From patchwork Wed Oct 19 08:22:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 4541 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4ac7:0:0:0:0:0 with SMTP id y7csp204106wrs; Wed, 19 Oct 2022 01:45:03 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7xj63aXuWmIOLi3Y6kFv+n7N/US2XmE+3fcs/knbo7vh0uc9YIj/wa7lHCarXfRyhS5ocW X-Received: by 2002:a17:90a:c09:b0:20d:7820:2e60 with SMTP id 9-20020a17090a0c0900b0020d78202e60mr42416953pjs.180.1666169103014; Wed, 19 Oct 2022 01:45:03 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666169103; cv=none; d=google.com; s=arc-20160816; b=GZfVXNX9X6BdlYEZFDPYbNwEi34pc+PweQtMgyZZmkcLOdLz7btMItOrkbhjeJGwqk Kq/zMFoecz36Gf5mNhi/M8uQFc3QNE2Ab19tzHlIMFM2BG0gvQjjFid4cU3DVgNkGwc/ AjFuGotLDAGQh0qhd09PWQA25PyMjhglbYVv9HflfEw+ZG7TRd/sPSVYkh/VWgWUEC9O 9uL0ABx7WagNzb5xIL4IYL2qR4m/R2VCdpUii0rTiEBt98CyeQAP33tEAjuF6bJu9KkF ePPiVXD9BY5o+J0Cf+F2wlj+k3mCIgp9R1bi5mnLdhjH/DrzxZmmdcUiFeL3HHfo31LL q4tQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=0yeKGAIcH/PnqD9ZjS7C8Kq7oyHCBz76xAXV0kd+apM=; b=rLYLhlw+53DupLo4bPJxGbgW4SRaJRyEsKZWSbF4IeU1Fuab1WO1jP3LZcSsQ1/H4b itCsQbwEF9JW3mN+YqAztWCYw1K03xx6LP60Xb9RgBM4NGB56zP82YuKjo0f3PC6WE78 PsH7c8ql0IHPsm5cqA4zknCuueiNyTpjdREqWiX8SZPPkFW/5BpdiTUeZkfPd1AkUSoe 1uCUjYjC7FncJKYDyMPt3OlzQrLC+EOkVYghdkl9TEoeYz4Mz9Xeizyhoj7RO71PkbmN fv0abSNFXqCLHBI+PaPUPqsbNDH2op/WuijMUwtQ7XG0mQ2z+SD4yfcE41ywKtC/KlFP WR8Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=YG+gze75; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id n26-20020a63971a000000b0043c2e57961asi17312104pge.799.2022.10.19.01.44.49; Wed, 19 Oct 2022 01:45:02 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=YG+gze75; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231181AbiJSIof (ORCPT + 99 others); Wed, 19 Oct 2022 04:44:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43114 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231184AbiJSInN (ORCPT ); Wed, 19 Oct 2022 04:43:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E7F3B1743B; Wed, 19 Oct 2022 01:40:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0B87F617E3; Wed, 19 Oct 2022 08:40:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B36FC4347C; Wed, 19 Oct 2022 08:40:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666168814; bh=0xP8NJZRqFkAmh8Wb9Hjt2svBmJ+r6ZSDULnSavJM7Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YG+gze757dmKqYlgI0Dcvt4po/t3Y0Yt60x6FPY2d3h02611s48j5uHJY5yzs5AYD 0BfT7Aj+riL/+Dubyi3gD3bZBKbPRWBgiyCqqcWIPLjLrQa2kp/kQKi2XGylEjJTbL 7Vsz8P9PdhPO6fSgSyhmDcUlJdhlnQ0onykd6tfI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jisheng Zhang , Palmer Dabbelt Subject: [PATCH 6.0 061/862] riscv: vdso: fix NULL deference in vdso_join_timens() when vfork Date: Wed, 19 Oct 2022 10:22:28 +0200 Message-Id: <20221019083252.656779179@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747104933591676413?= X-GMAIL-MSGID: =?utf-8?q?1747104933591676413?= From: Jisheng Zhang commit a8616d2dc193b6becc36b5f3cfeaa9ac7a5762f9 upstream. Testing tools/testing/selftests/timens/vfork_exec.c got below kernel log: [ 6.838454] Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000020 [ 6.842255] Oops [#1] [ 6.842871] Modules linked in: [ 6.844249] CPU: 1 PID: 64 Comm: vfork_exec Not tainted 6.0.0-rc3-rt15+ #8 [ 6.845861] Hardware name: riscv-virtio,qemu (DT) [ 6.848009] epc : vdso_join_timens+0xd2/0x110 [ 6.850097] ra : vdso_join_timens+0xd2/0x110 [ 6.851164] epc : ffffffff8000635c ra : ffffffff8000635c sp : ff6000000181fbf0 [ 6.852562] gp : ffffffff80cff648 tp : ff60000000fdb700 t0 : 3030303030303030 [ 6.853852] t1 : 0000000000000030 t2 : 3030303030303030 s0 : ff6000000181fc40 [ 6.854984] s1 : ff60000001e6c000 a0 : 0000000000000010 a1 : ffffffff8005654c [ 6.856221] a2 : 00000000ffffefff a3 : 0000000000000000 a4 : 0000000000000000 [ 6.858114] a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038 [ 6.859484] s2 : ff60000001e6c068 s3 : ff6000000108abb0 s4 : 0000000000000000 [ 6.860751] s5 : 0000000000001000 s6 : ffffffff8089dc40 s7 : ffffffff8089dc38 [ 6.862029] s8 : ffffffff8089dc30 s9 : ff60000000fdbe38 s10: 000000000000005e [ 6.863304] s11: ffffffff80cc3510 t3 : ffffffff80d1112f t4 : ffffffff80d1112f [ 6.864565] t5 : ffffffff80d11130 t6 : ff6000000181fa00 [ 6.865561] status: 0000000000000120 badaddr: 0000000000000020 cause: 000000000000000d [ 6.868046] [] timens_commit+0x38/0x11a [ 6.869089] [] timens_on_fork+0x72/0xb4 [ 6.870055] [] begin_new_exec+0x3c6/0x9f0 [ 6.871231] [] load_elf_binary+0x628/0x1214 [ 6.872304] [] bprm_execve+0x1f2/0x4e4 [ 6.873243] [] do_execveat_common+0x16e/0x1ee [ 6.874258] [] sys_execve+0x3c/0x48 [ 6.875162] [] ret_from_syscall+0x0/0x2 [ 6.877484] ---[ end trace 0000000000000000 ]--- This is because the mm->context.vdso_info is NULL in vfork case. From another side, mm->context.vdso_info either points to vdso info for RV64 or vdso info for compat, there's no need to bloat riscv's mm_context_t, we can handle the difference when setup the additional page for vdso. Signed-off-by: Jisheng Zhang Suggested-by: Palmer Dabbelt Fixes: 3092eb456375 ("riscv: compat: vdso: Add setup additional pages implementation") Link: https://lore.kernel.org/r/20220924070737.3048-1-jszhang@kernel.org Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt Signed-off-by: Greg Kroah-Hartman --- arch/riscv/include/asm/mmu.h | 1 - arch/riscv/kernel/vdso.c | 13 ++++++++++--- 2 files changed, 10 insertions(+), 4 deletions(-) --- a/arch/riscv/include/asm/mmu.h +++ b/arch/riscv/include/asm/mmu.h @@ -16,7 +16,6 @@ typedef struct { atomic_long_t id; #endif void *vdso; - void *vdso_info; #ifdef CONFIG_SMP /* A local icache flush is needed before user execution can resume. */ cpumask_t icache_stale_mask; --- a/arch/riscv/kernel/vdso.c +++ b/arch/riscv/kernel/vdso.c @@ -60,6 +60,11 @@ struct __vdso_info { struct vm_special_mapping *cm; }; +static struct __vdso_info vdso_info; +#ifdef CONFIG_COMPAT +static struct __vdso_info compat_vdso_info; +#endif + static int vdso_mremap(const struct vm_special_mapping *sm, struct vm_area_struct *new_vma) { @@ -114,15 +119,18 @@ int vdso_join_timens(struct task_struct { struct mm_struct *mm = task->mm; struct vm_area_struct *vma; - struct __vdso_info *vdso_info = mm->context.vdso_info; mmap_read_lock(mm); for (vma = mm->mmap; vma; vma = vma->vm_next) { unsigned long size = vma->vm_end - vma->vm_start; - if (vma_is_special_mapping(vma, vdso_info->dm)) + if (vma_is_special_mapping(vma, vdso_info.dm)) zap_page_range(vma, vma->vm_start, size); +#ifdef CONFIG_COMPAT + if (vma_is_special_mapping(vma, compat_vdso_info.dm)) + zap_page_range(vma, vma->vm_start, size); +#endif } mmap_read_unlock(mm); @@ -264,7 +272,6 @@ static int __setup_additional_pages(stru vdso_base += VVAR_SIZE; mm->context.vdso = (void *)vdso_base; - mm->context.vdso_info = (void *)vdso_info; ret = _install_special_mapping(mm, vdso_base, vdso_text_len,