:48:08PM -0400, Gregory Price wrote:
    > > diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
    > > index 5c7b2f9d5913..1a51a54f264f 100644
    > > --- a/arch/arm64/include/asm/uaccess.h
    > > +++ b/arch/arm64/include/asm/uaccess.h
    > > @@ -35,7 +35,9 @@ static inline int __access_ok(const void __user *ptr, unsigned long size);
    > > * This is equivalent to the following test:
    > > * (u65)addr + (u65)size <= (u65)TASK_SIZE_MAX
    > > */
    > > -static inline int access_ok(const void __user *addr, unsigned long size)
    > > +static inline int task_access_ok(struct task_struct *task,
    > > + const void __user *addr,
    > > + unsigned long size)
    > > {
    > > /*
    > > * Asynchronous I/O running in a kernel thread does not have the
    > > @@ -43,11 +45,18 @@ static inline int access_ok(const void __user *addr, unsigned long size)
    > > * the user address before checking.
    > > */
    > > if (IS_ENABLED(CONFIG_ARM64_TAGGED_ADDR_ABI) &&
    > > - (current->flags & PF_KTHREAD || test_thread_flag(TIF_TAGGED_ADDR)))
    > > + (task->flags & PF_KTHREAD || test_ti_thread_flag(task, TIF_TAGGED_ADDR)))
    > > addr = untagged_addr(addr);
    > >
    > > return likely(__access_ok(addr, size));
    > > }
    > > +
    > > +static inline int access_ok(const void __user *addr, unsigned long size)
    > > +{
    > > + return task_access_ok(current, addr, size);
    > > +}
    > > +
    > > +#define task_access_ok task_access_ok
    >
    > I'd not bother with this at all. In the generic code you can either do
    > an __access_ok() check directly or just
    > access_ok(untagged_addr(selector), ...) with a comment that address
    > tagging of the ptraced task may not be enabled.
    >
    > --
    > Catalin

    This was my original proposal, but the comment that lead to this patch
    was the following:

    """
    If this would be correct, then access_ok() on arm64 would
    unconditionally untag the checked address, but it does not. Simply
    because untagging is only valid if the task enabled pointer tagging. If
    it didn't a tagged pointer is obviously invalid.

    Why would ptrace make this suddenly valid?
    """

    https://lore.kernel.org/all/87a605anvx.ffs@tglx/

    I did not have a sufficient answer for this so I went down this path.

    It does seem simpler to simply untag the address, however it didn't seem
    like a good solution to simply leave an identified bad edge case.

    with access_ok(untagged_addr(addr), ...) it breaks down like this:

    (tracer,tracee) : result

    tag,tag : untagged - (correct)
    tag,untag : untagged - incorrect as this would have been an impossible
    state to reach through the standard prctl interface. Will
    lead to a SIGSEGV in the tracee upon next syscall
    untag,tag : untagged - (correct)
    untag,untag : no-op - (correct), tagged address will fail to set

    Basically if the tracer is a tagged process while the tracee is not, it
    would become possible to set the tracee's selector to a tagged pointer.

    It's beyond me to say whether or not this situation is "ok" and "the
    user's fault", but it does feel like an addressable problem.

    Thoughts?
    ~Gregory

    \
     
     \ /
      Last update: 2023-03-29 18:49    [W:4.832 / U:0.344 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site