diff mbox series

[RFC,3/8] mm: Use get_unmapped_area_vmflags()

Message ID 20240215231332.1556787-4-rick.p.edgecombe@intel.com (mailing list archive)
State New
Headers show
Series Cover a guard gap corner case | expand

Commit Message

Edgecombe, Rick P Feb. 15, 2024, 11:13 p.m. UTC 
When memory is being placed, mmap() will take care to respect the guard
gaps of certain types of memory (VM_SHADOWSTACK, VM_GROWSUP and
VM_GROWSDOWN). In order to ensure guard gaps between mappings, mmap()
needs to consider two things:
 1. That the new mapping isn’t placed in an any existing mappings guard
    gaps.
 2. That the new mapping isn’t placed such that any existing mappings
    are not in *its* guard gaps.

The long standing behavior of mmap() is to ensure 1, but not take any care
around 2. So for example, if there is a PAGE_SIZE free area, and a
mmap() with a PAGE_SIZE size, and a type that has a guard gap is being
placed, mmap() may place the shadow stack in the PAGE_SIZE free area. Then
the mapping that is supposed to have a guard gap will not have a gap to
the adjacent VMA.

Use mm_get_unmapped_area_vmflags() in the do_mmap() so future changes
can cause shadow stack mappings to be placed with a guard gap. Also use
the THP variant that takes vm_flags, such that THP shadow stack can get the
same treatment. Adjust the vm_flags calculation to happen earlier so that
the vm_flags can be passed into __get_unmapped_area().

Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
---
 include/linux/mm.h |  2 ++
 mm/mmap.c          | 38 ++++++++++++++++++++++----------------
 2 files changed, 24 insertions(+), 16 deletions(-)

Comments

kirill.shutemov@linux.intel.com Feb. 16, 2024, 12:56 p.m. UTC | #1 
On Thu, Feb 15, 2024 at 03:13:27PM -0800, Rick Edgecombe wrote:
> @@ -1879,6 +1879,12 @@ get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
>  	return error ? error : addr;
>  }
>  
> +unsigned long
> +get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
> +		unsigned long pgoff, unsigned long flags)
> +{
> +	return __get_unmapped_area(file, addr, len, pgoff, flags, 0);
> +}
>  EXPORT_SYMBOL(get_unmapped_area);

Any reason it is not a static inline function in the header file?
Edgecombe, Rick P Feb. 16, 2024, 10:15 p.m. UTC | #2 
On Fri, 2024-02-16 at 14:56 +0200, Kirill A. Shutemov wrote:
> > +unsigned long
> > +get_unmapped_area(struct file *file, unsigned long addr, unsigned
> > long len,
> > +               unsigned long pgoff, unsigned long flags)
> > +{
> > +       return __get_unmapped_area(file, addr, len, pgoff, flags,
> > 0);
> > +}
> >   EXPORT_SYMBOL(get_unmapped_area);
> 
> Any reason it is not a static inline function in the header file?

get_unmapped_area() doesn't seem to be referenced from any modules. I
don't think it needs to be exported actually. Maybe it used to be?

It could be a static inline it seems. Why are you thinking it would be
better?

I think maybe get_unmapped_area() should stay as is, static-inline
wise, but remove the export, and the newly added __get_unmapped_area()
should be made static. Does it sound reasonable?
kirill.shutemov@linux.intel.com Feb. 17, 2024, 12:35 p.m. UTC | #3 
On Fri, Feb 16, 2024 at 10:15:05PM +0000, Edgecombe, Rick P wrote:
> On Fri, 2024-02-16 at 14:56 +0200, Kirill A. Shutemov wrote:
> > > +unsigned long
> > > +get_unmapped_area(struct file *file, unsigned long addr, unsigned
> > > long len,
> > > +               unsigned long pgoff, unsigned long flags)
> > > +{
> > > +       return __get_unmapped_area(file, addr, len, pgoff, flags,
> > > 0);
> > > +}
> > >   EXPORT_SYMBOL(get_unmapped_area);
> > 
> > Any reason it is not a static inline function in the header file?
> 
> get_unmapped_area() doesn't seem to be referenced from any modules. I
> don't think it needs to be exported actually. Maybe it used to be?
> 
> It could be a static inline it seems. Why are you thinking it would be
> better?

That's just what I would do for legacy interface wrapper for new function
interface. And save a function call for caller (it shouldn't matter in
this case, but still).

> I think maybe get_unmapped_area() should stay as is, static-inline
> wise, but remove the export, and the newly added __get_unmapped_area()
> should be made static. Does it sound reasonable?

Up to you.
diff mbox series

Patch

diff --git a/include/linux/mm.h b/include/linux/mm.h
index da5219b48d52..9addf16dbf18 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -3352,6 +3352,8 @@  unsigned long randomize_stack_top(unsigned long stack_top);
 unsigned long randomize_page(unsigned long start, unsigned long range);
 
 extern unsigned long get_unmapped_area(struct file *, unsigned long, unsigned long, unsigned long, unsigned long);
+extern unsigned long __get_unmapped_area(struct file *, unsigned long, unsigned long,
+					 unsigned long, unsigned long, vm_flags_t);
 
 extern unsigned long mmap_region(struct file *file, unsigned long addr,
 	unsigned long len, vm_flags_t vm_flags, unsigned long pgoff,
diff --git a/mm/mmap.c b/mm/mmap.c
index 2021bc040e81..2723f26f7c62 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1249,18 +1249,6 @@  unsigned long do_mmap(struct file *file, unsigned long addr,
 	if (mm->map_count > sysctl_max_map_count)
 		return -ENOMEM;
 
-	/* Obtain the address to map to. we verify (or select) it and ensure
-	 * that it represents a valid section of the address space.
-	 */
-	addr = get_unmapped_area(file, addr, len, pgoff, flags);
-	if (IS_ERR_VALUE(addr))
-		return addr;
-
-	if (flags & MAP_FIXED_NOREPLACE) {
-		if (find_vma_intersection(mm, addr, addr + len))
-			return -EEXIST;
-	}
-
 	if (prot == PROT_EXEC) {
 		pkey = execute_only_pkey(mm);
 		if (pkey < 0)
@@ -1274,6 +1262,18 @@  unsigned long do_mmap(struct file *file, unsigned long addr,
 	vm_flags |= calc_vm_prot_bits(prot, pkey) | calc_vm_flag_bits(flags) |
 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
 
+	/* Obtain the address to map to. we verify (or select) it and ensure
+	 * that it represents a valid section of the address space.
+	 */
+	addr = __get_unmapped_area(file, addr, len, pgoff, flags, vm_flags);
+	if (IS_ERR_VALUE(addr))
+		return addr;
+
+	if (flags & MAP_FIXED_NOREPLACE) {
+		if (find_vma_intersection(mm, addr, addr + len))
+			return -EEXIST;
+	}
+
 	if (flags & MAP_LOCKED)
 		if (!can_do_mlock())
 			return -EPERM;
@@ -1831,8 +1831,8 @@  unsigned long mm_get_unmapped_area_vmflags(struct mm_struct *mm, struct file *fi
 }
 
 unsigned long
-get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
-		unsigned long pgoff, unsigned long flags)
+__get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
+		unsigned long pgoff, unsigned long flags, vm_flags_t vm_flags)
 {
 	unsigned long (*get_area)(struct file *, unsigned long,
 				  unsigned long, unsigned long, unsigned long)
@@ -1865,8 +1865,8 @@  get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
 	if (get_area)
 		addr = get_area(file, addr, len, pgoff, flags);
 	else
-		addr = mm_get_unmapped_area(current->mm, file, addr, len,
-					    pgoff, flags);
+		addr = mm_get_unmapped_area_vmflags(current->mm, file, addr, len,
+						    pgoff, flags, vm_flags);
 	if (IS_ERR_VALUE(addr))
 		return addr;
 
@@ -1879,6 +1879,12 @@  get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
 	return error ? error : addr;
 }
 
+unsigned long
+get_unmapped_area(struct file *file, unsigned long addr, unsigned long len,
+		unsigned long pgoff, unsigned long flags)
+{
+	return __get_unmapped_area(file, addr, len, pgoff, flags, 0);
+}
 EXPORT_SYMBOL(get_unmapped_area);
 
 unsigned long