Commit e059853d authored by Catalin Marinas's avatar Catalin Marinas Committed by Marc Zyngier
Browse files

arm64: mte: Fix/clarify the PG_mte_tagged semantics 



Currently the PG_mte_tagged page flag mostly means the page contains
valid tags and it should be set after the tags have been cleared or
restored. However, in mte_sync_tags() it is set before setting the tags
to avoid, in theory, a race with concurrent mprotect(PROT_MTE) for
shared pages. However, a concurrent mprotect(PROT_MTE) with a copy on
write in another thread can cause the new page to have stale tags.
Similarly, tag reading via ptrace() can read stale tags if the
PG_mte_tagged flag is set before actually clearing/restoring the tags.

Fix the PG_mte_tagged semantics so that it is only set after the tags
have been cleared or restored. This is safe for swap restoring into a
MAP_SHARED or CoW page since the core code takes the page lock. Add two
functions to test and set the PG_mte_tagged flag with acquire and
release semantics. The downside is that concurrent mprotect(PROT_MTE) on
a MAP_SHARED page may cause tag loss. This is already the case for KVM
guests if a VMM changes the page protection while the guest triggers a
user_mem_abort().

Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
[pcc@google.com: fix build with CONFIG_ARM64_MTE disabled]
Signed-off-by: default avatarPeter Collingbourne <pcc@google.com>
Reviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
Reviewed-by: default avatarSteven Price <steven.price@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Peter Collingbourne <pcc@google.com>
Signed-off-by: default avatarMarc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20221104011041.290951-3-pcc@google.com
parent b0284cd2

arch/arm64/include/asm/mte.h

+30 −0
Original line number Diff line number Diff line
@@ -37,6 +37,29 @@ void mte_free_tag_storage(char *storage); 
/* track which pages have valid allocation tags */

#define PG_mte_tagged	PG_arch_2



static inline void set_page_mte_tagged(struct page *page)

{

	/*

	 * Ensure that the tags written prior to this function are visible

	 * before the page flags update.

	 */

	smp_wmb();

	set_bit(PG_mte_tagged, &page->flags);

}



static inline bool page_mte_tagged(struct page *page)

{

	bool ret = test_bit(PG_mte_tagged, &page->flags);



	/*

	 * If the page is tagged, ensure ordering with a likely subsequent

	 * read of the tags.

	 */

	if (ret)

		smp_rmb();

	return ret;

}



void mte_zero_clear_page_tags(void *addr);

void mte_sync_tags(pte_t old_pte, pte_t pte);

void mte_copy_page_tags(void *kto, const void *kfrom);
@@ -56,6 +79,13 @@ size_t mte_probe_user_range(const char __user *uaddr, size_t size); 
/* unused if !CONFIG_ARM64_MTE, silence the compiler */

#define PG_mte_tagged	0



static inline void set_page_mte_tagged(struct page *page)

{

}

static inline bool page_mte_tagged(struct page *page)

{

	return false;

}

static inline void mte_zero_clear_page_tags(void *addr)

{

}

arch/arm64/include/asm/pgtable.h

+1 −1
Original line number Diff line number Diff line
@@ -1050,7 +1050,7 @@ static inline void arch_swap_invalidate_area(int type) 
static inline void arch_swap_restore(swp_entry_t entry, struct folio *folio)

{

	if (system_supports_mte() && mte_restore_tags(entry, &folio->page))

		set_bit(PG_mte_tagged, &folio->flags);

		set_page_mte_tagged(&folio->page);

}



#endif /* CONFIG_ARM64_MTE */

arch/arm64/kernel/cpufeature.c

+3 −1
Original line number Diff line number Diff line
@@ -2050,8 +2050,10 @@ static void cpu_enable_mte(struct arm64_cpu_capabilities const *cap) 
	 * Clear the tags in the zero page. This needs to be done via the

	 * linear map which has the Tagged attribute.

	 */

	if (!test_and_set_bit(PG_mte_tagged, &ZERO_PAGE(0)->flags))

	if (!page_mte_tagged(ZERO_PAGE(0))) {

		mte_clear_page_tags(lm_alias(empty_zero_page));

		set_page_mte_tagged(ZERO_PAGE(0));

	}



	kasan_init_hw_tags_cpu();

}

arch/arm64/kernel/elfcore.c

+1 −1
Original line number Diff line number Diff line
@@ -47,7 +47,7 @@ static int mte_dump_tag_range(struct coredump_params *cprm, 
		 * Pages mapped in user space as !pte_access_permitted() (e.g.

		 * PROT_EXEC only) may not have the PG_mte_tagged flag set.

		 */

		if (!test_bit(PG_mte_tagged, &page->flags)) {

		if (!page_mte_tagged(page)) {

			put_page(page);

			dump_skip(cprm, MTE_PAGE_TAG_STORAGE);

			continue;

arch/arm64/kernel/hibernate.c

+1 −1
Original line number Diff line number Diff line
@@ -271,7 +271,7 @@ static int swsusp_mte_save_tags(void) 
			if (!page)

				continue;



			if (!test_bit(PG_mte_tagged, &page->flags))

			if (!page_mte_tagged(page))

				continue;



			ret = save_tags(page, pfn);