Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Yash Shah <yash.shah@sifive.com>
To:     paul.walmsley@sifive.com, palmer@dabbelt.com,
        linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org
Cc:     colin.king@canonical.com, aou@eecs.berkeley.edu,
        david.abdurachmanov@gmail.com, Yash Shah <yash.shah@sifive.com>
Subject: [PATCH] RISC-V: Don't allow write+exec only page mapping request in mmap
Date:   Tue, 16 Jun 2020 19:33:06 +0530
Message-Id: <1592316186-1420-1-git-send-email-yash.shah@sifive.com>
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-MessageSentRepresentingType: 1
Received: from osubuntu003.open-silicon.com (159.117.144.156) by SG2PR0401CA0008.apcprd04.prod.outlook.com (2603:1096:3:1::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.3109.22 via Frontend Transport; Tue, 16 Jun 2020 14:03:57 +0000
X-Mailer: git-send-email 2.7.4
X-Originating-IP: [159.117.144.156]
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 20302512-843b-47f7-b815-08d811fe1e2c
X-MS-TrafficTypeDiagnostic: BN6PR13MB0866:
X-LD-Processed: 22f88e9d-ae0d-4ed9-b984-cdc9be1529f1,ExtAddr
X-MS-Exchange-Transport-Forked: True
X-Microsoft-Antispam-PRVS: <BN6PR13MB086697033160FF574A85F7188C9D0@BN6PR13MB0866.namprd13.prod.outlook.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:5516;
X-Forefront-PRVS: 04362AC73B
X-MS-Exchange-SenderADCheck: 1
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: m/W1Rt0S2egAN6uiZeT1ceL90ITJekJr/gC50u/lxxk9Z1pgrx4Vlloh7WdzD2xuzd0Jjqx5QRk9ab7+wOuWHiyQnOb9tkajY3HAP28GdQiZE3csmOH2G28YmQN98Fb1oUl1Z5Vo3VSbfoRSl/evyfIHigEdbKzP+eisUSXMfqN7/rJ7Mv7bTyt2V9lEhPR19598edpcIdRbI2iEaaCMoxkmKle++NLTBXtNCOb+aWxgyxivdE5NsVqYIpA+zaMgydVXdzdeL0N7GOuN2hw334Oj55hgbUCvxehsVy0ni7OvV3CC6Zt8WvK4XmbvN0A+l4JI3f+TS8E0HKrJjgI+BNkTqV06nqRWSQUknQLrg1362aB7DdNZWDjdZt9crDLFC71IGTXxfg0b2IQESqpRbA==
X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:BN6PR1301MB2020.namprd13.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(136003)(39840400004)(376002)(366004)(396003)(346002)(52116002)(8936002)(6666004)(26005)(6486002)(86362001)(6512007)(2906002)(316002)(8676002)(4326008)(478600001)(966005)(36756003)(5660300002)(83380400001)(107886003)(956004)(16526019)(186003)(66556008)(6506007)(44832011)(2616005)(66946007)(66476007);DIR:OUT;SFP:1101;
X-MS-Exchange-AntiSpam-MessageData: i23e5WdMWwyJkd5Y4dEL+qEz6AjYUtGCzc+lqWq+vVCrkF1YBkssyglKjZ5ic2YROsiq1uQtvVdckX+LqOyR9Fii/NVoeMmqpfwgABcg5lULiMus5IUZTzComXRGmNU2soKg9W1ar10c+ggbIzaGV80ZKmFHX+muJqUM3Pyc0Iwx29WhRsQX+9roMN/wckFl7WGs3kCZti4lS8hdK4EtnFMZmFmn1AhgY8BZqwY3MTF6duTZiAV9rKg633qsNsphI+f1KQLIxTTUxqR1og3bpdEnsWsyUNgaYi7zU52C6ItHI4uViWtUjmy373snZbGSihtIG7fMaDFxODfF9poNWd4MUc5UOshPY/X5sMZkznVWopfV3FdjBj1GKzQaOoGDD0u5KIlEQNySMULTJB5kxyqRc7hlXQxgtyEmklNNz+dowAik/QlO4xPR05jzXcwGYlgSMDZ37nMp0+j2ubP2eXyAB7daJAawCLayhDFGEdU=
X-OriginatorOrg: sifive.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 20302512-843b-47f7-b815-08d811fe1e2c
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 16 Jun 2020 14:04:00.2495
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 22f88e9d-ae0d-4ed9-b984-cdc9be1529f1
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Pk7MlXFFsQl/Dhk/PKBYsNl2jDOVLCQEjK4GDkase2jpQfLt1Vr3zN8OaZVLggWxqj8cjkZpdaFv+QEb5sVfsA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR13MB0866
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

As per the table 4.2 of the RISC-V instruction set manual[0], the PTE
permission bit combination of "write+exec only" is invalid and reserved
for future use. Hence, don't allow such mapping request in mmap call.

An issue is been reported by David Abdurachmanov, that while running
stress-ng with "sysbadaddr" argument, RCU stalls are observed on RISC-V
specific kernel.

This issue arises when the stress-sysbadaddr request for pages with
"write+exec only" permission bits and then passes the address obtain
from this mmap call to various system call. For the riscv kernel, the
mmap call should fail for this particular combination of permission bits
since it's not valid.

[0]: https://www2.eecs.berkeley.edu/Pubs/TechRpts/2016/EECS-2016-161.pdf

Signed-off-by: Yash Shah <yash.shah@sifive.com>
Reported-by: David Abdurachmanov <david.abdurachmanov@gmail.com>
---
 arch/riscv/kernel/sys_riscv.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
index f3619f5..12f8a7f 100644
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -8,6 +8,7 @@
 #include <linux/syscalls.h>
 #include <asm/unistd.h>
 #include <asm/cacheflush.h>
+#include <asm-generic/mman-common.h>
 
 static long riscv_sys_mmap(unsigned long addr, unsigned long len,
 			   unsigned long prot, unsigned long flags,
@@ -16,6 +17,11 @@ static long riscv_sys_mmap(unsigned long addr, unsigned long len,
 {
 	if (unlikely(offset & (~PAGE_MASK >> page_shift_offset)))
 		return -EINVAL;
+
+	if ((prot & PROT_WRITE) && (prot & PROT_EXEC))
+		if (unlikely(!(prot & PROT_READ)))
+			return -EINVAL;
+
 	return ksys_mmap_pgoff(addr, len, prot, flags, fd,
 			       offset >> (PAGE_SHIFT - page_shift_offset));
 }
-- 
2.7.4