Powered by Linux
[RFC PATCH 0/7] Tagged Pointer Detection — Semantic Matching Tool

[RFC PATCH 0/7] Tagged Pointer Detection

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


The ARM64 ABI allows tagged memory addresses to be passed through the
user-kernel syscall ABI boundary. Tagged memory addresses are those which
contain a non-zero top byte - the hardware will always ignore this top
byte, however software does not. This series provides smatch detection
to detect code that erroneously compares tagged memory addresses with
untagged memory addresses.

This current approach will provide a Smatch warning when it detects a
comparison is being made between a user originated 64 bit data where the
top byte may be non-zero and any variable which may contain an 'untagged

'Untagged addresses' are detected by looking for hard-coded known struct
members (such as vm_start, vm_end and addr_limit) and hard-coded known
macros (such as PAGE_SIZE, PAGE_MASK and TASK_SIZE). This check is
also able to detect when comparisons are made against variables that
have been assigned from these known untagged variables, though this
tracking is limited to the scope of the function.

The warnings produced indicate the point of comparison, yet it is more
helpful to walk up the call tree to find where the source of data
originated from. This series also updates the smdb.py script to assist
with this.

To avoid false-warnings, we also introduce the concept of a __untagged
(address space) annotation - when this is applied to a function argument
we tell Smatch not to treat this as a tagged user-orginated address. We
don't use this annotation to suppress warnings, however the smdb.py script
will filter out call trees where all parents do not contain tagged
user-orginated addresses.

There are limitations with this approach, however I'm keen to understand
if there are solutions for them. I'll reply to the individual patches with
my thoughts.

Andrew Murray (7):
  build: Add '-lm' build flag
  smdb.py: remove undocumented test command
  arm64: add check for comparison against tagged address
  smdb.py: add find_tagged and parse_warns_tagged commands
  kernel_user_data: track parameter __untagged annotations
  smdb.py: filter out __untagged from find_tagged results
  Documentation: add guide for tagged addresses

 .../arm64-detecting-tagged-addresses.txt      | 207 ++++++++++++++
 Makefile                                      |   2 +-
 check_arm64_tagged.c                          | 255 ++++++++++++++++++
 check_list.h                                  |   2 +
 smatch_data/db/smdb.py                        | 115 +++++++-
 smatch_estate.c                               |  22 ++
 smatch_extra.h                                |   3 +
 smatch_kernel_user_data.c                     |  71 ++++-
 8 files changed, 662 insertions(+), 15 deletions(-)
 create mode 100644 Documentation/arm64-detecting-tagged-addresses.txt
 create mode 100644 check_arm64_tagged.c


[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Big List of Linux Books]

  Powered by Linux