Re: [PATCH 1/3] arm64: armv8_deprecated: Fix swp_handler() signal generation

[Liam Howlett]

* Will Deacon <will@xxxxxxxxxx> [210422 09:01]:
> On Tue, Apr 20, 2021 at 04:50:12PM +0000, Liam Howlett wrote:
> > arm64_notify_segfault() was written to decide on the si_code from the
> > assembly emulation of the swp_handler(), but was also used for the
> > signal generation from failed access_ok() and unaligned instructions.
> > 
> > When access_ok() fails, there is no need to search for the offending
> > address in the VMA space.  Instead, simply set the error to SIGSEGV with
> > si_code SEGV_ACCERR.
> > 
> > Change the return code from emulate_swpX() when there is an unaligned
> > pointer so the caller can differentiate from the EFAULT.  It is
> > unnecessary to search the VMAs in the case of an unaligned pointer.
> > This change uses SIGSEGV and SEGV_ACCERR instead of SIGBUS to keep with
> > what was returned before.
> > 
> > Fixes: bd35a4adc413 (arm64: Port SWP/SWPB emulation support from arm)
> > Signed-off-by: Liam R. Howlett <Liam.Howlett@xxxxxxxxxx>
> > ---
> >  arch/arm64/kernel/armv8_deprecated.c | 20 +++++++++++++-------
> 
> Can you give an example of something that is fixed by this, please? At first
> glance, it doesn't look like it changes the user-visible behaviour.

In short, when !access_ok(), don't return SEGV_MAPERR.

access_ok() is defined as __range_ok() which checks if the address is a
userspace address.  If the access is not okay, then the return should be
SEGV_ACCERR.  However, if the address is above any known VMA, then the
return will be SEGV_MAPERR.  Isn't this a bug?

Right now this particular bug is masked almost always by the fact that
find_vma() will return SIGV_ACCERR unless it's abvove any known VMA, but
patch 3 in this series will alter the behaviour and thus, I wanted to
fix the bug here before fixing that bug.

> 
> We should also be compatible with arch/arm/ here (see set_segfault()).


Yes, the same error exists there it seems.  If my solution is
acceptable, I can expand it to include the same change there.

Thanks,
Liam