From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2EE69C04AA7 for ; Mon, 13 May 2019 18:11:46 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id E65272086A for ; Mon, 13 May 2019 18:11:45 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=synopsys.com header.i=@synopsys.com header.b="CKvKqUge" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726357AbfEMSLo (ORCPT ); Mon, 13 May 2019 14:11:44 -0400 Received: from dc8-smtprelay2.synopsys.com ([198.182.47.102]:48602 "EHLO smtprelay-out1.synopsys.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726107AbfEMSLn (ORCPT ); Mon, 13 May 2019 14:11:43 -0400 Received: from mailhost.synopsys.com (badc-mailhost1.synopsys.com [10.192.0.17]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)) (No client certificate requested) by smtprelay-out1.synopsys.com (Postfix) with ESMTPS id 1357CC01E3; Mon, 13 May 2019 18:11:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=synopsys.com; s=mail; t=1557771108; bh=pGSKux1p55Pb1d120mTxSJIOc007D5yWWyT9ySgtwes=; h=Subject:To:CC:References:From:Date:In-Reply-To:From; b=CKvKqUgeHez7daT5sXOXxrcP+pHxoFEWyAx44ob9GmmHj/fDcNC5Tj+4hg1GMypNV gXyDC12WneIGX2BMIdjdRg/emYo5KHJu5+zKbbA8o7iLZjaPQzYO+hR9CnM5j4Eypo ggnWyknkUqFXfV6IdrfblzfnyeyfQCh4fwX+56awFpaW6dmeTQR40cq9GKM1iU9Mfm R4ZBdo16S2ARmgSU+ngAK33i6Ze9p6h6AsFtcdIoWWi0FG6I5Sc/OIqFOU5av60C5J RyU+2BrWTfC0fYRoblKVIMQ03XzHGYzHs3jZ1nRcJCI5+8sq+vsCe2XsJ1QGDo5zWR rT/dtYf5Sxp6Q== Received: from US01WEHTC3.internal.synopsys.com (us01wehtc3.internal.synopsys.com [10.15.84.232]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by mailhost.synopsys.com (Postfix) with ESMTPS id 75FFCA005A; Mon, 13 May 2019 18:11:41 +0000 (UTC) Received: from IN01WEHTCA.internal.synopsys.com (10.144.199.104) by US01WEHTC3.internal.synopsys.com (10.15.84.232) with Microsoft SMTP Server (TLS) id 14.3.408.0; Mon, 13 May 2019 11:11:41 -0700 Received: from IN01WEHTCB.internal.synopsys.com (10.144.199.105) by IN01WEHTCA.internal.synopsys.com (10.144.199.103) with Microsoft SMTP Server (TLS) id 14.3.408.0; Mon, 13 May 2019 23:41:52 +0530 Received: from [10.10.161.89] (10.10.161.89) by IN01WEHTCB.internal.synopsys.com (10.144.199.243) with Microsoft SMTP Server (TLS) id 14.3.408.0; Mon, 13 May 2019 23:41:39 +0530 Subject: Re: [PATCH v2] ARC: Send SIGSEGV if userspace process accesses kernel virtual memory To: Eugeniy Paltsev , CC: , Alexey Brodkin Newsgroups: gmane.linux.kernel,gmane.linux.kernel.arc References: <20190513172800.27940-1-Eugeniy.Paltsev@synopsys.com> From: Vineet Gupta Openpgp: preference=signencrypt Autocrypt: addr=vgupta@synopsys.com; keydata= mQINBFEffBMBEADIXSn0fEQcM8GPYFZyvBrY8456hGplRnLLFimPi/BBGFA24IR+B/Vh/EFk B5LAyKuPEEbR3WSVB1x7TovwEErPWKmhHFbyugdCKDv7qWVj7pOB+vqycTG3i16eixB69row lDkZ2RQyy1i/wOtHt8Kr69V9aMOIVIlBNjx5vNOjxfOLux3C0SRl1veA8sdkoSACY3McOqJ8 zR8q1mZDRHCfz+aNxgmVIVFN2JY29zBNOeCzNL1b6ndjU73whH/1hd9YMx2Sp149T8MBpkuQ cFYUPYm8Mn0dQ5PHAide+D3iKCHMupX0ux1Y6g7Ym9jhVtxq3OdUI5I5vsED7NgV9c8++baM 7j7ext5v0l8UeulHfj4LglTaJIvwbUrCGgtyS9haKlUHbmey/af1j0sTrGxZs1ky1cTX7yeF nSYs12GRiVZkh/Pf3nRLkjV+kH++ZtR1GZLqwamiYZhAHjo1Vzyl50JT9EuX07/XTyq/Bx6E dcJWr79ZphJ+mR2HrMdvZo3VSpXEgjROpYlD4GKUApFxW6RrZkvMzuR2bqi48FThXKhFXJBd JiTfiO8tpXaHg/yh/V9vNQqdu7KmZIuZ0EdeZHoXe+8lxoNyQPcPSj7LcmE6gONJR8ZqAzyk F5voeRIy005ZmJJ3VOH3Gw6Gz49LVy7Kz72yo1IPHZJNpSV5xwARAQABtCpWaW5lZXQgR3Vw dGEgKGFsaWFzKSA8dmd1cHRhQHN5bm9wc3lzLmNvbT6JAj4EEwECACgCGwMGCwkIBwMCBhUI AgkKCwQWAgMBAh4BAheABQJbBYpwBQkLx0HcAAoJEGnX8d3iisJeChAQAMR2UVbJyydOv3aV jmqP47gVFq4Qml1weP5z6czl1I8n37bIhdW0/lV2Zll+yU1YGpMgdDTHiDqnGWi4pJeu4+c5 xsI/VqkH6WWXpfruhDsbJ3IJQ46//jb79ogjm6VVeGlOOYxx/G/RUUXZ12+CMPQo7Bv+Jb+t NJnYXYMND2Dlr2TiRahFeeQo8uFbeEdJGDsSIbkOV0jzrYUAPeBwdN8N0eOB19KUgPqPAC4W HCg2LJ/o6/BImN7bhEFDFu7gTT0nqFVZNXlOw4UcGGpM3dq/qu8ZgRE0turY9SsjKsJYKvg4 djAaOh7H9NJK72JOjUhXY/sMBwW5vnNwFyXCB5t4ZcNxStoxrMtyf35synJVinFy6wCzH3eJ XYNfFsv4gjF3l9VYmGEJeI8JG/ljYQVjsQxcrU1lf8lfARuNkleUL8Y3rtxn6eZVtAlJE8q2 hBgu/RUj79BKnWEPFmxfKsaj8of+5wubTkP0I5tXh0akKZlVwQ3lbDdHxznejcVCwyjXBSny d0+qKIXX1eMh0/5sDYM06/B34rQyq9HZVVPRHdvsfwCU0s3G+5Fai02mK68okr8TECOzqZtG cuQmkAeegdY70Bpzfbwxo45WWQq8dSRURA7KDeY5LutMphQPIP2syqgIaiEatHgwetyVCOt6 tf3ClCidHNaGky9KcNSQuQINBFEffBMBEADXZ2pWw4Regpfw+V+Vr6tvZFRl245PV9rWFU72 xNuvZKq/WE3xMu+ZE7l2JKpSjrEoeOHejtT0cILeQ/Yhf2t2xAlrBLlGOMmMYKK/K0Dc2zf0 MiPRbW/NCivMbGRZdhAAMx1bpVhInKjU/6/4mT7gcE57Ep0tl3HBfpxCK8RRlZc3v8BHOaEf cWSQD7QNTZK/kYJo+Oyux+fzyM5TTuKAaVE63NHCgWtFglH2vt2IyJ1XoPkAMueLXay6enSK Nci7qAG2UwicyVDCK9AtEub+ps8NakkeqdSkDRp5tQldJbfDaMXuWxJuPjfSojHIAbFqP6Qa ANXvTCSuBgkmGZ58skeNopasrJA4z7OsKRUBvAnharU82HGemtIa4Z83zotOGNdaBBOHNN2M HyfGLm+kEoccQheH+my8GtbH1a8eRBtxlk4c02ONkq1Vg1EbIzvgi4a56SrENFx4+4sZcm8o ItShAoKGIE/UCkj/jPlWqOcM/QIqJ2bR8hjBny83ONRf2O9nJuEYw9vZAPFViPwWG8tZ7J+R euXKai4DDr+8oFOi/40mIDe/Bat3ftyd+94Z1RxDCngd3Q85bw13t2ttNLw5eHufLIpoEyAh TCLNQ58eT91YGVGvFs39IuH0b8ovVvdkKGInCT59Vr0MtfgcsqpDxWQXJXYZYTFHd3/RswAR AQABiQIlBBgBAgAPAhsMBQJbBYpwBQkLx0HdAAoJEGnX8d3iisJewe8P/36pkZrVTfO+U+Gl 1OQh4m6weozuI8Y98/DHLMxEujKAmRzy+zMHYlIl3WgSih1UMOZ7U84yVZQwXQkLItcwXoih ChKD5D2BKnZYEOLM+7f9DuJuWhXpee80aNPzEaubBYQ7dYt8rcmB7SdRz/yZq3lALOrF/zb6 SRleBh0DiBLP/jKUV74UAYV3OYEDHN9blvhWUEFFE0Z+j96M4/kuRdxvbDmp04Nfx79AmJEn fv1Vvc9CFiWVbBrNPKomIN+JV7a7m2lhbfhlLpUk0zGFDTWcWejl4qz/pCYSoIUU4r/VBsCV ZrOun4vd4cSi/yYJRY4kaAJGCL5k7qhflL2tgldUs+wERH8ZCzimWVDBzHTBojz0Ff3w2+gY 6FUbAJBrBZANkymPpdAB/lTsl8D2ZRWyy90f4VVc8LB/QIWY/GiS2towRXQBjHOfkUB1JiEX YH/i93k71mCaKfzKGXTVxObU2I441w7r4vtNlu0sADRHCMUqHmkpkjV1YbnYPvBPFrDBS1V9 OfD9SutXeDjJYe3N+WaLRp3T3x7fYVnkfjQIjDSOdyPWlTzqQv0I3YlUk7KjFrh1rxtrpoYS IQKf5HuMowUNtjyiK2VhA5V2XDqd+ZUT3RqfAPf3Y5HjkhKJRqoIDggUKMUKmXaxCkPGi91T hhqBJlyU6MVUa6vZNv8E Message-ID: <771bef88-7691-18d4-76a7-6d6eafcc1b37@synopsys.com> Date: Mon, 13 May 2019 11:11:35 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Thunderbird/60.6.1 MIME-Version: 1.0 In-Reply-To: <20190513172800.27940-1-Eugeniy.Paltsev@synopsys.com> Content-Type: text/plain; charset="utf-8" Content-Language: en-US Content-Transfer-Encoding: 7bit X-Originating-IP: [10.10.161.89] Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 5/13/19 10:28 AM, Eugeniy Paltsev wrote: > As of today if userspace process tries to access address which belongs > to kernel virtual memory area and kernel have mapping for this address > that process hangs instead of receiving SIGSEGV and being killed. > > Steps to reproduce: > Create userspace application which reads from the beginning of > kernel-space virtual memory area (I.E. read from 0x7000_0000 on most > of existing platforms): > ------------------------>8----------------- > #include > #include > > int main(int argc, char *argv[]) > { > volatile uint32_t temp; > > temp = *(uint32_t *)(0x70000000); > } > ------------------------>8----------------- > That application hangs after such memory access. > > Fix that by checking which access (user or kernel) caused the exception > before handling kernel virtual address fault. > > Fix that by checking that VMALLOC_FAULT was caused in kernel mode > before trying to handle it. Merge both the line above, say ... "Ensure that kernel virtual addresses are only handled for faults in kernel mode" > Thus we can use @no_context label, removing the need for > @bad_area_nosemaphore and untangling the code mess a bit. Say ... "And while we are here, remove @bad_area_nosemaphore label, untangling the code mess a bit" > > Cc: # 4.20+ Why just 4.20, this needs to go back as far as possible ! > Signed-off-by: Vineet Gupta > Signed-off-by: Eugeniy Paltsev > --- > arch/arc/mm/fault.c | 9 +++------ > 1 file changed, 3 insertions(+), 6 deletions(-) > > diff --git a/arch/arc/mm/fault.c b/arch/arc/mm/fault.c > index 8df1638259f3..6836095251ed 100644 > --- a/arch/arc/mm/fault.c > +++ b/arch/arc/mm/fault.c > @@ -66,7 +66,7 @@ void do_page_fault(unsigned long address, struct pt_regs *regs) > struct vm_area_struct *vma = NULL; > struct task_struct *tsk = current; > struct mm_struct *mm = tsk->mm; > - int si_code = 0; > + int si_code = SEGV_MAPERR; > int ret; > vm_fault_t fault; > int write = regs->ecr_cause & ECR_C_PROTV_STORE; /* ST/EX */ > @@ -81,16 +81,14 @@ void do_page_fault(unsigned long address, struct pt_regs *regs) > * only copy the information from the master page table, > * nothing more. > */ > - if (address >= VMALLOC_START) { > + if (address >= VMALLOC_START && !user_mode(regs)) { > ret = handle_kernel_vaddr_fault(address); > if (unlikely(ret)) > - goto bad_area_nosemaphore; > + goto no_context; > else > return; > } > > - si_code = SEGV_MAPERR; > - > /* > * If we're in an interrupt or have no user > * context, we must not take the fault.. > @@ -198,7 +196,6 @@ void do_page_fault(unsigned long address, struct pt_regs *regs) > bad_area: > up_read(&mm->mmap_sem); > > -bad_area_nosemaphore: > /* User mode accesses just cause a SIGSEGV */ > if (user_mode(regs)) { > tsk->thread.fault_address = address; >