From patchwork Mon May 15 13:05:51 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 94135 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b0ea:0:b0:3b6:4342:cba0 with SMTP id b10csp6914679vqo; Mon, 15 May 2023 06:18:24 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ6Fks2SfjLgQobaSRSOtGTL3GnHKeXAmOxJ2P2AWLBx2bdcqreQDCqAvY12qQjipYLeKXAz X-Received: by 2002:a05:6a00:80c:b0:64c:b45e:bcbf with SMTP id m12-20020a056a00080c00b0064cb45ebcbfmr1214621pfk.4.1684156703998; Mon, 15 May 2023 06:18:23 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1684156703; cv=none; d=google.com; s=arc-20160816; b=s0hDgfpR/Z30JQFpPQNSrNC6Q8UPvmp18GPQDFBNt9cE9/vN2uYn6Slc/jorMYej04 BbnZQxBMYngpjCskOBL07QMlWAudo+iYJif6xohVGSVBRtfDQ2qIc97F66cyKw2HI2u6 Nqczc7m17Eq1xIWEfGQFQp6OZiZAUDTd3HW9xCHUWL909RrlIA5DCgDHtzp9r6QrIDNb Ot4+SYL06nO6A0OTPfklOjcCz99q9s8a3PM7xRQ1EoPd4Be7F38j9jcAQ+LnGXes37r7 tv+Je8SpwIB/pmOe/3Dc1twuQMBNUcmluBPOKQJifWm42AQDxds3fhBGx17ww6DVzUIw tGaw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=lhTOrV9Ep9418v/k9QWjv1EjLbKrSL2Q0hL/MSOj6fE=; b=L5cLvvpB/VWJo+IRkSzkzLQlZbTBcdHZEXKWa6UXuhlnA/7Tv7CIaXU3fl3JAmjiSM 8ni7Zt+kMsps3+g1S3n9ZFi4ccCOMlrITykSoI+n+T7OK5OWUA3KnvYhnGUBh+k7MN3d ojOF5w6/DFAZIs7D8tdTx39w/T3WcVtSR+Jw5TNXIO9ZB+ML351PaQq4uF6kuAu6h7QV gqTpvG6YDL7tHSQEsRmycauwyxNDMvLvUHkMpFatlhNzHlBKKRWHhQ8uRjpLerkutX4c cJUWaSEJRZz7rJf6OeEU48quJ4yBnIAA2EeB53VMIO7qsHqX5GG/pburO9BOLnr1I/3r mp+Q== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=AE5TPYdJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id p6-20020a637f46000000b0050bf5a814a8si15046712pgn.403.2023.05.15.06.18.09; Mon, 15 May 2023 06:18:23 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=AE5TPYdJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242272AbjEONHI (ORCPT + 99 others); Mon, 15 May 2023 09:07:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242148AbjEONGn (ORCPT ); Mon, 15 May 2023 09:06:43 -0400 Received: from mail-pl1-x62e.google.com (mail-pl1-x62e.google.com [IPv6:2607:f8b0:4864:20::62e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B2B3626AE for ; Mon, 15 May 2023 06:06:14 -0700 (PDT) Received: by mail-pl1-x62e.google.com with SMTP id d9443c01a7336-1aaea43def7so87349445ad.2 for ; Mon, 15 May 2023 06:06:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684155965; x=1686747965; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=lhTOrV9Ep9418v/k9QWjv1EjLbKrSL2Q0hL/MSOj6fE=; b=AE5TPYdJKh+upwVCJh3G8m4CCCGvl07nH8DA+I/nklujQ9YNY+5+hrzRPCyiIGbHCd /G3dlUxrCo3tGgXlYHwHpAnY3srtCMkn2jHsUMg6pylapAZdL3XF43Ekl+CjStZbtfNz qtYa8TABInHSPUkJf4aHK+0vNIdvP6UNEHHos= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684155965; x=1686747965; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=lhTOrV9Ep9418v/k9QWjv1EjLbKrSL2Q0hL/MSOj6fE=; b=aFFIadmb0e3K02BLzgG7D7jpNYKJjN+5pKuDiFh3q5qiZo5l8ydUcfvj0koyAkgbyM iTycHF6Onmg1WhKANJy0DWB2+XhONYPnmr0AOauwrViq6ZUmeyO5f7jQFcWBCPatcbCn FYF+WQ6jhkzp/1Y09n1jj4GIOA1miushnx0zhgDyqNv2jq8dAU+zf6CV+5tijdc7nZez RPEmrMdYiDqjw9uxSl7PkIPsPMsbae8ZivAigXZpdczbeMyltXjbPuuMNSazZAbCT6DR FePLkMK3W+9RBcL8iVKsY4O+hz73R32wzuGwJ4ZLuOQOj6ZlhQdxT/tErYBQw0Zn+QjZ aGtw== X-Gm-Message-State: AC+VfDwK9z2wnkf0URUUs2t4jBoh/t6q2slKuJmCjrCXjgW1Z+aqrE7v Bo0oESrvc9ND9NShFmIpewZlNQ== X-Received: by 2002:a17:902:da84:b0:1ac:a28e:4b29 with SMTP id j4-20020a170902da8400b001aca28e4b29mr29799652plx.26.1684155965066; Mon, 15 May 2023 06:06:05 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id z6-20020a170902834600b001a980a23802sm13465239pln.111.2023.05.15.06.06.04 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 15 May 2023 06:06:04 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH 5/6] KEY: Apply PKEY_ENFORCE_API to munmap Date: Mon, 15 May 2023 13:05:51 +0000 Message-ID: <20230515130553.2311248-6-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.606.ga4b1b128d6-goog In-Reply-To: <20230515130553.2311248-1-jeffxu@chromium.org> References: <20230515130553.2311248-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1765966300317658720?= X-GMAIL-MSGID: =?utf-8?q?1765966300317658720?= From: Jeff Xu This patch enables PKEY_ENFORCE_API for the munmap syscall. Signed-off-by: Jeff Xu --- include/linux/mm.h | 2 +- mm/mmap.c | 34 ++++++++++++++++++++++++++-------- mm/mremap.c | 6 ++++-- 3 files changed, 31 insertions(+), 11 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 27ce77080c79..48076e845d53 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -3136,7 +3136,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long pgoff, unsigned long *populate, struct list_head *uf); extern int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, unsigned long start, size_t len, struct list_head *uf, - bool downgrade); + bool downgrade, bool syscall); extern int do_munmap(struct mm_struct *, unsigned long, size_t, struct list_head *uf); extern int do_madvise(struct mm_struct *mm, unsigned long start, size_t len_in, int behavior); diff --git a/mm/mmap.c b/mm/mmap.c index 13678edaa22c..29329aa794a6 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2498,6 +2498,7 @@ do_vmi_align_munmap(struct vma_iterator *vmi, struct vm_area_struct *vma, * @uf: The userfaultfd list_head * @downgrade: set to true if the user wants to attempt to write_downgrade the * mmap_lock + * @syscall: set to true if this is called from syscall entry * * This function takes a @mas that is either pointing to the previous VMA or set * to MA_START and sets it up to remove the mapping(s). The @len will be @@ -2507,7 +2508,7 @@ do_vmi_align_munmap(struct vma_iterator *vmi, struct vm_area_struct *vma, */ int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, unsigned long start, size_t len, struct list_head *uf, - bool downgrade) + bool downgrade, bool syscall) { unsigned long end; struct vm_area_struct *vma; @@ -2519,6 +2520,19 @@ int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, if (end == start) return -EINVAL; + /* + * When called by syscall from userspace, check if the calling + * thread has the PKEY permission to modify the memory mapping. + */ + if (syscall && arch_check_pkey_enforce_api(mm, start, end) < 0) { + char comm[TASK_COMM_LEN]; + + pr_warn_ratelimited( + "munmap was denied on PKEY_ENFORCE_API memory, pid=%d '%s'\n", + task_pid_nr(current), get_task_comm(comm, current)); + return -EACCES; + } + /* arch_unmap() might do unmaps itself. */ arch_unmap(mm, start, end); @@ -2541,7 +2555,7 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, { VMA_ITERATOR(vmi, mm, start); - return do_vmi_munmap(&vmi, mm, start, len, uf, false); + return do_vmi_munmap(&vmi, mm, start, len, uf, false, false); } unsigned long mmap_region(struct file *file, unsigned long addr, @@ -2575,7 +2589,7 @@ unsigned long mmap_region(struct file *file, unsigned long addr, } /* Unmap any existing mapping in the area */ - if (do_vmi_munmap(&vmi, mm, addr, len, uf, false)) + if (do_vmi_munmap(&vmi, mm, addr, len, uf, false, false)) return -ENOMEM; /* @@ -2792,7 +2806,11 @@ unsigned long mmap_region(struct file *file, unsigned long addr, return error; } -static int __vm_munmap(unsigned long start, size_t len, bool downgrade) +/* + * @syscall: set to true if this is called from syscall entry + */ +static int __vm_munmap(unsigned long start, size_t len, bool downgrade, + bool syscall) { int ret; struct mm_struct *mm = current->mm; @@ -2802,7 +2820,7 @@ static int __vm_munmap(unsigned long start, size_t len, bool downgrade) if (mmap_write_lock_killable(mm)) return -EINTR; - ret = do_vmi_munmap(&vmi, mm, start, len, &uf, downgrade); + ret = do_vmi_munmap(&vmi, mm, start, len, &uf, downgrade, syscall); /* * Returning 1 indicates mmap_lock is downgraded. * But 1 is not legal return value of vm_munmap() and munmap(), reset @@ -2820,14 +2838,14 @@ static int __vm_munmap(unsigned long start, size_t len, bool downgrade) int vm_munmap(unsigned long start, size_t len) { - return __vm_munmap(start, len, false); + return __vm_munmap(start, len, false, false); } EXPORT_SYMBOL(vm_munmap); SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len) { addr = untagged_addr(addr); - return __vm_munmap(addr, len, true); + return __vm_munmap(addr, len, true, true); } @@ -3055,7 +3073,7 @@ int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags) if (ret) goto limits_failed; - ret = do_vmi_munmap(&vmi, mm, addr, len, &uf, 0); + ret = do_vmi_munmap(&vmi, mm, addr, len, &uf, 0, false); if (ret) goto munmap_failed; diff --git a/mm/mremap.c b/mm/mremap.c index b11ce6c92099..768e5bd4e8b5 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -703,7 +703,8 @@ static unsigned long move_vma(struct vm_area_struct *vma, } vma_iter_init(&vmi, mm, old_addr); - if (do_vmi_munmap(&vmi, mm, old_addr, old_len, uf_unmap, false) < 0) { + if (do_vmi_munmap(&vmi, mm, old_addr, old_len, uf_unmap, false, false) < + 0) { /* OOM: unable to split vma, just get accounts right */ if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP)) vm_acct_memory(old_len >> PAGE_SHIFT); @@ -993,7 +994,8 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, VMA_ITERATOR(vmi, mm, addr + new_len); retval = do_vmi_munmap(&vmi, mm, addr + new_len, - old_len - new_len, &uf_unmap, true); + old_len - new_len, &uf_unmap, true, + false); /* Returning 1 indicates mmap_lock is downgraded to read. */ if (retval == 1) { downgraded = true;