From patchwork Tue Oct 17 09:08:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13424816 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6661FCDB474 for ; Tue, 17 Oct 2023 09:08:38 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 3636A8D0101; Tue, 17 Oct 2023 05:08:29 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 312E58D0108; Tue, 17 Oct 2023 05:08:29 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 0FB6C8D0101; Tue, 17 Oct 2023 05:08:29 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id EE9E68D0101 for ; Tue, 17 Oct 2023 05:08:28 -0400 (EDT) Received: from smtpin01.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id CFF8D1A1032 for ; Tue, 17 Oct 2023 09:08:28 +0000 (UTC) X-FDA: 81354377496.01.503D390 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) by imf07.hostedemail.com (Postfix) with ESMTP id 0A4454001C for ; Tue, 17 Oct 2023 09:08:26 +0000 (UTC) Authentication-Results: imf07.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=UvJV2IFY; spf=pass (imf07.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.214.179 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1697533707; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=y4l+64vDxS/g2eoGFpPCE9LGtKZAVDbLXZ7/tGX4pxw=; b=tdhM3iNrWWW9RfNg+/Mbtf1KMB0yWSGU9JH8BG4oDmKXJE8UWZvXNgoBUhaGaCbbabuHAb iyTdIWWdRaZLaMl7qLxdOX3wpEnrzBXHhNuFQZ49gyjpBMtPWn6H4OUkTy7i7LAcflSf8O zX9zco/JVvsnsK3G4amdrkXOgMSxArI= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1697533707; a=rsa-sha256; cv=none; b=b7hAtMWuz7w0K1ITiA+yia0ceIKyX0mCfNX8iGOJgk1Qa4H/kMJMIyBykf0/U8jcg+NM5W 6/D+Vpk8CMF76fl/J9Vi52Xh1wwL/xTmtOwH1FxXsbdbtyjeCfNfkl9fMlxFJqGRb0q4hP 0S6z5rjTIOVBHks7O7BeaStC5z7hNuE= ARC-Authentication-Results: i=1; imf07.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=UvJV2IFY; spf=pass (imf07.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.214.179 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-1c0ecb9a075so35841705ad.2 for ; Tue, 17 Oct 2023 02:08:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1697533706; x=1698138506; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=y4l+64vDxS/g2eoGFpPCE9LGtKZAVDbLXZ7/tGX4pxw=; b=UvJV2IFYOojuMrhBrhtqDao9dIMGp+02pRv+Z4iwgAnPPss9X0HJa2Xkrezer69BlD 16bzbwCt9oPXf0RygcFbMBLZZ/T4wcpO7P0FC0JN6KnQixkMQKJoqGkpujzYWC4GNAkr bbKSrGxM/LjBsLyvxVECwz/AQvOiRhSjd83fI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697533706; x=1698138506; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=y4l+64vDxS/g2eoGFpPCE9LGtKZAVDbLXZ7/tGX4pxw=; b=DI528JhAOQVyxYjEptVvszyVFXQ1XAfAD0ehZFR70DCRYOvSBfQ0Fn3hYOBajJnnqG nf3yHcgLjPJNBgKomGhVKk3RpD1Z5fvHk+mC0GNtKN2zdi0C3zspyMjtgsQMt7iZzAWc brgdf9T3tkg9hHlEk5kA4cf3TlmU2iROXFn8OIA6eamRRlP0gZw0RJrvGXyLkHwWDtZk jXo8IAUsexabaBYrUcIbAfvWmn9A0RY7JorQ2y0MCjgLvndzvIzNQ/C96q2Pveos3mzL RrYvyG6YmAW294sHEEUaWMU5D0CDnet8Kj6mb/ZuIhQytZRCkvnn6sKGJVkaoo+/nhEp TT5g== X-Gm-Message-State: AOJu0YzyMXWDfN0tN/xcVbz5JQ28Ux2uHZOEhpl+4WSY5cbaLYwkmobI LBS8FpyfVZo7m/2X767TbUQO5A== X-Google-Smtp-Source: AGHT+IH3ijh2spAMvSfaaAyElvlHfpC0/idOO3bXawN0BNxN5uSfUsaSC/pvKljbIONUXHU4GOlTmA== X-Received: by 2002:a17:902:da83:b0:1b2:4852:9a5f with SMTP id j3-20020a170902da8300b001b248529a5fmr1721130plx.54.1697533706010; Tue, 17 Oct 2023 02:08:26 -0700 (PDT) Received: from localhost (9.184.168.34.bc.googleusercontent.com. [34.168.184.9]) by smtp.gmail.com with UTF8SMTPSA id k13-20020a170902760d00b001acae9734c0sm986537pll.266.2023.10.17.02.08.25 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 17 Oct 2023 02:08:25 -0700 (PDT) From: jeffxu@chromium.org To: akpm@linux-foundation.org, keescook@chromium.org, jannh@google.com, sroettger@google.com, willy@infradead.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org Cc: jeffxu@google.com, jorgelo@chromium.org, groeck@chromium.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, surenb@google.com, alex.sierra@amd.com, apopple@nvidia.com, aneesh.kumar@linux.ibm.com, axelrasmussen@google.com, ben@decadent.org.uk, catalin.marinas@arm.com, david@redhat.com, dwmw@amazon.co.uk, ying.huang@intel.com, hughd@google.com, joey.gouly@arm.com, corbet@lwn.net, wangkefeng.wang@huawei.com, Liam.Howlett@oracle.com, lstoakes@gmail.com, mawupeng1@huawei.com, linmiaohe@huawei.com, namit@vmware.com, peterx@redhat.com, peterz@infradead.org, ryan.roberts@arm.com, shr@devkernel.io, vbabka@suse.cz, xiujianfeng@huawei.com, yu.ma@intel.com, zhangpeng362@huawei.com, dave.hansen@intel.com, luto@kernel.org, linux-hardening@vger.kernel.org Subject: [RFC PATCH v2 7/8] mseal:Check seal flag for mmap(2) Date: Tue, 17 Oct 2023 09:08:14 +0000 Message-ID: <20231017090815.1067790-8-jeffxu@chromium.org> X-Mailer: git-send-email 2.42.0.655.g421f12c284-goog In-Reply-To: <20231017090815.1067790-1-jeffxu@chromium.org> References: <20231017090815.1067790-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspamd-Queue-Id: 0A4454001C X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: r7torw19f3tf9wepq5o65yk63ftcr3wh X-HE-Tag: 1697533706-478768 X-HE-Meta: U2FsdGVkX1+iJkspgFEFbm56xBlilShQf12plf6IOO+JFn+kaYCt35kbME+cLKHh65j70e+j4Mow95dV5zEPsCnWA3wI6Emtnz/MP7RYA2KxGEga6aexCtPzVC1nNK6tAKg0LjHhtCjnyeAnPAdAYMdB2wb7ohdA+LVn2Apaz42r3PrviluHgq9EfV41CoV9TJCuFnBvV25I86QLfBggFnwZFsg2LiSaBvyIrU0xIFpoAbu7QxgQ1kNy61q1ZGPNuHvrzML3uCNrbXpiJbmnWZefyuqABlRU9dnTMaRIIRgnXu079kKqbfz9nAPhC0myPg8et1ZB1SRpM6EFb+ncGGfLraAyiMxlKd/Cth4eYHpGMSVrMfvcyaiVBP11QHJ5ZtI8LHgb0NLwIur+3LPK86mrOJizKlN5hGe71QQ7SIdQqFZ+pt5dTzWOadIuhY84Ntcm0JgioW9/8qwKZuUBlwhHerBZufD7Yc8nd6sMyTZrdFIMgDZCD3pzXJBqEOp+BXaN0d2/6W9NmUP41rJkirXo8xDrfWJRZ0FTNm1t+z1e3OwtkPAbWpFRcjCIl+wuVkBVOX9SkhkD3X0/WMP1HBDUvv3NTFJKp3XXhyeXMWyM1E2cdQbpUXiAQyn+M/tnwH8ej+byBDcQqWE5HfBh5kmyh23ZMsHkm5A5OynqveDF4X5Qu8N2PnljHWoWMqn32HE6ys6C/cFM8SN16xszjN+Q43mciHmv7OQ4MlTFDuIK5arNlOxXYZIgUu1KBZ4BLTGIlqZvhVarEPrEevN57xWEgpU5QhyR3YtpNyQk+YqjoDv8YhZhAoWpcwaKeyUScJvVmu6FOaX98OCkRKq4pWmnjlI2BMDpNTkdgz/pQd3OgFQrQzeSZrRccrkup3atdzRcLFnhYWWWVapcPZKMlAbdgNKReDT0pogy3QBdZotKbjcouyrmysqbhoOHtdon8zcoVEai+8AdLE8mxOA 0Fds9PiJ uinxiXfOLHeppRrls+2RyGBbN/b6U87bUydmg9FVVENLCeHp9s225X9U04LHB+sD74vDkgFYSCV/Is2pM03/Bfx5J2mlgtN5z/5bldJcROornFCTmxZ/9gfrdGAhpdwZi9nPfkS6rPrsEf3u9je9Q7uOLBgkN7qvcx+M9AXr6wIbgENpSCPtIrl8m+XT9CRMi5foVXrsVhqdPDrC988un6ax6hf6XcN0CfcO5WL2F/azwagsQ+85CxqVwjdF3ED7Iel3PFbgtpak6uwLkK0wicVVEDuBu+YYRPGhyrN6qtugpx/6uFUZDQqSmhQ4CjmgnSRtfeB8KpUn8qNk= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu mmap(2) can change a protection of existing VMAs. Sealing will prevent unintended mmap(2) call. What this patch does: When a mmap(2) is invoked, if one of its VMAs has MM_SEAL_MMAP set from previous mseal(2) call, the mmap(2) will fail, without any VMAs modified. The patch is based on following: There are two cases: with MMU, NO MMU. For MMU case: 1. ksys_mmap_pgoff() currently are called in 2 places: SYSCALL_DEFINE1(old_mmap, ...) SYSCALL_DEFINE6(mmap_pgoff,...) Since both are syscall entry point, omit adding checkSeals in the signature of ksys_mmap_pgoff(). 2. ksys_mmap_pgoff() calls vm_mmap_pgoff() with checkSeals = MM_SEAL_MMAP, in turn, checkSeals flag is passed into do_mmap(), Note: Of all the call paths that goes into do_mmap(), ksys_mmap_pgoff() is the only place where checkSeals = MM_SEAL_MMAP. The rest has checkSeals = 0. 3. In do_mmap(), call can_modify_mm() before any update is maded to the VMAs. For NON-MMU case: Set checkSeals = 0 for all cases. Signed-off-by: Jeff Xu --- fs/aio.c | 5 +++-- include/linux/mm.h | 5 ++++- ipc/shm.c | 3 ++- mm/internal.h | 4 ++-- mm/mmap.c | 22 ++++++++++++++++++---- mm/nommu.c | 6 ++++-- mm/util.c | 8 +++++--- 7 files changed, 38 insertions(+), 15 deletions(-) diff --git a/fs/aio.c b/fs/aio.c index b3174da80ff6..7f4863d0082d 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -557,8 +557,9 @@ static int aio_setup_ring(struct kioctx *ctx, unsigned int nr_events) } ctx->mmap_base = do_mmap(ctx->aio_ring_file, 0, ctx->mmap_size, - PROT_READ | PROT_WRITE, - MAP_SHARED, 0, &unused, NULL); + PROT_READ | PROT_WRITE, MAP_SHARED, 0, &unused, + NULL, 0); + mmap_write_unlock(mm); if (IS_ERR((void *)ctx->mmap_base)) { ctx->mmap_size = 0; diff --git a/include/linux/mm.h b/include/linux/mm.h index f2f316522f2a..9f496c9f2970 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3274,9 +3274,12 @@ extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned lo extern unsigned long mmap_region(struct file *file, unsigned long addr, unsigned long len, vm_flags_t vm_flags, unsigned long pgoff, struct list_head *uf); + extern unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, - unsigned long pgoff, unsigned long *populate, struct list_head *uf); + unsigned long pgoff, unsigned long *populate, struct list_head *uf, + unsigned long checkSeals); + extern int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, unsigned long start, size_t len, struct list_head *uf, bool unlock, unsigned long checkSeals); diff --git a/ipc/shm.c b/ipc/shm.c index 60e45e7045d4..3660f522ecba 100644 --- a/ipc/shm.c +++ b/ipc/shm.c @@ -1662,7 +1662,8 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, goto invalid; } - addr = do_mmap(file, addr, size, prot, flags, 0, &populate, NULL); + addr = do_mmap(file, addr, size, prot, flags, 0, &populate, NULL, + 0); *raddr = addr; err = 0; if (IS_ERR_VALUE(addr)) diff --git a/mm/internal.h b/mm/internal.h index d1d4bf4e63c0..2c074d8c6abd 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -800,8 +800,8 @@ extern u64 hwpoison_filter_memcg; extern u32 hwpoison_filter_enable; extern unsigned long __must_check vm_mmap_pgoff(struct file *, unsigned long, - unsigned long, unsigned long, - unsigned long, unsigned long); + unsigned long, unsigned long, unsigned long, unsigned long, + unsigned long checkSeals); extern void set_pageblock_order(void); unsigned long reclaim_pages(struct list_head *folio_list); diff --git a/mm/mmap.c b/mm/mmap.c index 62d592f16f45..edcadd2bb394 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1197,7 +1197,8 @@ static inline bool file_mmap_ok(struct file *file, struct inode *inode, unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags, unsigned long pgoff, - unsigned long *populate, struct list_head *uf) + unsigned long *populate, struct list_head *uf, + unsigned long checkSeals) { struct mm_struct *mm = current->mm; vm_flags_t vm_flags; @@ -1365,6 +1366,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr, vm_flags |= VM_NORESERVE; } + if (!can_modify_mm(mm, addr, addr + len, MM_SEAL_MMAP)) + return -EACCES; + addr = mmap_region(file, addr, len, vm_flags, pgoff, uf); if (!IS_ERR_VALUE(addr) && ((vm_flags & VM_LOCKED) || @@ -1411,7 +1415,17 @@ unsigned long ksys_mmap_pgoff(unsigned long addr, unsigned long len, return PTR_ERR(file); } - retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff); + /* + * vm_mmap_pgoff() currently called from two places: + * SYSCALL_DEFINE1(old_mmap, ...) + * SYSCALL_DEFINE6(mmap_pgoff,...) + * and not in any other places. + * Therefore, omit changing the signature of vm_mmap_pgoff() + * Otherwise, we might need to add checkSeals and pass it + * from all callers of vm_mmap_pgoff(). + */ + retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff, + MM_SEAL_MMAP); out_fput: if (file) fput(file); @@ -3016,8 +3030,8 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, flags |= MAP_LOCKED; file = get_file(vma->vm_file); - ret = do_mmap(vma->vm_file, start, size, - prot, flags, pgoff, &populate, NULL); + ret = do_mmap(vma->vm_file, start, size, prot, flags, pgoff, + &populate, NULL, 0); fput(file); out: mmap_write_unlock(mm); diff --git a/mm/nommu.c b/mm/nommu.c index 8dba41cfc44d..dc83651ee777 100644 --- a/mm/nommu.c +++ b/mm/nommu.c @@ -1018,7 +1018,8 @@ unsigned long do_mmap(struct file *file, unsigned long flags, unsigned long pgoff, unsigned long *populate, - struct list_head *uf) + struct list_head *uf, + unsigned long checkSeals) { struct vm_area_struct *vma; struct vm_region *region; @@ -1262,7 +1263,8 @@ unsigned long ksys_mmap_pgoff(unsigned long addr, unsigned long len, goto out; } - retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff); + retval = vm_mmap_pgoff(file, addr, len, prot, flags, pgoff, + 0); if (file) fput(file); diff --git a/mm/util.c b/mm/util.c index 4ed8b9b5273c..ca9d8c69267c 100644 --- a/mm/util.c +++ b/mm/util.c @@ -532,7 +532,8 @@ EXPORT_SYMBOL_GPL(account_locked_vm); unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr, unsigned long len, unsigned long prot, - unsigned long flag, unsigned long pgoff) + unsigned long flag, unsigned long pgoff, + unsigned long checkseals) { unsigned long ret; struct mm_struct *mm = current->mm; @@ -544,7 +545,7 @@ unsigned long vm_mmap_pgoff(struct file *file, unsigned long addr, if (mmap_write_lock_killable(mm)) return -EINTR; ret = do_mmap(file, addr, len, prot, flag, pgoff, &populate, - &uf); + &uf, checkseals); mmap_write_unlock(mm); userfaultfd_unmap_complete(mm, &uf); if (populate) @@ -562,7 +563,8 @@ unsigned long vm_mmap(struct file *file, unsigned long addr, if (unlikely(offset_in_page(offset))) return -EINVAL; - return vm_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT); + return vm_mmap_pgoff(file, addr, len, prot, flag, offset >> PAGE_SHIFT, + 0); } EXPORT_SYMBOL(vm_mmap);