From patchwork Tue Mar 12 22:28:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 13590667 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 87A76C54E5D for ; Tue, 12 Mar 2024 22:29:07 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E710A8E001F; Tue, 12 Mar 2024 18:29:06 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E20E48E0011; Tue, 12 Mar 2024 18:29:06 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CE8888E001F; Tue, 12 Mar 2024 18:29:06 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id BB8948E0011 for ; Tue, 12 Mar 2024 18:29:06 -0400 (EDT) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id 660E1120B8A for ; Tue, 12 Mar 2024 22:29:06 +0000 (UTC) X-FDA: 81889828692.06.4F1DD5C Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) by imf11.hostedemail.com (Postfix) with ESMTP id 7FC3F40018 for ; Tue, 12 Mar 2024 22:29:03 +0000 (UTC) Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=d+Svp7It; spf=pass (imf11.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.198.163.15 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1710282544; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding:in-reply-to: references:dkim-signature; bh=gu68G8dVhhX6ELTf9RRsVX6JhTcU6IE6NGCu2RLXBP4=; b=qQByP4DPFd14Rg2aSnqPagnzMnvvP2BogQEQvKLAeON8BXpx1RmSGF1W0Z03vx6RFWGicG OY3GGPA9Gc8OKYudrrS3HFKIxWnM8M/3HiwSVXmydWUrvCZq4jVJ/s7Px9fdY3O897HtRy z/Q39gbU6/Qnz5b3WaQghz7TwFE5peM= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1710282544; a=rsa-sha256; cv=none; b=0Xr/u+kpJ3UJ0p1Z0/WvOrkrt+dYgV0jhExuUn5XcHMFagI1PkSjlgIY0tIzMjb+mK3tyw qgSxwwwoolmF97zsQXymA93WXTEPQxO1GYp+8kQ4Hx7hxFYUlskzpP+SLh3J9WzmFxNDhD cdIf7gQzDGayL0Uh5D8persizWftCq8= ARC-Authentication-Results: i=1; imf11.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=d+Svp7It; spf=pass (imf11.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 192.198.163.15 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1710282544; x=1741818544; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=tTQ5x31bZfDMPtCq1BPOxcN0a7C3MnUNoyPhThEtsVE=; b=d+Svp7ItYq4vdQ9L/RqzcoK3/4L/m1LlqlqLH2hZVksspA5aZNVOXOLg 1/D7rwi5/n856UiWR0iSTOSnX3o7XxDT14b5gtzeI3r+tU2rzQIb5gwlN 4zHjr0IUSlgqqrdp1TtJL0U4TS5eQlmg2m+mcxcZ0rFkg/hrLXqlx9sQ0 OPs8Znmf//ftyLuo7+6AsvWG9aCA1d5H7rm6Os0dGFtimzCTxqPV9X5aY ohnsZVjGkwZPsYHqhLbll/WcRSd0HYdX1TL8e88PJ5+hHAi8mL2Aoelv/ oeZkazqmWytuNmMrkSDhn1W2YwDCSlK0pN6Hh6IrpPSAJPMD9fycsy5FV w==; X-IronPort-AV: E=McAfee;i="6600,9927,11011"; a="5191899" X-IronPort-AV: E=Sophos;i="6.07,119,1708416000"; d="scan'208";a="5191899" Received: from orviesa004.jf.intel.com ([10.64.159.144]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Mar 2024 15:29:01 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.07,119,1708416000"; d="scan'208";a="16356823" Received: from gargayus-mobl1.amr.corp.intel.com (HELO rpedgeco-desk4.intel.com) ([10.255.231.196]) by orviesa004-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Mar 2024 15:29:01 -0700 From: Rick Edgecombe To: Liam.Howlett@oracle.com, akpm@linux-foundation.org, bp@alien8.de, broonie@kernel.org, dave.hansen@linux.intel.com, debug@rivosinc.com, hpa@zytor.com, keescook@chromium.org, kirill.shutemov@linux.intel.com, luto@kernel.org, mingo@redhat.com, peterz@infradead.org, tglx@linutronix.de, x86@kernel.org, christophe.leroy@csgroup.eu Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, rick.p.edgecombe@intel.com Subject: [PATCH v3 00/12] Cover a guard gap corner case Date: Tue, 12 Mar 2024 15:28:31 -0700 Message-Id: <20240312222843.2505560-1-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Rspamd-Queue-Id: 7FC3F40018 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: iwcxkaqs7tw9eoem8ayir9d51z5zpfhe X-HE-Tag: 1710282543-923538 X-HE-Meta: U2FsdGVkX1/oOwR6jBOiFk/BmLO1XHAK9fxnKuyMmhpypHQhj5v8fnOhdZ/0gbIxuh+vIHJ7sfdPh3Zwpm2WKFqNbwhgo7hymBVrcqEQw+ecCS82U9owNlQVw/IXTexcwY0Iyo4I+sNlygjEXqpoKhzGjqGNv7vCQldujVCmI5vul38ETSilFvTHaDeani06Z3GWBS8VkBaxhA0PHa4KzFYGLvOgGOs+quYbL0uwQwH1iRB5PfkO/PK3BqZiZj4ofscqeO3hRoAv2+FgH0i1cqwaBPI+P+uPbfje9+WSAGbhPuz3qEMkm+ftYTGbr/rSoL3U2lDUHFSZos2WUElWkQ9Dd/I/eZ3NFzRYvTP3xTdurKYA3skP7d8geSzaPnVhLtYxMZgKtsbly1wDU7J5AKLzguTgI7v6mzFQAtcZn6wgefPKJD6AGaJIpAcHQpNGrmeJlv6+0XwnzhRyHnjbazd3WkMhZ2O27LtilV58jXc4e3WNfeCsbly1noTi/SvE6RE4Hju35/JIPlNg/EQ2Yr/glYH07FHKVEoR5Bbo2I25oaYmmLPMJ0SNEoVkiXloCJKH7wzX+rC/3Tj6n0mGlUzPlMnBmXrT9qWHXbZkvUQMHLTJX7b/Wa2rwBpI/VjNUdYGDqKqNtKKVjmcLXIq3jI7YTaXwXI2E+MDTvpXF9ba2yjL4mROtcacpDmtt33dT6YNW+5OrSknL/R2WDjuEaZH3Te7Ozcmf6ChJrPCIzBtb0t2sp0nDvM1ts2JFo+YTa5SzA0m5C4uTG/hoKdt14lyjG84jR0OZcDzxEHYQjC7tsd3Dd3jt4kYGBNHW9SdTheu6zeafv74w+9V5F0Bwtn9Rxj3ffl8 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: Hi, For v3, the change is in the struct vm_unmapped_area_info zeroing patches. Per discussion[0], they are switched to a method of intializing the struct at the callers that also doesn't leave useless statements as cleanup, but is a bit easier to manually inspect for bugs. The arch's that acked the old versions are left separate. What's left after that happens in a treewide change. It seems like a more straightforward change now, but I would still appreciate if anyone can double check the treewide change. Also, rebase to v6.8. [0] https://lore.kernel.org/lkml/e617dea592ec336e991c4362e48cd8c648ba7b49.camel@intel.com/ v2: https://lore.kernel.org/lkml/20240226190951.3240433-1-rick.p.edgecombe@intel.com/ v1: https://lore.kernel.org/lkml/20240215231332.1556787-1-rick.p.edgecombe@intel.com/ ======= In working on x86’s shadow stack feature, I came across some limitations around the kernel’s handling of guard gaps. AFAICT these limitations are not too important for the traditional stack usage of guard gaps, but have bigger impact on shadow stack’s usage. And now in addition to x86, we have two other architectures implementing shadow stack like features that plan to use guard gaps. I wanted to see about addressing them, but I have not worked on mmap() placement related code before, so would greatly appreciate if people could take a look and point me in the right direction. The nature of the limitations of concern is as follows. In order to ensure guard gaps between mappings, mmap() would need to consider two things: 1. That the new mapping isn’t placed in an any existing mapping’s guard gap. 2. That the new mapping isn’t placed such that any existing mappings are not in *its* guard gaps Currently mmap never considers (2), and (1) is not considered in some situations. When not passing an address hint, or passing one without MAP_FIXED_NOREPLACE, (1) is enforced. With MAP_FIXED_NOREPLACE, (1) is not enforced. With MAP_FIXED, (1) is not considered, but this seems to be expected since MAP_FIXED can already clobber existing mappings. For MAP_FIXED_NOREPLACE I would have guessed it should respect the guard gaps of existing mappings, but it is probably a little ambiguous. In this series I just tried to add enforcement of (2) for the normal (no address hint) case and only for the newer shadow stack memory (not stacks). The reason is that with the no-address-hint situation, landing next to a guard gap could come up naturally and so be more influencable by attackers such that two shadow stacks could be adjacent without a guard gap. Where as the address-hint scenarios would require more control - being able to call mmap() with specific arguments. As for why not just fix the other corner cases anyway, I thought it might have some greater possibility of affecting existing apps. Thanks, Rick Rick Edgecombe (12): mm: Switch mm->get_unmapped_area() to a flag mm: Introduce arch_get_unmapped_area_vmflags() mm: Use get_unmapped_area_vmflags() thp: Add thp_get_unmapped_area_vmflags() csky: Use initializer for struct vm_unmapped_area_info parisc: Use initializer for struct vm_unmapped_area_info powerpc: Use initializer for struct vm_unmapped_area_info treewide: Use initializer for struct vm_unmapped_area_info mm: Take placement mappings gap into account x86/mm: Implement HAVE_ARCH_UNMAPPED_AREA_VMFLAGS x86/mm: Care about shadow stack guard gap during placement selftests/x86: Add placement guard gap test for shstk arch/alpha/kernel/osf_sys.c | 5 +- arch/arc/mm/mmap.c | 4 +- arch/arm/mm/mmap.c | 5 +- arch/csky/abiv1/mmap.c | 12 +- arch/loongarch/mm/mmap.c | 3 +- arch/mips/mm/mmap.c | 3 +- arch/parisc/kernel/sys_parisc.c | 6 +- arch/powerpc/mm/book3s64/slice.c | 23 ++-- arch/s390/mm/hugetlbpage.c | 9 +- arch/s390/mm/mmap.c | 15 +-- arch/sh/mm/mmap.c | 5 +- arch/sparc/kernel/sys_sparc_32.c | 3 +- arch/sparc/kernel/sys_sparc_64.c | 20 ++-- arch/sparc/mm/hugetlbpage.c | 9 +- arch/x86/include/asm/pgtable_64.h | 1 + arch/x86/kernel/cpu/sgx/driver.c | 2 +- arch/x86/kernel/sys_x86_64.c | 42 +++++-- arch/x86/mm/hugetlbpage.c | 9 +- arch/x86/mm/mmap.c | 4 +- drivers/char/mem.c | 2 +- drivers/dax/device.c | 6 +- fs/hugetlbfs/inode.c | 11 +- fs/proc/inode.c | 15 +-- fs/ramfs/file-mmu.c | 2 +- include/linux/huge_mm.h | 11 ++ include/linux/mm.h | 12 +- include/linux/mm_types.h | 6 +- include/linux/sched/coredump.h | 5 +- include/linux/sched/mm.h | 22 ++++ io_uring/io_uring.c | 2 +- mm/debug.c | 6 - mm/huge_memory.c | 26 +++-- mm/mmap.c | 106 +++++++++++++----- mm/shmem.c | 11 +- mm/util.c | 6 +- .../testing/selftests/x86/test_shadow_stack.c | 67 ++++++++++- 36 files changed, 319 insertions(+), 177 deletions(-)