lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 28 May 2019 17:34:00 +0100
From:   Catalin Marinas <>
To:     Dave Martin <>
Cc:     Andrew Murray <>,
        Mark Rutland <>,,
        Christian Koenig <>,
        Szabolcs Nagy <>,
        Will Deacon <>,,,
        Lee Smith <>,,
        Vincenzo Frascino <>,
        Jacob Bramley <>,
        Leon Romanovsky <>,,,,
        Evgeniy Stepanov <>,, Kees Cook <>,
        Ruben Ayrapetyan <>,
        Andrey Konovalov <>,
        Kevin Brodsky <>,
        Alex Williamson <>,
        Mauro Carvalho Chehab <>,
        Dmitry Vyukov <>,
        Kostya Serebryany <>,
        Greg Kroah-Hartman <>,
        Felix Kuehling <>,,
        Jens Wiklander <>,
        Ramana Radhakrishnan <>,
        Alexander Deucher <>,
        Andrew Morton <>,
        Robin Murphy <>,
        Yishai Hadas <>,
        Luc Van Oostenryck <>
Subject: Re: [PATCH v15 05/17] arms64: untag user pointers passed to memory

On Tue, May 28, 2019 at 04:56:45PM +0100, Dave P Martin wrote:
> On Tue, May 28, 2019 at 04:40:58PM +0100, Catalin Marinas wrote:
> [...]
> > My thoughts on allowing tags (quick look):
> >
> > brk - no
> [...]
> > mlock, mlock2, munlock - yes
> > mmap - no (we may change this with MTE but not for TBI)
> [...]
> > mprotect - yes
> I haven't following this discussion closely... what's the rationale for
> the inconsistencies here (feel free to refer me back to the discussion
> if it's elsewhere).

_My_ rationale (feel free to disagree) is that mmap() by default would
not return a tagged address (ignoring MTE for now). If it gets passed a
tagged address or a "tagged NULL" (for lack of a better name) we don't
have clear semantics of whether the returned address should be tagged in
this ABI relaxation. I'd rather reserve this specific behaviour if we
overload the non-zero tag meaning of mmap() for MTE. Similar reasoning
for mremap(), at least on the new_address argument (not entirely sure
about old_address).

munmap() should probably follow the mmap() rules.

As for brk(), I don't see why the user would need to pass a tagged
address, we can't associate any meaning to this tag.

For the rest, since it's likely such addresses would have been tagged by
malloc() in user space, we should allow tagged pointers.


Powered by blists - more mailing lists