• Kristina Martsenko's avatar
    arm64: traps: fix userspace cache maintenance emulation on a tagged pointer · 81cddd65
    Kristina Martsenko authored
    When we emulate userspace cache maintenance in the kernel, we can
    currently send the task a SIGSEGV even though the maintenance was done
    on a valid address. This happens if the address has a non-zero address
    tag, and happens to not be mapped in.
    
    When we get the address from a user register, we don't currently remove
    the address tag before performing cache maintenance on it. If the
    maintenance faults, we end up in either __do_page_fault, where find_vma
    can't find the VMA if the address has a tag, or in do_translation_fault,
    where the tagged address will appear to be above TASK_SIZE. In both
    cases, the address is not mapped in, and the task is sent a SIGSEGV.
    
    This patch removes the tag from the address before using it. With this
    patch, the fault is handled correctly, the address gets mapped in, and
    the cache maintenance succeeds.
    
    As a second bug, if cache maintenance (correctly) fails on an invalid
    tagged address, the address gets passed into arm64_notify_segfault,
    where find_vma fails to find the VMA due to the tag, and the wrong
    si_code may be sent as part of the siginfo_t of the segfault. With this
    patch, the correct si_code is sent.
    
    Fixes: 7dd01aef ("arm64: trap userspace "dc cvau" cache operation on errata-affected core")
    Cc: <stable@vger.kernel.org> # 4.8.x-
    Acked-by: default avatarWill Deacon <will.deacon@arm.com>
    Signed-off-by: default avatarKristina Martsenko <kristina.martsenko@arm.com>
    Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
    81cddd65
traps.c 18.6 KB