From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4B869C433E1 for ; Mon, 29 Jun 2020 19:55:44 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2DB9120674 for ; Mon, 29 Jun 2020 19:55:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1593460544; bh=KGTxbpDBwea5FTUqlV3d9WT6LzTHKFm5813Edct4Qfg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=AHGhulLB91nVvLSr7P50xxwCcKJhQpGJUYSCxUDaq3MNCiwwCk287iO/DW+5xafoK pcX4uLCq5yLdPr8HXEOV2raSs+/AcfUk7sm7ylBLL1gQl+1E3wsfElA3nthHrsrDaX r9N+jW7hJTkxVt/RKFbrKBVhwqLYwM85WljEXSqE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731786AbgF2Tzn (ORCPT ); Mon, 29 Jun 2020 15:55:43 -0400 Received: from mail.kernel.org ([198.145.29.99]:47682 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387659AbgF2TkY (ORCPT ); Mon, 29 Jun 2020 15:40:24 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 2996E248EC; Mon, 29 Jun 2020 15:27:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1593444458; bh=KGTxbpDBwea5FTUqlV3d9WT6LzTHKFm5813Edct4Qfg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rgbblNd8Bw8uHBJqAm+PtoCljh4tcwMiEWrJAYMtfrtAuHBdaWuBn/KHpHONqqwj/ BfYuMnjdmBY1DpZG+CHJ76LP+tp0GuW7ua3u8ftCc4QxSwwpxX0b7En2FzlJMpnVUd IQyOKsDecHx05fEr2TyXnJbEyFgABMryEePSXQlU= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Yash Shah , David Abdurachmanov , Palmer Dabbelt , Sasha Levin Subject: [PATCH 5.4 138/178] RISC-V: Don't allow write+exec only page mapping request in mmap Date: Mon, 29 Jun 2020 11:24:43 -0400 Message-Id: <20200629152523.2494198-139-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200629152523.2494198-1-sashal@kernel.org> References: <20200629152523.2494198-1-sashal@kernel.org> MIME-Version: 1.0 X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.50-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-5.4.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 5.4.50-rc1 X-KernelTest-Deadline: 2020-07-01T15:25+00:00 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Yash Shah [ Upstream commit e0d17c842c0f824fd4df9f4688709fc6907201e1 ] As per the table 4.4 of version "20190608-Priv-MSU-Ratified" of the RISC-V instruction set manual[0], the PTE permission bit combination of "write+exec only" is reserved for future use. Hence, don't allow such mapping request in mmap call. An issue is been reported by David Abdurachmanov, that while running stress-ng with "sysbadaddr" argument, RCU stalls are observed on RISC-V specific kernel. This issue arises when the stress-sysbadaddr request for pages with "write+exec only" permission bits and then passes the address obtain from this mmap call to various system call. For the riscv kernel, the mmap call should fail for this particular combination of permission bits since it's not valid. [0]: http://dabbelt.com/~palmer/keep/riscv-isa-manual/riscv-privileged-20190608-1.pdf Signed-off-by: Yash Shah Reported-by: David Abdurachmanov [Palmer: Refer to the latest ISA specification at the only link I could find, and update the terminology.] Signed-off-by: Palmer Dabbelt Signed-off-by: Sasha Levin --- arch/riscv/kernel/sys_riscv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c index f3619f59d85cc..12f8a7fce78b1 100644 --- a/arch/riscv/kernel/sys_riscv.c +++ b/arch/riscv/kernel/sys_riscv.c @@ -8,6 +8,7 @@ #include #include #include +#include static long riscv_sys_mmap(unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, @@ -16,6 +17,11 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len, { if (unlikely(offset & (~PAGE_MASK >> page_shift_offset))) return -EINVAL; + + if ((prot & PROT_WRITE) && (prot & PROT_EXEC)) + if (unlikely(!(prot & PROT_READ))) + return -EINVAL; + return ksys_mmap_pgoff(addr, len, prot, flags, fd, offset >> (PAGE_SHIFT - page_shift_offset)); } -- 2.25.1