This is a note to let you know that I've just added the patch titled
arm64: mte: Do not set PG_mte_tagged if tags were not initialized
to the 6.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
arm64-mte-do-not-set-pg_mte_tagged-if-tags-were-not-initialized.patch
and it can be found in the queue-6.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From c4c597f1b367433c52c531dccd6859a39b4580fb Mon Sep 17 00:00:00 2001
From: Peter Collingbourne <pcc@xxxxxxxxxx>
Date: Thu, 20 Apr 2023 14:43:27 -0700
Subject: arm64: mte: Do not set PG_mte_tagged if tags were not initialized
From: Peter Collingbourne <pcc@xxxxxxxxxx>
commit c4c597f1b367433c52c531dccd6859a39b4580fb upstream.
The mte_sync_page_tags() function sets PG_mte_tagged if it initializes
page tags. Then we return to mte_sync_tags(), which sets PG_mte_tagged
again. At best, this is redundant. However, it is possible for
mte_sync_page_tags() to return without having initialized tags for the
page, i.e. in the case where check_swap is true (non-compound page),
is_swap_pte(old_pte) is false and pte_is_tagged is false. So at worst,
we set PG_mte_tagged on a page with uninitialized tags. This can happen
if, for example, page migration causes a PTE for an untagged page to
be replaced. If the userspace program subsequently uses mprotect() to
enable PROT_MTE for that page, the uninitialized tags will be exposed
to userspace.
Fix it by removing the redundant call to set_page_mte_tagged().
Fixes: e059853d14ca ("arm64: mte: Fix/clarify the PG_mte_tagged semantics")
Signed-off-by: Peter Collingbourne <pcc@xxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx> # 6.1
Link: https://linux-review.googlesource.com/id/Ib02d004d435b2ed87603b858ef7480f7b1463052
Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx>
Reviewed-by: Alexandru Elisei <alexandru.elisei@xxxxxxx>
Link: https://lore.kernel.org/r/20230420214327.2357985-1-pcc@xxxxxxxxxx
Signed-off-by: Will Deacon <will@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/arm64/kernel/mte.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/arch/arm64/kernel/mte.c
+++ b/arch/arm64/kernel/mte.c
@@ -66,13 +66,10 @@ void mte_sync_tags(pte_t old_pte, pte_t
return;
/* if PG_mte_tagged is set, tags have already been initialised */
- for (i = 0; i < nr_pages; i++, page++) {
- if (!page_mte_tagged(page)) {
+ for (i = 0; i < nr_pages; i++, page++)
+ if (!page_mte_tagged(page))
mte_sync_page_tags(page, old_pte, check_swap,
pte_is_tagged);
- set_page_mte_tagged(page);
- }
- }
/* ensure the tags are visible before the PTE is set */
smp_wmb();
Patches currently in stable-queue which might be from pcc@xxxxxxxxxx are
queue-6.3/arm64-mte-do-not-set-pg_mte_tagged-if-tags-were-not-initialized.patch
queue-6.3/arm64-also-reset-kasan-tag-if-page-is-not-pg_mte_tagged.patch
