linux-kernel - [PATCH v3] riscv: don't allow write but not read page mapping request in mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <PH7PR14MB55944401F3CECBF340F1DCB2CEAB9@PH7PR14MB5594.namprd14.prod.outlook.com>
Date:   Mon, 13 Jun 2022 15:16:47 +0800
From:   Celeste Liu <coelacanthus@...look.com>
To:     Palmer Dabbelt <palmer@...osinc.com>,
        Paul Walmsley <paul.walmsley@...ive.com>,
        Albert Ou <aou@...s.berkeley.edu>
Cc:     Celeste Liu <coelacanthus@...look.com>,
        Xiongchuan Tan <xc-tan@...look.com>,
        Wang Ruikang <dramforever@...e.com>,
        Ruizhe Pan <c141028@...il.com>, Guo Ren <guoren@...nel.org>,
        linux-riscv@...ts.infradead.org, linux-kernel@...r.kernel.org,
        Yash Shah <yash.shah@...ive.com>
Subject: [PATCH v3] riscv: don't allow write but not read page mapping request in mmap

When Xiongchuan Tan tries to run one of libaio's tests[1], it encounters a strange
behavior: for the same PROT_WRITE only mapping, there was a discrepancy
in whether it could be read before and after writing (readable before
writing, unreadable after writing). After some investigation,
I found that mmap allows write only mapping, an undefined behavior, on RISC-V.

As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
"20211203 Privileged Architecture v1.12, Ratified"[2], the PTE permission
bit combination of "write+!read" is "Reserved for future use.". Hence, don't
allow such mapping request in mmap call. In the current code[3], write+exec
only is marked as invalid, but write only is not marked as invalid.

This patch refines that judgment.

[1]: https://pagure.io/libaio/blob/1b18bfafc6a2f7b9fa2c6be77a95afed8b7be448/f/harness/cases/5.t
[2]: https://github.com/riscv/riscv-isa-manual/releases/download/Priv-v1.12/riscv-privileged-20211203.pdf
[3]: modified in commit e0d17c842c0f824fd4df9f4688709fc6907201e1
     (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e0d17c842c0f824fd4df9f4688709fc6907201e1)

Reported-by: Xiongchuan Tan <xc-tan@...look.com>
Co-developed-by: Wang Ruikang <dramforever@...e.com>
Signed-off-by: Wang Ruikang <dramforever@...e.com>
Co-developed-by: Ruizhe Pan <c141028@...il.com>
Signed-off-by: Ruizhe Pan <c141028@...il.com>
Signed-off-by: Celeste Liu <coelacanthus@...look.com>
Reviewed-by: Guo Ren <guoren@...nel.org>
Cc: linux-riscv@...ts.infradead.org
Cc: linux-kernel@...r.kernel.org
Cc: Guo Ren <guoren@...nel.org>
Cc: Yash Shah <yash.shah@...ive.com>
---
v2: This version adds a link to the referenced spec, and reference of the 
previous related modification.
v3: fix DCO signoff name and add comment for reason

 arch/riscv/kernel/sys_riscv.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
index 9c0194f176fc..e55281b497cf 100644
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -18,9 +18,14 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
 	if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
 		return -EINVAL;
 
-	if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
-		if (unlikely(!(prot & PROT_READ)))
-			return -EINVAL;
+	/*
+	 * As mentioned in Table 4.5 in RISC-V spec Volume 2 Section 4.3 version
+	 * "20211203 Privileged Architecture v1.12, Ratified", the PTE permission
+	 * bit combination of "write+!read" is "Reserved for future use.". Hence, don't
+	 * allow such mapping request in mmap call.
+	 */
+	if (unlikely((prot & PROT_WRITE) && !(prot & PROT_READ)))
+		return -EINVAL;
 
 	return ksys_mmap_pgoff(addr, len, prot, flags, fd,
 			       offset >> (PAGE_SHIFT - page_shift_offset));
-- 
2.36.1