From patchwork Mon May 15 13:05:51 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13241399 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 05390C77B75 for ; Mon, 15 May 2023 13:07:10 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 744D5900006; Mon, 15 May 2023 09:07:10 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 6F4FF900002; Mon, 15 May 2023 09:07:10 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5E3BC900006; Mon, 15 May 2023 09:07:10 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 488A8900002 for ; Mon, 15 May 2023 09:07:10 -0400 (EDT) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 01DFC8126F for ; Mon, 15 May 2023 13:07:09 +0000 (UTC) X-FDA: 80792515020.18.5DE699A Received: from mail-pl1-f176.google.com (mail-pl1-f176.google.com [209.85.214.176]) by imf02.hostedemail.com (Postfix) with ESMTP id 7AF6380188 for ; Mon, 15 May 2023 13:06:06 +0000 (UTC) Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=AE5TPYdJ; spf=pass (imf02.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.214.176 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684155966; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=lhTOrV9Ep9418v/k9QWjv1EjLbKrSL2Q0hL/MSOj6fE=; b=etpamlidbIGDav2U2W4fEdmhFF2ON4gxTjpa0YqJk1MDYW4l+QyGozVuiPd7WqKNA+PPDb fR7qJsbn1hOChWTaK+/uIuZOopmqdWmW3CRnXF/LWdYR8CiAmzqD662gBRq23d3rPC8Lzr oFG6GIC01wnD5b3wkea/ryxQhO97znU= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684155966; a=rsa-sha256; cv=none; b=FdcEgjakLG//5+YJrHYAN8H58q0kA3rcedU+xVHnoG9FqaHdZEtbGfwCP3e+3Z+HSFfeXW 4dmBCK8jW0VbSnR+FMpC9olIEtqc8hBKtWxQ+sfdbR3JYEw+GwRwRsLhL7l7bRiBkSlKe1 hLq0e++NYAvYH9lo0+6LFZaCiBL5f3Q= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=AE5TPYdJ; spf=pass (imf02.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.214.176 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org Received: by mail-pl1-f176.google.com with SMTP id d9443c01a7336-1aaef97652fso87518365ad.0 for ; Mon, 15 May 2023 06:06:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684155965; x=1686747965; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=lhTOrV9Ep9418v/k9QWjv1EjLbKrSL2Q0hL/MSOj6fE=; b=AE5TPYdJKh+upwVCJh3G8m4CCCGvl07nH8DA+I/nklujQ9YNY+5+hrzRPCyiIGbHCd /G3dlUxrCo3tGgXlYHwHpAnY3srtCMkn2jHsUMg6pylapAZdL3XF43Ekl+CjStZbtfNz qtYa8TABInHSPUkJf4aHK+0vNIdvP6UNEHHos= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684155965; x=1686747965; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=lhTOrV9Ep9418v/k9QWjv1EjLbKrSL2Q0hL/MSOj6fE=; b=JL83gfX+VyA2LGWK/o+kjRi9MRjZWtpzIS1Xe9oXhR2ru3JUa/fIOM87Wxjy15nWhQ ORIYe3IBSlNriFJ9duyBie3+IyT1JT7rKJajQ3ODFxHdlkpdTLxBQy+Nu0z0hROujbPD zRv/LxY3O1K4GBHYkg3ge2Ma92QXZfYbv8ifLwL06iAHdJ3Uq8oNmDRQmYZxXAOB7UV/ nYnz/+fNnPqCrg4Fw1HaAEC/CIl0Ci7+CO72ZLsnivSZtHp4LKx/na/TI+PVuV11Mif9 smhykAx0BzsX0KSyNJu7yA9U7X3awy+1K+rVPhCUDnOMWILFtEvhVU+v85O1xoTKlOfx 2BbQ== X-Gm-Message-State: AC+VfDxALZscyG0BLjgkwaix5gG2OIKCqromyqcuVE6gKfcRBlIZvoOQ n2Xd9sX6CutpuHf4oN3/jVKk2g== X-Google-Smtp-Source: ACHHUZ4pDHGfCKYoQ6o3ND+tn3Cpa2PwKLfI3Rj7SdWtOItCYzvZZqHrfIDR9pXglq7oDkkVfGKQ/Q== X-Received: by 2002:a17:902:da84:b0:1ac:a28e:4b29 with SMTP id j4-20020a170902da8400b001aca28e4b29mr29799652plx.26.1684155965066; Mon, 15 May 2023 06:06:05 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id z6-20020a170902834600b001a980a23802sm13465239pln.111.2023.05.15.06.06.04 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 15 May 2023 06:06:04 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH 5/6] KEY: Apply PKEY_ENFORCE_API to munmap Date: Mon, 15 May 2023 13:05:51 +0000 Message-ID: <20230515130553.2311248-6-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.606.ga4b1b128d6-goog In-Reply-To: <20230515130553.2311248-1-jeffxu@chromium.org> References: <20230515130553.2311248-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspamd-Queue-Id: 7AF6380188 X-Rspam-User: X-Rspamd-Server: rspam06 X-Stat-Signature: h5guuhzn7qs41yyoitexn14yqjgja45e X-HE-Tag: 1684155966-755795 X-HE-Meta: U2FsdGVkX1/F5lehs03wEEEKgCnq4gTuAJGKYMxJiPyz6dXhojZLtq9fdrnQ/+dCMP29MriAwV1EdJJOqnB9RNtGW/mdq/k+PEg42zIDVjNFzablvQo6dpqUKlfAFmHgOUczMo/aXI4FSPE/jm230cFsnc+CqazTQKXoURAqoHr/7HZzP2VWz3F+y5B6wZe5SvT2Pk8UAoJ9Un/e2MMss5DUMoNdvCLKwrM7fTxXzoiQ5PYRL8Hv+RjKgQIne7Zc/NCcRvkdQqmqAhOl7SkM5tfbvmAHaRLq7ykUssjKg2hja2Pn10yRBxEsnr0Dy0qEX1/NXNZQjtoEcEJ9tI0FCZ8CCdibcNc4dsVjC+8IAMcKia7OzOqH/kZQSw3KmGh8rcqmPcDNO2Uc454aqNOQer1LNuLCuKts1qZFoUi9vj5CLa1nm8PRMUNO468Aq+xKq2WpWjn/JDGFirev46MC4hrUe7+5W2KEDyaQhsHQzxiogmlCxbCITL5IiDQMKrOuW9gLKE7CJeo1AcJemq7tXvqobvqt/8yLY5T602zDHpXu51zSl2iCGOWUzObWjNJqs01NJKKQFWg0YHhl+VfuB+x107frveEEMpldt7Zk93EwZYa36wA46UnHfCgyqkWsWHyTlmtaEQolCk7PKLD6v2JWC6T+9fB1hhLbY9TjjoNy37yqGUd2IKC508zRFsCkDvqKabw6RvSmgnSOcx9+j3r4nlS6vApGFP52fX1xnKDchvU71MvEVnK0dUavTkbndDz16pj1i5I5yiO0o40/HBjQOu+ZUCIDv1/6aRlvz/j2zDbL+tMsU4A5JLVJFsEK8NNeCcbgc1xo2cKnfeMk7p8MQwfNX96dLwBpyCZaSZ5Dryghj8nmNBCutqqHHaiL+tWQ8cgU5UN0LofuN+wlxTKe7GX+WpYr0gzjJ+eJGk1NFCn9ntsAVXLWqg2lQv7k3b3NPfcCMphfn13qKbd dD9PxVK/ xcnDslQDCDoMlq+x1OwEY+LMuC2wK6Ii4lqBrJ1azAFFh6xYHO752VzecL/TESXyLlDl7/iZygJAHY5m+h/zJ+ryWQw/rdZluoghf968yFUSjjoIcm9u6R3kePI15MjqQ5pVd2wkjraOR7zch/2YeB8V2pfEVNuxrRqrgux9whnqRLTLDkrBOGOqP0vARmgA60OtmlCLL33U0VmYVSm219pHWbtuj4u0n+uDNqoaRFD5K7siwCnXOpB8MUJf3AAc/VSC9hRHF6enKOVVogTnEUXYc92Duw4Syt7n1M1t8vlLA0G27iuV6GtfJ/P+K/5QHTWjZRH6l08tEeotlvCUoXiAUZ8A+988Dt6VNWTwNtt6p3DyjSHvS/iMAew== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu This patch enables PKEY_ENFORCE_API for the munmap syscall. Signed-off-by: Jeff Xu --- include/linux/mm.h | 2 +- mm/mmap.c | 34 ++++++++++++++++++++++++++-------- mm/mremap.c | 6 ++++-- 3 files changed, 31 insertions(+), 11 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 27ce77080c79..48076e845d53 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3136,7 +3136,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long pgoff, unsigned long *populate, struct list_head *uf); extern int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, unsigned long start, size_t len, struct list_head *uf, - bool downgrade); + bool downgrade, bool syscall); extern int do_munmap(struct mm_struct *, unsigned long, size_t, struct list_head *uf); extern int do_madvise(struct mm_struct *mm, unsigned long start, size_t len_in, int behavior); diff --git a/mm/mmap.c b/mm/mmap.c index 13678edaa22c..29329aa794a6 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2498,6 +2498,7 @@ do_vmi_align_munmap(struct vma_iterator *vmi, struct vm_area_struct *vma, * @uf: The userfaultfd list_head * @downgrade: set to true if the user wants to attempt to write_downgrade the * mmap_lock + * @syscall: set to true if this is called from syscall entry * * This function takes a @mas that is either pointing to the previous VMA or set * to MA_START and sets it up to remove the mapping(s). The @len will be @@ -2507,7 +2508,7 @@ do_vmi_align_munmap(struct vma_iterator *vmi, struct vm_area_struct *vma, */ int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, unsigned long start, size_t len, struct list_head *uf, - bool downgrade) + bool downgrade, bool syscall) { unsigned long end; struct vm_area_struct *vma; @@ -2519,6 +2520,19 @@ int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, if (end == start) return -EINVAL; + /* + * When called by syscall from userspace, check if the calling + * thread has the PKEY permission to modify the memory mapping. + */ + if (syscall && arch_check_pkey_enforce_api(mm, start, end) < 0) { + char comm[TASK_COMM_LEN]; + + pr_warn_ratelimited( + "munmap was denied on PKEY_ENFORCE_API memory, pid=%d '%s'\n", + task_pid_nr(current), get_task_comm(comm, current)); + return -EACCES; + } + /* arch_unmap() might do unmaps itself. */ arch_unmap(mm, start, end); @@ -2541,7 +2555,7 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, { VMA_ITERATOR(vmi, mm, start); - return do_vmi_munmap(&vmi, mm, start, len, uf, false); + return do_vmi_munmap(&vmi, mm, start, len, uf, false, false); } unsigned long mmap_region(struct file *file, unsigned long addr, @@ -2575,7 +2589,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr, } /* Unmap any existing mapping in the area */ - if (do_vmi_munmap(&vmi, mm, addr, len, uf, false)) + if (do_vmi_munmap(&vmi, mm, addr, len, uf, false, false)) return -ENOMEM; /* @@ -2792,7 +2806,11 @@ unsigned long mmap_region(struct file *file, unsigned long addr, return error; } -static int __vm_munmap(unsigned long start, size_t len, bool downgrade) +/* + * @syscall: set to true if this is called from syscall entry + */ +static int __vm_munmap(unsigned long start, size_t len, bool downgrade, + bool syscall) { int ret; struct mm_struct *mm = current->mm; @@ -2802,7 +2820,7 @@ static int __vm_munmap(unsigned long start, size_t len, bool downgrade) if (mmap_write_lock_killable(mm)) return -EINTR; - ret = do_vmi_munmap(&vmi, mm, start, len, &uf, downgrade); + ret = do_vmi_munmap(&vmi, mm, start, len, &uf, downgrade, syscall); /* * Returning 1 indicates mmap_lock is downgraded. * But 1 is not legal return value of vm_munmap() and munmap(), reset @@ -2820,14 +2838,14 @@ static int __vm_munmap(unsigned long start, size_t len, bool downgrade) int vm_munmap(unsigned long start, size_t len) { - return __vm_munmap(start, len, false); + return __vm_munmap(start, len, false, false); } EXPORT_SYMBOL(vm_munmap); SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len) { addr = untagged_addr(addr); - return __vm_munmap(addr, len, true); + return __vm_munmap(addr, len, true, true); } @@ -3055,7 +3073,7 @@ int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags) if (ret) goto limits_failed; - ret = do_vmi_munmap(&vmi, mm, addr, len, &uf, 0); + ret = do_vmi_munmap(&vmi, mm, addr, len, &uf, 0, false); if (ret) goto munmap_failed; diff --git a/mm/mremap.c b/mm/mremap.c index b11ce6c92099..768e5bd4e8b5 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -703,7 +703,8 @@ static unsigned long move_vma(struct vm_area_struct *vma, } vma_iter_init(&vmi, mm, old_addr); - if (do_vmi_munmap(&vmi, mm, old_addr, old_len, uf_unmap, false) < 0) { + if (do_vmi_munmap(&vmi, mm, old_addr, old_len, uf_unmap, false, false) < + 0) { /* OOM: unable to split vma, just get accounts right */ if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP)) vm_acct_memory(old_len >> PAGE_SHIFT); @@ -993,7 +994,8 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, VMA_ITERATOR(vmi, mm, addr + new_len); retval = do_vmi_munmap(&vmi, mm, addr + new_len, - old_len - new_len, &uf_unmap, true); + old_len - new_len, &uf_unmap, true, + false); /* Returning 1 indicates mmap_lock is downgraded to read. */ if (retval == 1) { downgraded = true;