From patchwork Mon May 15 13:05:49 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 94131 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp6914068vqo; Mon, 15 May 2023 06:17:32 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7f4XpF/GCFou6nuhd8Bhpmmg9NOzEO4sxIJRg/9xtcoaBxchNrC/CNT2Cn8UNS5OJXwKR0 X-Received: by 2002:a05:6808:7c3:b0:38e:4e3:aada with SMTP id f3-20020a05680807c300b0038e04e3aadamr10884270oij.38.1684156652064; Mon, 15 May 2023 06:17:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684156652; cv=none; d=google.com; s=arc-20160816; b=ZKgHkNKxurcwyQrlsWcmWfZzaI0YJQskhVDP70FQbEmvzKeYSc1MSsxU5GKcRkFZN2 K4I1urku6MsZ8l+Lw4xTLtCOG6tnui6gIJGl9OWGmnteoRka7nEpRcyym4FajjIAqFAq xK15n72mLW4ay2IJ6G3iw9AvdBelx4qZdo3bHBBaGBFCzk1tUQa7CakZiqR/xZFOEGA7 oE+2bnDt3NKgV0papJe31LS0mbjNx6e+oh2yug6hVdgUO+J6bDn8A7PSuWyIRcK0Hn6T b3jAihV8soC69rCIq3okml2HDwmXIusTVYPEhoX8tyQl99X6xcU1/cvyovkM4PwpPEfy 1I2A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=+ujRp+fUzXaEUmgqKvUj1r8AuZXVhmdz7uVnxDSzpYA=; b=HA+daj/ZsVbNfhRlAoMbwc/k1TiVNfmp3gh4Tfrla5FaFYj+KcdZcpZVf3tVVnpTF8 8jOMUysKF9rl6cf6X0WbBUCMNvxzYkll4lHnWayH9neq4B19+aMVcBDisHib1KdaGNco MFKqDwrAsdkSxFdtzx9K7Zuvq4xbFOJZKGGMp3IumY6jtlXO8PWuM58Jv0wVmVwLAAa+ hdfUJAm4+U4b7XF/qula3zSAnUGGr/WD5/Q2+4WOmbO4B2QQh2GRCDt8g5eBuicFkQqD aDQyOmRvmfQDv8Nr/uxqTYMhrYZYDa2wXoVBZP0LZ4wNN1agaaYchBvSCl8Hbwyqhqgb sBNA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=Rt5yYfm0; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v132-20020acade8a000000b0038e9d9e2f51si9855319oig.304.2023.05.15.06.17.18; Mon, 15 May 2023 06:17:32 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=Rt5yYfm0; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242244AbjEONHB (ORCPT + 99 others); Mon, 15 May 2023 09:07:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50378 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242172AbjEONGj (ORCPT ); Mon, 15 May 2023 09:06:39 -0400 Received: from mail-pl1-x629.google.com (mail-pl1-x629.google.com [IPv6:2607:f8b0:4864:20::629]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 565BC2698 for ; Mon, 15 May 2023 06:06:12 -0700 (PDT) Received: by mail-pl1-x629.google.com with SMTP id d9443c01a7336-1aaf70676b6so90625685ad.3 for ; Mon, 15 May 2023 06:06:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684155963; x=1686747963; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=+ujRp+fUzXaEUmgqKvUj1r8AuZXVhmdz7uVnxDSzpYA=; b=Rt5yYfm0CK8EUUQDrYdxuqMd3n+YNkZzNsjoe7Sh2TMU94iFWNQ9XbZV1szPVs7im8 +tqDWyCl21fUMShhLNa9cxw1wcdjPBpuZrvT2b9Xhnfk8Tltierjd6QqsJqZl2irCBNZ 75n9PT1i0yFsyihOnR4+Se6E/rdRMjFhTYgCA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684155963; x=1686747963; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=+ujRp+fUzXaEUmgqKvUj1r8AuZXVhmdz7uVnxDSzpYA=; b=HoMLMCkPf6TOHZDYbY61+DOCoeuLFSeuGUrZ3Y1SU2zHkrFaTXar7pMjrjpTJcahPf W/qU8O+sXGXfcCBDg/1AknHxbTkl27vgAME00sr8s7zPjJUWIulznmbi7R5k181AcmlH KdcKKWFA0QJy+2kWuXa3O46fRVqA8fpVcSdaI1BcsFo8C3IMeE5uoc/yUIkQXApdGHlM f4hnI3HJkvtUZAuVB+0ZvhEv8QxOQ41Q8nHmxcHVEiBoUQnuUUVXwxkKtgISWfFhepiX w6vYjIPomGZVQNMFHXawq/3Dn6BEZNC0eM7eRzMeW1BQiIahRdTX62p1GjloSCq/fgIa pDeQ== X-Gm-Message-State: AC+VfDxAKx6gL7aj7y1zLVQnnTQUTota4cSuVLeQBD7ZoR0v5gbH+qWN GaQfzVxljKXQe833cvHSyFooCA== X-Received: by 2002:a17:902:ce84:b0:1ac:a030:c30a with SMTP id f4-20020a170902ce8400b001aca030c30amr28883712plg.19.1684155962938; Mon, 15 May 2023 06:06:02 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id i2-20020a170902c94200b001a988a71617sm13474160pla.192.2023.05.15.06.06.02 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 15 May 2023 06:06:02 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH 3/6] PKEY: Apply PKEY_ENFORCE_API to mprotect Date: Mon, 15 May 2023 13:05:49 +0000 Message-ID: <20230515130553.2311248-4-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.606.ga4b1b128d6-goog In-Reply-To: <20230515130553.2311248-1-jeffxu@chromium.org> References: <20230515130553.2311248-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765966245869946882?= X-GMAIL-MSGID: =?utf-8?q?1765966245869946882?= From: Jeff Xu This patch enables PKEY_ENFORCE_API for the mprotect and mprotect_pkey syscalls. Signed-off-by: Jeff Xu --- mm/mprotect.c | 25 ++++++++++++++++++++++--- 1 file changed, 22 insertions(+), 3 deletions(-) diff --git a/mm/mprotect.c b/mm/mprotect.c index 8a68fdca8487..1378be50567d 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -727,9 +727,13 @@ mprotect_fixup(struct vma_iterator *vmi, struct mmu_gather *tlb, /* * pkey==-1 when doing a legacy mprotect() + * syscall==true if this is called by syscall from userspace. + * Note: this is always true for now, added as a reminder in case that + * do_mprotect_pkey is called directly by kernel in the future. + * Also it is consistent with __do_munmap(). */ static int do_mprotect_pkey(unsigned long start, size_t len, - unsigned long prot, int pkey) + unsigned long prot, int pkey, bool syscall) { unsigned long nstart, end, tmp, reqprot; struct vm_area_struct *vma, *prev; @@ -794,6 +798,21 @@ static int do_mprotect_pkey(unsigned long start, size_t len, } } + /* + * When called by syscall from userspace, check if the calling + * thread has the PKEY permission to modify the memory mapping. + */ + if (syscall && + arch_check_pkey_enforce_api(current->mm, start, end) < 0) { + char comm[TASK_COMM_LEN]; + + pr_warn_ratelimited( + "munmap was denied on PKEY_ENFORCE_API memory, pid=%d '%s'\n", + task_pid_nr(current), get_task_comm(comm, current)); + error = -EACCES; + goto out; + } + prev = vma_prev(&vmi); if (start > vma->vm_start) prev = vma; @@ -878,7 +897,7 @@ static int do_mprotect_pkey(unsigned long start, size_t len, SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len, unsigned long, prot) { - return do_mprotect_pkey(start, len, prot, -1); + return do_mprotect_pkey(start, len, prot, -1, true); } #ifdef CONFIG_ARCH_HAS_PKEYS @@ -886,7 +905,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len, SYSCALL_DEFINE4(pkey_mprotect, unsigned long, start, size_t, len, unsigned long, prot, int, pkey) { - return do_mprotect_pkey(start, len, prot, pkey); + return do_mprotect_pkey(start, len, prot, pkey, true); } SYSCALL_DEFINE2(pkey_alloc, unsigned long, flags, unsigned long, init_val)