On Sat, 23 Apr 2022 11:07:49 +0100 Catalin Marinas <catalin.marinas@xxxxxxx> wrote:
> On hardware with features like arm64 MTE or SPARC ADI, an access fault
> can be triggered at sub-page granularity. Depending on how the
> fault_in_writeable() function is used, the caller can get into a
> live-lock by continuously retrying the fault-in on an address different
> from the one where the uaccess failed.
>
> In the majority of cases progress is ensured by the following
> conditions:
>
> 1. copy_to_user_nofault() guarantees at least one byte access if the
> user address is not faulting.
>
> 2. The fault_in_writeable() loop is resumed from the first address that
> could not be accessed by copy_to_user_nofault().
>
> If the loop iteration is restarted from an earlier (initial) point, the
> loop is repeated with the same conditions and it would live-lock.
>
> Introduce an arch-specific probe_subpage_writeable() and call it from
> the newly added fault_in_subpage_writeable() function. The arch code
> with sub-page faults will have to implement the specific probing
> functionality.
>
> Note that no other fault_in_subpage_*() functions are added since they
> have no callers currently susceptible to a live-lock.
>
> ...
>
> --- a/include/linux/uaccess.h
> +++ b/include/linux/uaccess.h
> @@ -231,6 +231,28 @@ static inline bool pagefault_disabled(void)
> */
> #define faulthandler_disabled() (pagefault_disabled() || in_atomic())
>
> +#ifndef CONFIG_ARCH_HAS_SUBPAGE_FAULTS
> +
> +/**
> + * probe_subpage_writeable: probe the user range for write faults at sub-page
> + * granularity (e.g. arm64 MTE)
> + * @uaddr: start of address range
> + * @size: size of address range
> + *
> + * Returns 0 on success, the number of bytes not probed on fault.
> + *
> + * It is expected that the caller checked for the write permission of each
> + * page in the range either by put_user() or GUP. The architecture port can
> + * implement a more efficient get_user() probing if the same sub-page faults
> + * are triggered by either a read or a write.
> + */
> +static inline size_t probe_subpage_writeable(void __user *uaddr, size_t size)
It's `char __user *' at the other definition.
> +{
> + return 0;
> +}
> +
> +#endif /* CONFIG_ARCH_HAS_SUBPAGE_FAULTS */
> +
> #ifndef ARCH_HAS_NOCACHE_UACCESS
>
> ...
>
