From patchwork Fri Nov 5 20:39:22 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Morton X-Patchwork-Id: 12605543 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32E61C433F5 for ; Fri, 5 Nov 2021 20:39:25 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id DE7736056B for ; Fri, 5 Nov 2021 20:39:24 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org DE7736056B Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=linux-foundation.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 76D42940056; Fri, 5 Nov 2021 16:39:24 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 68291940049; Fri, 5 Nov 2021 16:39:24 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5205F940056; Fri, 5 Nov 2021 16:39:24 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0233.hostedemail.com [216.40.44.233]) by kanga.kvack.org (Postfix) with ESMTP id 3182A940049 for ; Fri, 5 Nov 2021 16:39:24 -0400 (EDT) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id E72217798B for ; Fri, 5 Nov 2021 20:39:23 +0000 (UTC) X-FDA: 78776041806.24.8B69061 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf17.hostedemail.com (Postfix) with ESMTP id 98DA2F0003A3 for ; Fri, 5 Nov 2021 20:39:23 +0000 (UTC) Received: by mail.kernel.org (Postfix) with ESMTPSA id 914A06056B; Fri, 5 Nov 2021 20:39:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linux-foundation.org; s=korg; t=1636144762; bh=w5HZz/nvaFNsq3igD47VFQavMrp+gHMdvsVCo8mPFbE=; h=Date:From:To:Subject:In-Reply-To:From; b=DiYUdMdWnAa/FcSkNwBMfMl+/77/yCJWzVDgCFNNurneaTphJVv5r4DqimGt7VxDe PUeaOOg03YWykBP35Ah57dvdsv9L/U4Riq7bH0zTZwImMMJbFnCsBCk1AJ5tbCj5Nr ToQNkNi3YizPXWXRA999NCYX/6D10EUFlQ6sviN0= Date: Fri, 05 Nov 2021 13:39:22 -0700 From: Andrew Morton To: akpm@linux-foundation.org, andreyknvl@gmail.com, david@redhat.com, hch@lst.de, keescook@chromium.org, linux-mm@kvack.org, mgorman@suse.de, mm-commits@vger.kernel.org, peterz@infradead.org, torvalds@linux-foundation.org, urezki@gmail.com, will@kernel.org Subject: [patch 090/262] mm/vmalloc: don't allow VM_NO_GUARD on vmap() Message-ID: <20211105203922.X-KS3cTcm%akpm@linux-foundation.org> In-Reply-To: <20211105133408.cccbb98b71a77d5e8430aba1@linux-foundation.org> User-Agent: s-nail v14.8.16 X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 98DA2F0003A3 X-Stat-Signature: qm174tpdhkx3nu9wfhcfnse84decfszf Authentication-Results: imf17.hostedemail.com; dkim=pass header.d=linux-foundation.org header.s=korg header.b=DiYUdMdW; dmarc=none; spf=pass (imf17.hostedemail.com: domain of akpm@linux-foundation.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=akpm@linux-foundation.org X-HE-Tag: 1636144763-227793 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Peter Zijlstra Subject: mm/vmalloc: don't allow VM_NO_GUARD on vmap() The vmalloc guard pages are added on top of each allocation, thereby isolating any two allocations from one another. The top guard of the lower allocation is the bottom guard guard of the higher allocation etc. Therefore VM_NO_GUARD is dangerous; it breaks the basic premise of isolating separate allocations. There are only two in-tree users of this flag, neither of which use it through the exported interface. Ensure it stays this way. Link: https://lkml.kernel.org/r/YUMfdA36fuyZ+/xt@hirez.programming.kicks-ass.net Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Christoph Hellwig Reviewed-by: David Hildenbrand Acked-by: Will Deacon Acked-by: Kees Cook Cc: Andrey Konovalov Cc: Mel Gorman Cc: Uladzislau Rezki Signed-off-by: Andrew Morton --- include/linux/vmalloc.h | 2 +- mm/vmalloc.c | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) --- a/include/linux/vmalloc.h~mm-vmalloc-dont-allow-vm_no_guard-on-vmap +++ a/include/linux/vmalloc.h @@ -22,7 +22,7 @@ struct notifier_block; /* in notifier.h #define VM_USERMAP 0x00000008 /* suitable for remap_vmalloc_range */ #define VM_DMA_COHERENT 0x00000010 /* dma_alloc_coherent */ #define VM_UNINITIALIZED 0x00000020 /* vm_struct is not fully initialized */ -#define VM_NO_GUARD 0x00000040 /* don't add guard page */ +#define VM_NO_GUARD 0x00000040 /* ***DANGEROUS*** don't add guard page */ #define VM_KASAN 0x00000080 /* has allocated kasan shadow memory */ #define VM_FLUSH_RESET_PERMS 0x00000100 /* reset direct map and flush TLB on unmap, can't be freed in atomic context */ #define VM_MAP_PUT_PAGES 0x00000200 /* put pages and free array in vfree */ --- a/mm/vmalloc.c~mm-vmalloc-dont-allow-vm_no_guard-on-vmap +++ a/mm/vmalloc.c @@ -2743,6 +2743,13 @@ void *vmap(struct page **pages, unsigned might_sleep(); + /* + * Your top guard is someone else's bottom guard. Not having a top + * guard compromises someone else's mappings too. + */ + if (WARN_ON_ONCE(flags & VM_NO_GUARD)) + flags &= ~VM_NO_GUARD; + if (count > totalram_pages()) return NULL;