[v30,09/20] mm: Introduce vm_ops->may_mprotect()
diff mbox series

Message ID 20200515004410.723949-10-jarkko.sakkinen@linux.intel.com
State New
Headers show
Series
  • Intel SGX foundations
Related show

Commit Message

Jarkko Sakkinen May 15, 2020, 12:43 a.m. UTC
From: Sean Christopherson <sean.j.christopherson@intel.com>

Add vm_ops()->may_mprotect() to check additional constrains set by a
subsystem for a mprotect() call.

Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
Acked-by: Jethro Beekman <jethro@fortanix.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 include/linux/mm.h |  2 ++
 mm/mprotect.c      | 14 +++++++++++---
 2 files changed, 13 insertions(+), 3 deletions(-)

Comments

Borislav Petkov May 29, 2020, 12:10 p.m. UTC | #1
On Fri, May 15, 2020 at 03:43:59AM +0300, Jarkko Sakkinen wrote:
> From: Sean Christopherson <sean.j.christopherson@intel.com>
> 
> Add vm_ops()->may_mprotect() to check additional constrains set by a

"constraints"

> subsystem for a mprotect() call.
> 
> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
> Acked-by: Jethro Beekman <jethro@fortanix.com>
> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> ---
>  include/linux/mm.h |  2 ++
>  mm/mprotect.c      | 14 +++++++++++---
>  2 files changed, 13 insertions(+), 3 deletions(-)

This needs an ACK from an mm person.
Jarkko Sakkinen May 29, 2020, 6:18 p.m. UTC | #2
On Fri, May 29, 2020 at 02:10:38PM +0200, Borislav Petkov wrote:
> On Fri, May 15, 2020 at 03:43:59AM +0300, Jarkko Sakkinen wrote:
> > From: Sean Christopherson <sean.j.christopherson@intel.com>
> > 
> > Add vm_ops()->may_mprotect() to check additional constrains set by a
> 
> "constraints"
> 
> > subsystem for a mprotect() call.
> > 
> > Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
> > Acked-by: Jethro Beekman <jethro@fortanix.com>
> > Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> > ---
> >  include/linux/mm.h |  2 ++
> >  mm/mprotect.c      | 14 +++++++++++---
> >  2 files changed, 13 insertions(+), 3 deletions(-)
> 
> This needs an ACK from an mm person.

Good point. I'll add the needed cc's.

/Jarkko
Dave Hansen May 29, 2020, 6:28 p.m. UTC | #3
On 5/14/20 5:43 PM, Jarkko Sakkinen wrote:
> From: Sean Christopherson <sean.j.christopherson@intel.com>
> 
> Add vm_ops()->may_mprotect() to check additional constrains set by a
> subsystem for a mprotect() call.

This changelog needs some more detail about why this is needed.  It
would also be nice to include thought about what else it could get used
for and what subsystems can expect by doing this and what the mm core is
expected to do.
Jarkko Sakkinen May 31, 2020, 11:12 p.m. UTC | #4
On Fri, May 29, 2020 at 11:28:56AM -0700, Dave Hansen wrote:
> On 5/14/20 5:43 PM, Jarkko Sakkinen wrote:
> > From: Sean Christopherson <sean.j.christopherson@intel.com>
> > 
> > Add vm_ops()->may_mprotect() to check additional constrains set by a
> > subsystem for a mprotect() call.
> 
> This changelog needs some more detail about why this is needed.  It
> would also be nice to include thought about what else it could get used
> for and what subsystems can expect by doing this and what the mm core is
> expected to do.

Point taken. I added a description on how it is used.

/Jarkko

Patch
diff mbox series

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 5a323422d783..dbcc2846b3b8 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -546,6 +546,8 @@  struct vm_operations_struct {
 	void (*close)(struct vm_area_struct * area);
 	int (*split)(struct vm_area_struct * area, unsigned long addr);
 	int (*mremap)(struct vm_area_struct * area);
+	int (*may_mprotect)(struct vm_area_struct *vma, unsigned long start,
+			    unsigned long end, unsigned long prot);
 	vm_fault_t (*fault)(struct vm_fault *vmf);
 	vm_fault_t (*huge_fault)(struct vm_fault *vmf,
 			enum page_entry_size pe_size);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 494192ca954b..079ba92df377 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -603,13 +603,21 @@  static int do_mprotect_pkey(unsigned long start, size_t len,
 			goto out;
 		}
 
+		tmp = vma->vm_end;
+		if (tmp > end)
+			tmp = end;
+
+		if (vma->vm_ops && vma->vm_ops->may_mprotect) {
+			error = vma->vm_ops->may_mprotect(vma, nstart, tmp,
+							  prot);
+			if (error)
+				goto out;
+		}
+
 		error = security_file_mprotect(vma, reqprot, prot);
 		if (error)
 			goto out;
 
-		tmp = vma->vm_end;
-		if (tmp > end)
-			tmp = end;
 		error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
 		if (error)
 			goto out;