Messages in this thread | | | From | Andrey Konovalov <> | Date | Thu, 3 May 2018 18:51:14 +0200 | Subject | Re: [PATCH 4/6] mm, arm64: untag user addresses in mm/gup.c |
| |
On Thu, May 3, 2018 at 5:24 PM, Kirill A. Shutemov <kirill@shutemov.name> wrote: > On Thu, May 03, 2018 at 04:09:56PM +0200, Andrey Konovalov wrote: >> On Wed, May 2, 2018 at 7:25 PM, Andrey Konovalov <andreyknvl@google.com> wrote:
>> I wasn't able to find anything that calls follow_page with pointers >> passed from userspace except for the memory subsystem syscalls, and we >> deliberately don't add untagging in those. > > I guess I missed this part, but could you elaborate on this? Why? > Not yet or not ever?
Check out the discussion here: https://www.spinics.net/lists/arm-kernel/msg640936.html
> > Also I wounder if we can find (with sparse?) all places where we cast out > __user. This would give a nice list of places where to pay attention.
The way I tested this is I added BUG_ON(top byte tag is set) to find_vma and find_extend_vma and ran a modified version of syzkaller that embeds tags into pointers overnight. The only crashes that I saw were coming from memory subsystem syscalls. I then temporarily added untagging to suppress those crashes (https://gist.github.com/xairy/3aa1f57798fa62522c8ac53fad9b74ca), and didn't see any crashes after that.
| |