From patchwork Tue Oct 17 09:08:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13424815 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40979CDB474 for ; Tue, 17 Oct 2023 09:08:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7819F8D0107; Tue, 17 Oct 2023 05:08:28 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 6BA878D0101; Tue, 17 Oct 2023 05:08:28 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 535168D0107; Tue, 17 Oct 2023 05:08:28 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 2FD708D0101 for ; Tue, 17 Oct 2023 05:08:28 -0400 (EDT) Received: from smtpin11.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 00194A0F86 for ; Tue, 17 Oct 2023 09:08:27 +0000 (UTC) X-FDA: 81354377454.11.7F32974 Received: from mail-pl1-f181.google.com (mail-pl1-f181.google.com [209.85.214.181]) by imf19.hostedemail.com (Postfix) with ESMTP id 264DC1A0007 for ; Tue, 17 Oct 2023 09:08:25 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=IfIXCkRu; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf19.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.214.181 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1697533706; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ViNyz7MVEy68sAHHL0LA4TbUsB4+tEyuC2ph9hmOQwY=; b=iJ/F+R8Ywfa82za/G1egGTdYHv2PmuPdk3sEcFkj3k0V5lQhnx+qW0WXvCpJtQVfRdpcr6 OZ0SCV4Vymc9yl1702fBJwf29gS4Q4142xPXN9tSQ8m+NRmZYOfMH7IIy2SOoq39XUb+Uk 2X8qeEk2mOpnrO5+L46zcAfqXm3+OfE= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=IfIXCkRu; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf19.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.214.181 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1697533706; a=rsa-sha256; cv=none; b=Lc42KygczbIpw1anmYJ1Ba/k3xnv8Y1/gUzvPaUNjpBKhJnrE5RT1PJGIS7FGxkG0m4Jb8 ZKyhU+fkw9THhGXGbCC2MzDs1+KCAKeLFq1Dhl7nCXy0h0D5JZDgMbLcEE1QBFYL4P6CSf r2fP96DYPCAtojEdaYZ7VXGyAvv64hQ= Received: by mail-pl1-f181.google.com with SMTP id d9443c01a7336-1c9b70b9656so32194565ad.1 for ; Tue, 17 Oct 2023 02:08:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1697533705; x=1698138505; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ViNyz7MVEy68sAHHL0LA4TbUsB4+tEyuC2ph9hmOQwY=; b=IfIXCkRucaef/p9FaKgbgMqEHlR0AWeXUzuO6BhHQPf4QionXtxYIuuQbWFrj2XBTU 8i88BA58HBep+7PwjQPUp0kpc0vE1xVBqrPL/N2uTnymfg6Q+4O9bdtjDjBRjek13CNi iYkbRSAAOD78wQN7AuKzRgNhubRqdLfiPk2as= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1697533705; x=1698138505; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ViNyz7MVEy68sAHHL0LA4TbUsB4+tEyuC2ph9hmOQwY=; b=oGyKmYhpp0GyY8wGsK1npYF3pZnanjSKWK5SlaQKhq0AHz8rEXthJ79t0pWak1ElBM /W9/Y6NgmIXxZHiSNIGlg+RBayK3k0wQIJhyWOq9qmEyeV9fGfYjR0ll11DuHN2/W5jy uhYF4lT9x/HPzFYmTmo7ekITxbWZfoMWtG+hiYjO3vL7XX1bKFO/L2c/7NJB2t96g2en 5V+yKWxLLzzv+zlnofmcfZEDL3ZNk6CRs9/5qPbcZNgdIBuAC/bzpT/kt4FpXTZGvTs4 Kk0l5reVD4d/jicTgDGAwXJH4s7KYDUWouphZQ619+TNcGVlAbSJBRIWRVRvOXml1aPu CemA== X-Gm-Message-State: AOJu0Yws6qgHgCjQM5swDW4QX6BruIEWrK89Pi+S9IuN1Qk7KO1Cw84Q trfS0048hNKqW0qeGJjatdR1Zg== X-Google-Smtp-Source: AGHT+IHMQjs3CP1M6u0EHjQpywUiPuYTFdj8fIiwHgzFn3k/gAIRbOULG1q5OcNoW72tl/neYPQw3A== X-Received: by 2002:a17:902:e749:b0:1c9:b187:4d84 with SMTP id p9-20020a170902e74900b001c9b1874d84mr2075293plf.14.1697533704959; Tue, 17 Oct 2023 02:08:24 -0700 (PDT) Received: from localhost (9.184.168.34.bc.googleusercontent.com. [34.168.184.9]) by smtp.gmail.com with UTF8SMTPSA id ij25-20020a170902ab5900b001b890b3bbb1sm1019372plb.211.2023.10.17.02.08.24 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Tue, 17 Oct 2023 02:08:24 -0700 (PDT) From: jeffxu@chromium.org To: akpm@linux-foundation.org, keescook@chromium.org, jannh@google.com, sroettger@google.com, willy@infradead.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org Cc: jeffxu@google.com, jorgelo@chromium.org, groeck@chromium.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, surenb@google.com, alex.sierra@amd.com, apopple@nvidia.com, aneesh.kumar@linux.ibm.com, axelrasmussen@google.com, ben@decadent.org.uk, catalin.marinas@arm.com, david@redhat.com, dwmw@amazon.co.uk, ying.huang@intel.com, hughd@google.com, joey.gouly@arm.com, corbet@lwn.net, wangkefeng.wang@huawei.com, Liam.Howlett@oracle.com, lstoakes@gmail.com, mawupeng1@huawei.com, linmiaohe@huawei.com, namit@vmware.com, peterx@redhat.com, peterz@infradead.org, ryan.roberts@arm.com, shr@devkernel.io, vbabka@suse.cz, xiujianfeng@huawei.com, yu.ma@intel.com, zhangpeng362@huawei.com, dave.hansen@intel.com, luto@kernel.org, linux-hardening@vger.kernel.org Subject: [RFC PATCH v2 6/8] mseal: Check seal flag for mremap(2) Date: Tue, 17 Oct 2023 09:08:13 +0000 Message-ID: <20231017090815.1067790-7-jeffxu@chromium.org> X-Mailer: git-send-email 2.42.0.655.g421f12c284-goog In-Reply-To: <20231017090815.1067790-1-jeffxu@chromium.org> References: <20231017090815.1067790-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: 264DC1A0007 X-Stat-Signature: wcqmph8fmgwqkzrxbdj19z9wih3phyf9 X-HE-Tag: 1697533705-592 X-HE-Meta: U2FsdGVkX198JpF6HOD9+z/qSKuLT07htTc3n0gLBcebQFLlQGTXtvnKCw328Q6r6rxm/cQ+HT3mBurb4AbSTbXKaKuw/ePuJHHMKkEjxZ2RybjTpLw5RnU4jl07dfdEpMWKbjyBRcnLk0SgHSKytrDzlaB84nZuRfM283q+rukz4u2c7b9eVpxA8YTHn5QAlZYSO3Lv2LJF2ervl0TxSiEUw2jTGu+TiVpDlnMsCYl3x0mQTVkWd4FyVu5lTbHwGQgw528FenDfauGpZRpsjCx2sIOG0cd2DvK75uUKsGfDR5xdkNhCN5e0H8gevjrH3Ss9p7iqS+a/9lqGNyJs1A+psWpnsQlpR7M5xLji0Vr+7KRhN3NTdxaAMUgTNPLBnA4HhgEbNGzF5bKEWZQ5mikRndiWxr3GPt9Gd9AwkLZDGHZ6hURYVLMljRKQZrQjsHgi8hzpzCPu3nVcHXkYrZdhmQ5VHw9SinCEBjn4YzatbwYKtB/Lx3GX5Rm6117rkQk5KZA2iFSO8MquNrY+rcJVB4U7AAt2mmhZH/xIZxp0ZVaC+K94dC+bnSIIjl9KeqBJWtqLHW1+rI1CC5VjWunsVbZI+qPsVRKA+mxewQaZE6jE8DRGs8nUat22ws+oyVBY6cTp/cSQ03xFhVdYVJOOJnAf5WNffePcISD6bxzR+KK8W8lvMsyeLZ4bliXaVe4XvICBO5nQEbUVlmy6JjTxGNFqSYXiT4glILI/AdsozVjIIL/nXModk52WMdfmi6sQ2hYQIb2v0l3u9oGZ0SJ4cTfWdIA3KWA283iIrEeG1OB/X2W3NUo8Zf7ifmb4n76x/EzPMimEwppCEeGwhOPlBpGqXNCAYHCDR7aXMO9Qi4DFX7QxP22EfAj/+LWQxrCBVgZsVIC0jH3e4hEA6qJdSCJZr7GmQbs5tNbV/yiNI37o05VZIoY1Q+aAmvd6uWHwiefMX/YPXfd1Hw0 YIPV4EmN UfiwK8iEoc9IyOTy6vz9au4sbpaTymlFxm3/0aOfSAHVYWz6j7LTHeNxssTrMTKsHrWJYwdkuIF01aaMkNTUKggGe7eZpBJDJL2skLOTF77I5ubz1Qcg58wEQVLLeJxDzDO5qRCPnxOofy1jEVzBeK2/Oj2FnkVYjkI3GWGZbVSOtXdllTBPCzAiGfGino+q2lDDgUfRJbMhNf9gvXxSAWurGfHtaNbMv6Va9CUctfVNsRRR6cCVlNjOm5hyby4zvT+7J82DtYmMlgGl7pWII35QXwe2oN3ojSGDeLDvxxnUuGmpEkXuFTO91UjiL1JIZG+zs+vdCI+MFqo4= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu mremap(2) can shrink/expand a VMA, or move a VMA to a fixed address and overwriting or existing VMA. Sealing will prevent unintended mremap(2) call. What this patch does: When a mremap(2) is invoked, if one of its VMAs has MM_SEAL_MREMAP set from previous mseal(2) call, this mremap(2) will fail, without any VMA modified. This patch is based on following: 1. At syscall entry point: SYSCALL_DEFINE5(mremap,...) There are two cases: a. going into mremap_to(). b. not going into mremap_to(). 2. For mremap_to() case. Since mremap_to() is called only from SYSCALL_DEFINE5(mremap,..), omit changing signature of mremap_to(), i.e. not passing checkSeals flag. In mremap_to(), it calls can_modify_mm() for src address and dst address (when MREMAP_FIXED is used), before any update is made to the VMAs. 3. For non mremap_to() case. It is still part of SYSCALL_DEFINE5(mremap,...). It calls can_modify_mm() to check sealing in the src address, before any update is made to src VMAs. Check for dest address is not needed, because dest memory is allocated in current mremap(2) call. Signed-off-by: Jeff Xu --- mm/mremap.c | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/mm/mremap.c b/mm/mremap.c index ac363937f8c4..691fc32d37e4 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -836,7 +836,27 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len, if ((mm->map_count + 2) >= sysctl_max_map_count - 3) return -ENOMEM; + /* + * Check src address for sealing. + * + * Note: mremap_to() currently called from one place: + * SYSCALL_DEFINE4(pkey_mprotect, ...) + * and not in any other places. + * Therefore, omit changing the signature of mremap_to() + * Otherwise, we might need to add checkSeals and pass it + * from all callers of mremap_to(). + */ + if (!can_modify_mm(mm, addr, addr + old_len, MM_SEAL_MREMAP)) + return -EACCES; + if (flags & MREMAP_FIXED) { + /* + * Check dest address for sealing. + */ + if (!can_modify_mm(mm, new_addr, new_addr + new_len, + MM_SEAL_MREMAP)) + return -EACCES; + ret = do_munmap(mm, new_addr, new_len, uf_unmap_early); if (ret) goto out; @@ -995,6 +1015,11 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, goto out; } + if (!can_modify_mm(mm, addr, addr + old_len, MM_SEAL_MREMAP)) { + ret = -EACCES; + goto out; + } + /* * Always allow a shrinking remap: that just unmaps * the unnecessary pages..