On Wed, Mar 29, 2023 at 05:22:49PM +0100, Catalin Marinas wrote:
> On Tue, Mar 28, 2023 at 12:48:08PM -0400, Gregory Price wrote:
> > diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
> > index 5c7b2f9d5913..1a51a54f264f 100644
> > --- a/arch/arm64/include/asm/uaccess.h
> > +++ b/arch/arm64/include/asm/uaccess.h
> > @@ -35,7 +35,9 @@ static inline int __access_ok(const void __user *ptr, unsigned long size);
> > * This is equivalent to the following test:
> > * (u65)addr + (u65)size <= (u65)TASK_SIZE_MAX
> > */
> > -static inline int access_ok(const void __user *addr, unsigned long size)
> > +static inline int task_access_ok(struct task_struct *task,
> > + const void __user *addr,
> > + unsigned long size)
> > {
> > /*
> > * Asynchronous I/O running in a kernel thread does not have the
> > @@ -43,11 +45,18 @@ static inline int access_ok(const void __user *addr, unsigned long size)
> > * the user address before checking.
> > */
> > if (IS_ENABLED(CONFIG_ARM64_TAGGED_ADDR_ABI) &&
> > - (current->flags & PF_KTHREAD || test_thread_flag(TIF_TAGGED_ADDR)))
> > + (task->flags & PF_KTHREAD || test_ti_thread_flag(task, TIF_TAGGED_ADDR)))
> > addr = untagged_addr(addr);
> >
> > return likely(__access_ok(addr, size));
> > }
> > +
> > +static inline int access_ok(const void __user *addr, unsigned long size)
> > +{
> > + return task_access_ok(current, addr, size);
> > +}
> > +
> > +#define task_access_ok task_access_ok
>
> I'd not bother with this at all. In the generic code you can either do
> an __access_ok() check directly or just
> access_ok(untagged_addr(selector), ...) with a comment that address
> tagging of the ptraced task may not be enabled.
>
> --
> Catalin
This was my original proposal, but the comment that lead to this patch
was the following:
"""
If this would be correct, then access_ok() on arm64 would
unconditionally untag the checked address, but it does not. Simply
because untagging is only valid if the task enabled pointer tagging. If
it didn't a tagged pointer is obviously invalid.
Why would ptrace make this suddenly valid?
"""
https://lore.kernel.org/all/87a605anvx.ffs@tglx/
I did not have a sufficient answer for this so I went down this path.
It does seem simpler to simply untag the address, however it didn't seem
like a good solution to simply leave an identified bad edge case.
with access_ok(untagged_addr(addr), ...) it breaks down like this:
(tracer,tracee) : result
tag,tag : untagged - (correct)
tag,untag : untagged - incorrect as this would have been an impossible
state to reach through the standard prctl interface. Will
lead to a SIGSEGV in the tracee upon next syscall
untag,tag : untagged - (correct)
untag,untag : no-op - (correct), tagged address will fail to set
Basically if the tracer is a tagged process while the tracee is not, it
would become possible to set the tracee's selector to a tagged pointer.
It's beyond me to say whether or not this situation is "ok" and "the
user's fault", but it does feel like an addressable problem.
Thoughts?
~Gregory
