Message ID | 20210401221104.31584-20-yu-cheng.yu@intel.com (mailing list archive) |
---|---|
State | New, archived |
Headers | show |
Series | [v24,01/30] Documentation/x86: Add CET description | expand |
On Thu, Apr 01, 2021 at 03:10:53PM -0700, Yu-cheng Yu wrote: > Can_follow_write_pte() ensures a read-only page is COWed by checking the > FOLL_COW flag, and uses pte_dirty() to validate the flag is still valid. > > Like a writable data page, a shadow stack page is writable, and becomes > read-only during copy-on-write, but it is always dirty. Thus, in the > can_follow_write_pte() check, it belongs to the writable page case and > should be excluded from the read-only page pte_dirty() check. Apply > the same changes to can_follow_write_pmd(). > > Signed-off-by: Yu-cheng Yu <yu-cheng.yu@intel.com> > Reviewed-by: Kees Cook <keescook@chromium.org> > Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> > --- > v24: > - Change arch_shadow_stack_mapping() to is_shadow_stack_mapping(). > > mm/gup.c | 8 +++++--- > mm/huge_memory.c | 8 +++++--- > 2 files changed, 10 insertions(+), 6 deletions(-) > > diff --git a/mm/gup.c b/mm/gup.c > index e40579624f10..c313cc988865 100644 > --- a/mm/gup.c > +++ b/mm/gup.c > @@ -356,10 +356,12 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, > * FOLL_FORCE can write to even unwritable pte's, but only > * after we've gone through a COW cycle and they are dirty. > */ > -static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) > +static inline bool can_follow_write_pte(pte_t pte, unsigned int flags, > + struct vm_area_struct *vma) > { > return pte_write(pte) || > - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); > + ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte) && > + !is_shadow_stack_mapping(vma->vm_flags)); It's getting too ugly. I think it deserve to be rewritten. What about: if (pte_write(pte)) return true; if ((flags & (FOLL_FORCE | FOLL_COW)) != (FOLL_FORCE | FOLL_COW)) return false; if (!pte_dirty(pte)) return false; if (is_shadow_stack_mapping(vma->vm_flags)) return false; return true; ?
diff --git a/mm/gup.c b/mm/gup.c index e40579624f10..c313cc988865 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -356,10 +356,12 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address, * FOLL_FORCE can write to even unwritable pte's, but only * after we've gone through a COW cycle and they are dirty. */ -static inline bool can_follow_write_pte(pte_t pte, unsigned int flags) +static inline bool can_follow_write_pte(pte_t pte, unsigned int flags, + struct vm_area_struct *vma) { return pte_write(pte) || - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte)); + ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte) && + !is_shadow_stack_mapping(vma->vm_flags)); } static struct page *follow_page_pte(struct vm_area_struct *vma, @@ -402,7 +404,7 @@ static struct page *follow_page_pte(struct vm_area_struct *vma, } if ((flags & FOLL_NUMA) && pte_protnone(pte)) goto no_page; - if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) { + if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags, vma)) { pte_unmap_unlock(ptep, ptl); return NULL; } diff --git a/mm/huge_memory.c b/mm/huge_memory.c index 8203bd6ae4bd..65fc0aedd577 100644 --- a/mm/huge_memory.c +++ b/mm/huge_memory.c @@ -1338,10 +1338,12 @@ vm_fault_t do_huge_pmd_wp_page(struct vm_fault *vmf, pmd_t orig_pmd) * FOLL_FORCE can write to even unwritable pmd's, but only * after we've gone through a COW cycle and they are dirty. */ -static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags) +static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags, + struct vm_area_struct *vma) { return pmd_write(pmd) || - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd)); + ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd) && + !is_shadow_stack_mapping(vma->vm_flags)); } struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, @@ -1354,7 +1356,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, assert_spin_locked(pmd_lockptr(mm, pmd)); - if (flags & FOLL_WRITE && !can_follow_write_pmd(*pmd, flags)) + if (flags & FOLL_WRITE && !can_follow_write_pmd(*pmd, flags, vma)) goto out; /* Avoid dumping huge zero page */