Patch "arm64: mm: kfence: only handle translation faults" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    arm64: mm: kfence: only handle translation faults

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     arm64-mm-kfence-only-handle-translation-faults.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 3c7178d068962382789f82da493a92742c6f4768
Author: Mark Rutland <mark.rutland@xxxxxxx>
Date:   Mon Nov 14 10:44:11 2022 +0000

    arm64: mm: kfence: only handle translation faults
    
    [ Upstream commit 0bb1fbffc631064db567ccaeb9ed6b6df6342b66 ]
    
    Alexander noted that KFENCE only expects to handle faults from invalid page
    table entries (i.e. translation faults), but arm64's fault handling logic will
    call kfence_handle_page_fault() for other types of faults, including alignment
    faults caused by unaligned atomics. This has the unfortunate property of
    causing those other faults to be reported as "KFENCE: use-after-free",
    which is misleading and hinders debugging.
    
    Fix this by only forwarding unhandled translation faults to the KFENCE
    code, similar to what x86 does already.
    
    Alexander has verified that this passes all the tests in the KFENCE test
    suite and avoids bogus reports on misaligned atomics.
    
    Link: https://lore.kernel.org/all/20221102081620.1465154-1-zhongbaisong@xxxxxxxxxx/
    Fixes: 840b23986344 ("arm64, kfence: enable KFENCE for ARM64")
    Signed-off-by: Mark Rutland <mark.rutland@xxxxxxx>
    Reviewed-by: Alexander Potapenko <glider@xxxxxxxxxx>
    Tested-by: Alexander Potapenko <glider@xxxxxxxxxx>
    Cc: Catalin Marinas <catalin.marinas@xxxxxxx>
    Cc: Marco Elver <elver@xxxxxxxxxx>
    Cc: Will Deacon <will@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20221114104411.2853040-1-mark.rutland@xxxxxxx
    Signed-off-by: Will Deacon <will@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index e38e7dc0f8f5..d09b21faa0b2 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -350,6 +350,11 @@ static bool is_el1_mte_sync_tag_check_fault(unsigned long esr)
 	return false;
 }
 
+static bool is_translation_fault(unsigned long esr)
+{
+	return (esr & ESR_ELx_FSC_TYPE) == ESR_ELx_FSC_FAULT;
+}
+
 static void __do_kernel_fault(unsigned long addr, unsigned long esr,
 			      struct pt_regs *regs)
 {
@@ -382,7 +387,8 @@ static void __do_kernel_fault(unsigned long addr, unsigned long esr,
 	} else if (addr < PAGE_SIZE) {
 		msg = "NULL pointer dereference";
 	} else {
-		if (kfence_handle_page_fault(addr, esr & ESR_ELx_WNR, regs))
+		if (is_translation_fault(esr) &&
+		    kfence_handle_page_fault(addr, esr & ESR_ELx_WNR, regs))
 			return;
 
 		msg = "paging request";