[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAJF2gTQjR_iqbH3ee1GYRnPCQdn79p+vK5-FiKZiTQNZFhPyeA@mail.gmail.com>
Date: Mon, 13 Jun 2022 13:44:28 +0800
From: Guo Ren <guoren@...nel.org>
To: Celeste Liu <coelacanthus@...look.com>
Cc: Palmer Dabbelt <palmer@...osinc.com>,
Paul Walmsley <paul.walmsley@...ive.com>,
Albert Ou <aou@...s.berkeley.edu>, xctan <xc-tan@...look.com>,
dram <dramforever@...e.com>, Ruizhe Pan <c141028@...il.com>,
linux-riscv <linux-riscv@...ts.infradead.org>,
Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Yash Shah <yash.shah@...ive.com>
Subject: Re: [PATCH v2] riscv: don't allow write but not read page mapping
request in mmap
On Mon, Jun 13, 2022 at 1:20 PM Celeste Liu <coelacanthus@...look.com> wrote:
>
> When xctan tries to run one of libaio's tests
> (https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t),
> it encounters a strange behavior: for the same PROT_WRITE only mapping,
> there was a discrepancy in whether it could be read before and after writing
> (readable before writing, unreadable after writing). After some investigation,
> I found that mmap allows write only mapping, an undefined behavior, on RISC-V.
>
> As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
> "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission
> bit combination of "write+!read" is "Reserved for future use.". Hence, don't
> allow such mapping request in mmap call. In the current code[2], write+exec
> only is marked as invalid, but write only is not marked as invalid.
>
> This patch refines that judgment.
>
> [1]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf
> [2]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1
> (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1)
>
> Reported-by: xctan <xc-tan@...look.com>
> Co-developed-by: dram <dramforever@...e.com>
> Signed-off-by: dram <dramforever@...e.com>
> Co-developed-by: Ruizhe Pan <c141028@...il.com>
> Signed-off-by: Ruizhe Pan <c141028@...il.com>
> Signed-off-by: Celeste Liu <coelacanthus@...look.com>
> Cc: linux-riscv@...ts.infradead.org
> Cc: linux-kernel@...r.kernel.org
> Cc: Guo Ren <guoren@...nel.org>
> Cc: Yash Shah <yash.shah@...ive.com>
> ---
> v2: This version adds a link to the referenced spec, and reference of the
> previous related modification.
>
> arch/riscv/kernel/sys_riscv.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
> index 9c0194f176fc..571556bb9261 100644
> --- a/arch/riscv/kernel/sys_riscv.c
> +++ b/arch/riscv/kernel/sys_riscv.c
> @@ -18,9 +18,8 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
> if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
> return -EINVAL;
>
> - if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
Yes, PROT_EXEC would prevent next PROT_READ check.
Looks good to me.
Reviewed-by: Guo Ren <guoren@...nel.org>
> - if (unlikely(!(prot & PROT_READ)))
> - return -EINVAL;
Could we put your comment here?
/*
* As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
* "20211203 Privileged Architecture v1.12, Ratified"[1], the PTE permission
* bit combination of "write+!read" is "Reserved for future use.". Hence, don't
* allow such mapping request in mmap call. In the current code[2], write+exec
* only is marked as invalid, but write only is not marked as invalid.
*/
> + if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
> + return -EINVAL;
>
> return ksys_mmap_pgoff(addr, len, prot, flags, fd,
> offset >> (PAGE_SHIFT - page_shift_offset));
> --
> 2.36.1
>
--
Best Regards
Guo Ren
ML: https://lore.kernel.org/linux-csky/
Powered by blists - more mailing lists