On Thu, May 3, 2018 at 5:24 PM, Kirill A. Shutemov <kirill@xxxxxxxxxxxxx> wrote: > On Thu, May 03, 2018 at 04:09:56PM +0200, Andrey Konovalov wrote: >> On Wed, May 2, 2018 at 7:25 PM, Andrey Konovalov <andreyknvl@xxxxxxxxxx> wrote: >> I wasn't able to find anything that calls follow_page with pointers >> passed from userspace except for the memory subsystem syscalls, and we >> deliberately don't add untagging in those. > > I guess I missed this part, but could you elaborate on this? Why? > Not yet or not ever? Check out the discussion here: https://www.spinics.net/lists/arm-kernel/msg640936.html > > Also I wounder if we can find (with sparse?) all places where we cast out > __user. This would give a nice list of places where to pay attention. The way I tested this is I added BUG_ON(top byte tag is set) to find_vma and find_extend_vma and ran a modified version of syzkaller that embeds tags into pointers overnight. The only crashes that I saw were coming from memory subsystem syscalls. I then temporarily added untagging to suppress those crashes (https://gist.github.com/xairy/3aa1f57798fa62522c8ac53fad9b74ca), and didn't see any crashes after that.
