| Message ID | 20201120030411.2690816-2-lokeshgidra@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Control over userfaultfd kernel-fault handling | expand |
On Thu, Nov 19, 2020 at 7:04 PM Lokesh Gidra <lokeshgidra@google.com> wrote: > > userfaultfd handles page faults from both user and kernel code. > Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes > the resulting userfaultfd object refuse to handle faults from kernel > mode, treating these faults as if SIGBUS were always raised, causing > the kernel code to fail with EFAULT. > > A future patch adds a knob allowing administrators to give some > processes the ability to create userfaultfd file objects only if they > pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes > will exploit userfaultfd's ability to delay kernel page faults to open > timing windows for future exploits. > > Signed-off-by: Daniel Colascione <dancol@google.com> > Signed-off-by: Lokesh Gidra <lokeshgidra@google.com> > Reviewed-by: Andrea Arcangeli <aarcange@redhat.com> > --- > fs/userfaultfd.c | 10 +++++++++- > include/uapi/linux/userfaultfd.h | 9 +++++++++ > 2 files changed, 18 insertions(+), 1 deletion(-) > > diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c > index 000b457ad087..605599fde015 100644 > --- a/fs/userfaultfd.c > +++ b/fs/userfaultfd.c > @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) > > if (ctx->features & UFFD_FEATURE_SIGBUS) > goto out; > + if ((vmf->flags & FAULT_FLAG_USER) == 0 && > + ctx->flags & UFFD_USER_MODE_ONLY) { > + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd " > + "sysctl knob to 1 if kernel faults must be handled " > + "without obtaining CAP_SYS_PTRACE capability\n"); > + goto out; > + } > > /* > * If it's already released don't get it. This avoids to loop > @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) > BUG_ON(!current->mm); > > /* Check the UFFD_* constants for consistency. */ > + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS); > BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC); > BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK); > > - if (flags & ~UFFD_SHARED_FCNTL_FLAGS) > + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY)) > return -EINVAL; > > ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL); > diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h > index e7e98bde221f..5f2d88212f7c 100644 > --- a/include/uapi/linux/userfaultfd.h > +++ b/include/uapi/linux/userfaultfd.h > @@ -257,4 +257,13 @@ struct uffdio_writeprotect { > __u64 mode; > }; > > +/* > + * Flags for the userfaultfd(2) system call itself. > + */ > + > +/* > + * Create a userfaultfd that can handle page faults only in user mode. > + */ > +#define UFFD_USER_MODE_ONLY 1 > + > #endif /* _LINUX_USERFAULTFD_H */ > -- > 2.29.0.rc1.297.gfa9743e501-goog > Adding linux-mm@kvack.org mailing list
On Thu, 19 Nov 2020 19:04:10 -0800 Lokesh Gidra <lokeshgidra@google.com> wrote: > userfaultfd handles page faults from both user and kernel code. > Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes > the resulting userfaultfd object refuse to handle faults from kernel > mode, treating these faults as if SIGBUS were always raised, causing > the kernel code to fail with EFAULT. > > A future patch adds a knob allowing administrators to give some > processes the ability to create userfaultfd file objects only if they > pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes > will exploit userfaultfd's ability to delay kernel page faults to open > timing windows for future exploits. Can we assume that an update to the userfaultfd(2) manpage is in the works? > --- a/fs/userfaultfd.c > +++ b/fs/userfaultfd.c > @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) > > if (ctx->features & UFFD_FEATURE_SIGBUS) > goto out; > + if ((vmf->flags & FAULT_FLAG_USER) == 0 && > + ctx->flags & UFFD_USER_MODE_ONLY) { > + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd " > + "sysctl knob to 1 if kernel faults must be handled " > + "without obtaining CAP_SYS_PTRACE capability\n"); > + goto out; > + } > > /* > * If it's already released don't get it. This avoids to loop > @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) > BUG_ON(!current->mm); > > /* Check the UFFD_* constants for consistency. */ > + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS); Are we sure this is true for all architectures? > BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC); > BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK); > > - if (flags & ~UFFD_SHARED_FCNTL_FLAGS) > + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY)) > return -EINVAL; > > ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL); > diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h > index e7e98bde221f..5f2d88212f7c 100644 > --- a/include/uapi/linux/userfaultfd.h > +++ b/include/uapi/linux/userfaultfd.h > @@ -257,4 +257,13 @@ struct uffdio_writeprotect { > __u64 mode; > }; > > +/* > + * Flags for the userfaultfd(2) system call itself. > + */ > + > +/* > + * Create a userfaultfd that can handle page faults only in user mode. > + */ > +#define UFFD_USER_MODE_ONLY 1 > + > #endif /* _LINUX_USERFAULTFD_H */ It would be nice to define this in include/linux/userfaultfd_k.h, alongside the other flags. But I guess it has to be here because it's part of the userspace API.
On Fri, Nov 20, 2020 at 3:33 PM Andrew Morton <akpm@linux-foundation.org> wrote: > > On Thu, 19 Nov 2020 19:04:10 -0800 Lokesh Gidra <lokeshgidra@google.com> wrote: > > > userfaultfd handles page faults from both user and kernel code. > > Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes > > the resulting userfaultfd object refuse to handle faults from kernel > > mode, treating these faults as if SIGBUS were always raised, causing > > the kernel code to fail with EFAULT. > > > > A future patch adds a knob allowing administrators to give some > > processes the ability to create userfaultfd file objects only if they > > pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes > > will exploit userfaultfd's ability to delay kernel page faults to open > > timing windows for future exploits. > > Can we assume that an update to the userfaultfd(2) manpage is in the > works? > Yes, I'm working on it. Can the kernel version which will have these patches be known now so that I can mention it in the manpage? > > --- a/fs/userfaultfd.c > > +++ b/fs/userfaultfd.c > > @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) > > > > if (ctx->features & UFFD_FEATURE_SIGBUS) > > goto out; > > + if ((vmf->flags & FAULT_FLAG_USER) == 0 && > > + ctx->flags & UFFD_USER_MODE_ONLY) { > > + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd " > > + "sysctl knob to 1 if kernel faults must be handled " > > + "without obtaining CAP_SYS_PTRACE capability\n"); > > + goto out; > > + } > > > > /* > > * If it's already released don't get it. This avoids to loop > > @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) > > BUG_ON(!current->mm); > > > > /* Check the UFFD_* constants for consistency. */ > > + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS); > > Are we sure this is true for all architectures? Yes, none of the architectures are using the least-significant bit for O_CLOEXEC or O_NONBLOCK. > > > BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC); > > BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK); > > > > - if (flags & ~UFFD_SHARED_FCNTL_FLAGS) > > + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY)) > > return -EINVAL; > > > > ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL); > > diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h > > index e7e98bde221f..5f2d88212f7c 100644 > > --- a/include/uapi/linux/userfaultfd.h > > +++ b/include/uapi/linux/userfaultfd.h > > @@ -257,4 +257,13 @@ struct uffdio_writeprotect { > > __u64 mode; > > }; > > > > +/* > > + * Flags for the userfaultfd(2) system call itself. > > + */ > > + > > +/* > > + * Create a userfaultfd that can handle page faults only in user mode. > > + */ > > +#define UFFD_USER_MODE_ONLY 1 > > + > > #endif /* _LINUX_USERFAULTFD_H */ > > It would be nice to define this in include/linux/userfaultfd_k.h, > alongside the other flags. But I guess it has to be here because it's > part of the userspace API.
On Mon, 23 Nov 2020 11:17:43 -0800 Lokesh Gidra <lokeshgidra@google.com> wrote: > > > A future patch adds a knob allowing administrators to give some > > > processes the ability to create userfaultfd file objects only if they > > > pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes > > > will exploit userfaultfd's ability to delay kernel page faults to open > > > timing windows for future exploits. > > > > Can we assume that an update to the userfaultfd(2) manpage is in the > > works? > > > Yes, I'm working on it. Can the kernel version which will have these > patches be known now so that I can mention it in the manpage? 5.11, if all proceeds smoothly.
diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 000b457ad087..605599fde015 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) if (ctx->features & UFFD_FEATURE_SIGBUS) goto out; + if ((vmf->flags & FAULT_FLAG_USER) == 0 && + ctx->flags & UFFD_USER_MODE_ONLY) { + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd " + "sysctl knob to 1 if kernel faults must be handled " + "without obtaining CAP_SYS_PTRACE capability\n"); + goto out; + } /* * If it's already released don't get it. This avoids to loop @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) BUG_ON(!current->mm); /* Check the UFFD_* constants for consistency. */ + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS); BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC); BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK); - if (flags & ~UFFD_SHARED_FCNTL_FLAGS) + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY)) return -EINVAL; ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL); diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h index e7e98bde221f..5f2d88212f7c 100644 --- a/include/uapi/linux/userfaultfd.h +++ b/include/uapi/linux/userfaultfd.h @@ -257,4 +257,13 @@ struct uffdio_writeprotect { __u64 mode; }; +/* + * Flags for the userfaultfd(2) system call itself. + */ + +/* + * Create a userfaultfd that can handle page faults only in user mode. + */ +#define UFFD_USER_MODE_ONLY 1 + #endif /* _LINUX_USERFAULTFD_H */