[PATCH v3 1/2] futex: Canonicalize arm64 tagged user addresses

[Shubhang Kaushik (Ampere)]

On arm64, a thread that enables the tagged address ABI can pass valid
top-byte-tagged user pointers to futex syscalls. Such a pointer must
have the same syscall behaviour as its untagged form.

get_futex_key() validates the user address with access_ok(), but uses
the raw address when constructing private and shared-anonymous futex
keys. A waiter using a tagged address and a waker using the untagged
form can therefore access the same futex word while hashing to distinct
keys, causing FUTEX_WAKE to miss the waiter.

Keep access_ok() on the original pointer so that arm64 retains its
per-thread tagged-address ABI enforcement. Canonicalize the address
afterwards, before it is used for futex key construction and shared
mapping lookup.

Fixes: 63f0c6037965 ("arm64: Introduce prctl() options to control the tagged user addresses ABI")
Cc: stable@xxxxxxxxxxxxxxx
Reviewed-by: Catalin Marinas <catalin.marinas@xxxxxxx>
Acked-by: Davidlohr Bueso <dave@xxxxxxxxxxxx>
Signed-off-by: Shubhang Kaushik (Ampere) <sh@xxxxxxxxxx>
---
 kernel/futex/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/futex/core.c b/kernel/futex/core.c
index a240638f69e5c65bd036434a15f3df680efb4638..dcc8ffca38595a5ea69f3672375ffb9f9c6766f9 100644
--- a/kernel/futex/core.c
+++ b/kernel/futex/core.c
@@ -539,6 +539,8 @@ int get_futex_key(u32 __user *uaddr, unsigned int flags, union futex_key *key,
 	if (unlikely(!access_ok(uaddr, size)))
 		return -EFAULT;
 
+	address = untagged_addr(address);
+
 	if (unlikely(should_fail_futex(fshared)))
 		return -EFAULT;
 

-- 
2.52.0