From patchwork Mon Apr 15 16:35:21 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13630308 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A748C4345F for ; Mon, 15 Apr 2024 16:35:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id A83876B0092; Mon, 15 Apr 2024 12:35:42 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A0A2D6B0093; Mon, 15 Apr 2024 12:35:42 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 80F076B0095; Mon, 15 Apr 2024 12:35:42 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 3E26E6B0093 for ; Mon, 15 Apr 2024 12:35:42 -0400 (EDT) Received: from smtpin09.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay09.hostedemail.com (Postfix) with ESMTP id 0BCDF806DC for ; Mon, 15 Apr 2024 16:35:42 +0000 (UTC) X-FDA: 82012317324.09.B3682EC Received: from mail-pf1-f174.google.com (mail-pf1-f174.google.com [209.85.210.174]) by imf05.hostedemail.com (Postfix) with ESMTP id 04880100014 for ; Mon, 15 Apr 2024 16:35:39 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b="W/EaniRi"; spf=pass (imf05.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.174 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1713198940; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=QnCTCSle99WuorIKXvt4zXtQrdrGKvYsPewqlVt4SL8=; b=cObd07WXF/sWywTORxniERnPFo4FXZc+TjAE2OOH6rY26N/hk5WhZjDvByFKu25RI//la6 QEkoqAne7BDLoJSTRES0xFHrD16ifhJdEx1PvAHPScShk1RpVbiA/5f9ggYOXpO3aI0KZn qisPZI3fFpGgAlKKfxOWAkEJt9uMJoM= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b="W/EaniRi"; spf=pass (imf05.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.174 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1713198940; a=rsa-sha256; cv=none; b=dNkY6yNYIIUo4ldJ6QW5E43UNkSJaMHgCaa/RntZAOqobYr9G0t7hrQJxXmac4FzE59hqd djYVJd+SFyCgctUDSZ/MEbFX4xdN7TcA4eHDMSEEoe04H4Sh+RqVQY77Z0UYDPm2LhecXQ 95N+zdy4anZBzcXICwJAwla3QS7yQk0= Received: by mail-pf1-f174.google.com with SMTP id d2e1a72fcca58-6ed2dc03df6so3094180b3a.1 for ; Mon, 15 Apr 2024 09:35:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1713198939; x=1713803739; darn=kvack.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=QnCTCSle99WuorIKXvt4zXtQrdrGKvYsPewqlVt4SL8=; b=W/EaniRiwbW4o59mF6x8bI1zEfdS4slh6+MdxkTVWbt5vT0P0YbBHyfyqnJ33Xea/h F2/YhUStvTWOPUnwVOi353DxAeLNt6gmwweePiyVIgFB0ooKgS2CCV36iBpgbFInhnhz rnc7ND7vl7elBdOnqnP7cNROBYVCCZeJ2WepA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713198939; x=1713803739; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=QnCTCSle99WuorIKXvt4zXtQrdrGKvYsPewqlVt4SL8=; b=lHZJuGkfFOqGoA6C1bwpWbIRcD//r1NENdiqXEewMRwPcFZLHZnpdr/NBuyALsPff3 Li4vkUOtV9QufKozQNCgNzSNwPJ+cBcJIn+nqKzGBOgAbxU32M43rMxivyV4Pj/aUDN3 oEvpNRleMrmmBfSe42gE3QfWbNutiZnnV5w09fKMFjiN6Di/QXNcsrNzVL494aEIab+y cGY38fkrLRxsnyhhQLb4ZwdCyNqbUbYsWuUCMz+4xjWBnoGjKep9ODx41ozj1vftwDnI h7zMfmTdksKRFFkuPIqMSasKNx62rLDduUQ8Sbh08aBA6Rdcj+dhAp0b7ul1SjU9eEu/ reXQ== X-Forwarded-Encrypted: i=1; AJvYcCWYqi9zoNv2qI+a+TYkl2DdNM/vj2PIKjEfd+c8jss6qh6ZlY+RrRmhQgFyJtn+IXNx70H27m5cz9gwDNlPAIbhVXE= X-Gm-Message-State: AOJu0YxdJX8CKw0bm0sf/fFJFICzmm2DvBdcJ/bPT2Ce6JHt/QoP2SNW cbQ9SZmUyR/0foex+bdedXIeAuLePzJwG4lLj/f3+9wl2jWeyJ25rEIE1ze6jw== X-Google-Smtp-Source: AGHT+IHQNHj7ENiJ0rCkxfuN0ytHMjzNjPBlUKmoggR3i0J7wtyEtoqG7oL4MpdgV62krnVmQYGOeg== X-Received: by 2002:a05:6a00:801:b0:6ea:9252:435 with SMTP id m1-20020a056a00080100b006ea92520435mr13773673pfk.30.1713198938753; Mon, 15 Apr 2024 09:35:38 -0700 (PDT) Received: from localhost (15.4.198.104.bc.googleusercontent.com. [104.198.4.15]) by smtp.gmail.com with UTF8SMTPSA id e10-20020a63aa0a000000b005dc5129ba9dsm7199863pgf.72.2024.04.15.09.35.38 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 15 Apr 2024 09:35:38 -0700 (PDT) From: jeffxu@chromium.org To: akpm@linux-foundation.org, keescook@chromium.org, jannh@google.com, sroettger@google.com, willy@infradead.org, gregkh@linuxfoundation.org, torvalds@linux-foundation.org, usama.anjum@collabora.com, corbet@lwn.net, Liam.Howlett@oracle.com, surenb@google.com, merimus@google.com, rdunlap@infradead.org Cc: jeffxu@google.com, jorgelo@chromium.org, groeck@chromium.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, pedro.falcato@gmail.com, dave.hansen@intel.com, linux-hardening@vger.kernel.org, deraadt@openbsd.org, Jeff Xu Subject: [PATCH v10 2/5] mseal: add mseal syscall Date: Mon, 15 Apr 2024 16:35:21 +0000 Message-ID: <20240415163527.626541-3-jeffxu@chromium.org> X-Mailer: git-send-email 2.44.0.683.g7961c838ac-goog In-Reply-To: <20240415163527.626541-1-jeffxu@chromium.org> References: <20240415163527.626541-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspamd-Queue-Id: 04880100014 X-Rspam-User: X-Stat-Signature: 1gtkqhcjx4opt5h9xb94gc7deo4a619j X-Rspamd-Server: rspam01 X-HE-Tag: 1713198939-414372 X-HE-Meta: U2FsdGVkX1/PILkSLzTPyywz0Kb1nWNj5GRw0W69/eFiDS/wP4+m3NZWeT8ETuRzZkt6JXxzRl1b9Sqjj6oy6N91tIoUXJtq9spGzX+BCaZFoZCLuzz1L74QEbsT14+8EBS56F//EoKjrMWW6I8d90zPr8b1epi0B1z6X6jlMcNX29t6htALQEHZZfNW/SB36wDdVIjr4nNMrYdV8pBCFkxB46PGelldCqUsVofZhwm+YVJMKdBIszZuScD5OR6sm5Z71SJj5k1cX0Hlu31FTUwYTKMf/LakwACLUOCTpneKlWRO2Lsv/nHsuChO/EGTPRbIqkqIASf/wZ6RRxqSwxGn35r1XLt6gUkv8sXmxosqUJKh8Qqo30AKv/qUR2fQfVQOwgGwziwIWWmaxwnnL3zC4f3l9DmcCZe3zzPqDKHs6us2uoLPJllbCzFxWLfUvcCdJxQ7lNcaehnmtR7SslJIvZg1eZ+ERQWvvSJglqUQF7y+ojLkeTFbuuJISYz3yPjDHZLo8jqsYWpYFcEyiTfVEo29iZUVM/nL0NQhSBvGFktxXslAevlmtAu013L63vqp0wraUHL4n5HCLFYOxNTKWiGUyepAOqG35UQF6tBZgcBv+Zy6hcFW0EDoscP7cW7LHAt5eobwdYZ7gwzKAoiIEkLHZzCvO04I7XMXo8/u+ptoNpTWbiJt3PHfRSQm3LLGKbTz3K2hDJcCH7hAaLFN3tM1fvdlvIFyJKNdTKQeP8LcIeVuk+pcOgR7KUMtql/u95hrTK4r5OGICfVghAOgczecpEg93AO+E2Zb3KEUke1ymoDbrZdcX9bXD8CDxvqd3+MsVtT1gfg5qTlTs37lu3k30D3Vq7b8mswMvY2HV15fxgtrBYfTBPuo2AeLfSfGpgafdf4hazjEFSqYCwD3HLB3gKFvBwlZpl3QnVpfBg3mWTFamdim4/JP1Pl4DGCWkdtTWAzy6COCH8P sLdQQA8z Fa2tDLzqQmVQwssCDku7UihMuPTkog1vYnMZAUFSvf+QLcuQqvS4zaqkYN4JOxXFruZquUWhiFYmy0nsp19RHnCaQfHc+B8gqsS54v8GgbidSNnY/IFuheOyGuhquDYGY6C/fM+YClmoOQUrNa6jhcVACojRsQaT4QehCmlVsi4XrAmlvw5wuVdg5KyXXycawIRPoA4FzJxRlTbFkcLKZQFqG3SHEqCgJVln5lS/k2k+henjG/1QAzx0tRtFTzQX/ahCOGTXuv63LPbl4HNDkf0v6dIEZU2EwLitH1KQUo58YICDFms52HDeNZ3MfSdLuzQvTB3RmkNypS8wfyBUorv38zgjaUkHbU1f5D6oc5SeeZUpsmHcWIWBNWpezUvc2E+6RFBnPXi3D6ieBUX3HJa/KWT1nfsKluLehyWbqpE39DX5GRFr09fB+U7pQnL9WMBrQCkTzo1fQ24iY5pDVgGkYJw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: From: Jeff Xu The new mseal() is an syscall on 64 bit CPU, and with following signature: int mseal(void addr, size_t len, unsigned long flags) addr/len: memory range. flags: reserved. mseal() blocks following operations for the given memory range. 1> Unmapping, moving to another location, and shrinking the size, via munmap() and mremap(), can leave an empty space, therefore can be replaced with a VMA with a new set of attributes. 2> Moving or expanding a different VMA into the current location, via mremap(). 3> Modifying a VMA via mmap(MAP_FIXED). 4> Size expansion, via mremap(), does not appear to pose any specific risks to sealed VMAs. It is included anyway because the use case is unclear. In any case, users can rely on merging to expand a sealed VMA. 5> mprotect() and pkey_mprotect(). 6> Some destructive madvice() behaviors (e.g. MADV_DONTNEED) for anonymous memory, when users don't have write permission to the memory. Those behaviors can alter region contents by discarding pages, effectively a memset(0) for anonymous memory. Following input during RFC are incooperated into this patch: Jann Horn: raising awareness and providing valuable insights on the destructive madvise operations. Linus Torvalds: assisting in defining system call signature and scope. Liam R. Howlett: perf optimization. Theo de Raadt: sharing the experiences and insight gained from implementing mimmutable() in OpenBSD. Finally, the idea that inspired this patch comes from Stephen Röttger’s work in Chrome V8 CFI. Signed-off-by: Jeff Xu --- include/linux/syscalls.h | 1 + mm/Makefile | 4 + mm/internal.h | 37 +++++ mm/madvise.c | 12 ++ mm/mmap.c | 31 +++- mm/mprotect.c | 10 ++ mm/mremap.c | 31 ++++ mm/mseal.c | 307 +++++++++++++++++++++++++++++++++++++++ 8 files changed, 432 insertions(+), 1 deletion(-) create mode 100644 mm/mseal.c diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index e619ac10cd23..9104952d323d 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -821,6 +821,7 @@ asmlinkage long sys_process_mrelease(int pidfd, unsigned int flags); asmlinkage long sys_remap_file_pages(unsigned long start, unsigned long size, unsigned long prot, unsigned long pgoff, unsigned long flags); +asmlinkage long sys_mseal(unsigned long start, size_t len, unsigned long flags); asmlinkage long sys_mbind(unsigned long start, unsigned long len, unsigned long mode, const unsigned long __user *nmask, diff --git a/mm/Makefile b/mm/Makefile index 4abb40b911ec..739811890e36 100644 --- a/mm/Makefile +++ b/mm/Makefile @@ -42,6 +42,10 @@ ifdef CONFIG_CROSS_MEMORY_ATTACH mmu-$(CONFIG_MMU) += process_vm_access.o endif +ifdef CONFIG_64BIT +mmu-$(CONFIG_MMU) += mseal.o +endif + obj-y := filemap.o mempool.o oom_kill.o fadvise.o \ maccess.o page-writeback.o folio-compat.o \ readahead.o swap.o truncate.o vmscan.o shrinker.o \ diff --git a/mm/internal.h b/mm/internal.h index 7e486f2c502c..a858161489b3 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -1326,6 +1326,43 @@ void __meminit __init_single_page(struct page *page, unsigned long pfn, unsigned long shrink_slab(gfp_t gfp_mask, int nid, struct mem_cgroup *memcg, int priority); +#ifdef CONFIG_64BIT +/* VM is sealed, in vm_flags */ +#define VM_SEALED _BITUL(63) +#endif + +#ifdef CONFIG_64BIT +static inline int can_do_mseal(unsigned long flags) +{ + if (flags) + return -EINVAL; + + return 0; +} + +bool can_modify_mm(struct mm_struct *mm, unsigned long start, + unsigned long end); +bool can_modify_mm_madv(struct mm_struct *mm, unsigned long start, + unsigned long end, int behavior); +#else +static inline int can_do_mseal(unsigned long flags) +{ + return -EPERM; +} + +static inline bool can_modify_mm(struct mm_struct *mm, unsigned long start, + unsigned long end) +{ + return true; +} + +static inline bool can_modify_mm_madv(struct mm_struct *mm, unsigned long start, + unsigned long end, int behavior) +{ + return true; +} +#endif + #ifdef CONFIG_SHRINKER_DEBUG static inline __printf(2, 0) int shrinker_debugfs_name_alloc( struct shrinker *shrinker, const char *fmt, va_list ap) diff --git a/mm/madvise.c b/mm/madvise.c index 44a498c94158..f7d589534e82 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1394,6 +1394,7 @@ int madvise_set_anon_name(struct mm_struct *mm, unsigned long start, * -EIO - an I/O error occurred while paging in data. * -EBADF - map exists, but area maps something that isn't a file. * -EAGAIN - a kernel resource was temporarily unavailable. + * -EPERM - memory is sealed. */ int do_madvise(struct mm_struct *mm, unsigned long start, size_t len_in, int behavior) { @@ -1437,10 +1438,21 @@ int do_madvise(struct mm_struct *mm, unsigned long start, size_t len_in, int beh start = untagged_addr_remote(mm, start); end = start + len; + /* + * Check if the address range is sealed for do_madvise(). + * can_modify_mm_madv assumes we have acquired the lock on MM. + */ + if (!can_modify_mm_madv(mm, start, end, behavior)) { + error = -EPERM; + goto out; + } + blk_start_plug(&plug); error = madvise_walk_vmas(mm, start, end, behavior, madvise_vma_behavior); blk_finish_plug(&plug); + +out: if (write) mmap_write_unlock(mm); else diff --git a/mm/mmap.c b/mm/mmap.c index 6dbda99a47da..4b80076c319e 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1267,6 +1267,16 @@ unsigned long do_mmap(struct file *file, unsigned long addr, return -EEXIST; } + /* + * addr is returned from get_unmapped_area, + * There are two cases: + * 1> MAP_FIXED == false + * unallocated memory, no need to check sealing. + * 1> MAP_FIXED == true + * sealing is checked inside mmap_region when + * do_vmi_munmap is called. + */ + if (prot == PROT_EXEC) { pkey = execute_only_pkey(mm); if (pkey < 0) @@ -2682,6 +2692,14 @@ int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, if (end == start) return -EINVAL; + /* + * Check if memory is sealed before arch_unmap. + * Prevent unmapping a sealed VMA. + * can_modify_mm assumes we have acquired the lock on MM. + */ + if (!can_modify_mm(mm, start, end)) + return -EPERM; + /* arch_unmap() might do unmaps itself. */ arch_unmap(mm, start, end); @@ -2744,7 +2762,10 @@ unsigned long mmap_region(struct file *file, unsigned long addr, } /* Unmap any existing mapping in the area */ - if (do_vmi_munmap(&vmi, mm, addr, len, uf, false)) + error = do_vmi_munmap(&vmi, mm, addr, len, uf, false); + if (error == -EPERM) + return error; + else if (error) return -ENOMEM; /* @@ -3094,6 +3115,14 @@ int do_vma_munmap(struct vma_iterator *vmi, struct vm_area_struct *vma, { struct mm_struct *mm = vma->vm_mm; + /* + * Check if memory is sealed before arch_unmap. + * Prevent unmapping a sealed VMA. + * can_modify_mm assumes we have acquired the lock on MM. + */ + if (!can_modify_mm(mm, start, end)) + return -EPERM; + arch_unmap(mm, start, end); return do_vmi_align_munmap(vmi, vma, mm, start, end, uf, unlock); } diff --git a/mm/mprotect.c b/mm/mprotect.c index f8a4544b4601..b30b2494bfcd 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include #include @@ -743,6 +744,15 @@ static int do_mprotect_pkey(unsigned long start, size_t len, } } + /* + * checking if memory is sealed. + * can_modify_mm assumes we have acquired the lock on MM. + */ + if (!can_modify_mm(current->mm, start, end)) { + error = -EPERM; + goto out; + } + prev = vma_prev(&vmi); if (start > vma->vm_start) prev = vma; diff --git a/mm/mremap.c b/mm/mremap.c index 38d98465f3d8..d69b438dcf83 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -902,7 +902,25 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len, if ((mm->map_count + 2) >= sysctl_max_map_count - 3) return -ENOMEM; + /* + * In mremap_to(). + * Move a VMA to another location, check if src addr is sealed. + * + * Place can_modify_mm here because mremap_to() + * does its own checking for address range, and we only + * check the sealing after passing those checks. + * + * can_modify_mm assumes we have acquired the lock on MM. + */ + if (!can_modify_mm(mm, addr, addr + old_len)) + return -EPERM; + if (flags & MREMAP_FIXED) { + /* + * In mremap_to(). + * VMA is moved to dst address, and munmap dst first. + * do_munmap will check if dst is sealed. + */ ret = do_munmap(mm, new_addr, new_len, uf_unmap_early); if (ret) goto out; @@ -1061,6 +1079,19 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, goto out; } + /* + * Below is shrink/expand case (not mremap_to()) + * Check if src address is sealed, if so, reject. + * In other words, prevent shrinking or expanding a sealed VMA. + * + * Place can_modify_mm here so we can keep the logic related to + * shrink/expand together. + */ + if (!can_modify_mm(mm, addr, addr + old_len)) { + ret = -EPERM; + goto out; + } + /* * Always allow a shrinking remap: that just unmaps * the unnecessary pages.. diff --git a/mm/mseal.c b/mm/mseal.c new file mode 100644 index 000000000000..daadac4b8125 --- /dev/null +++ b/mm/mseal.c @@ -0,0 +1,307 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Implement mseal() syscall. + * + * Copyright (c) 2023,2024 Google, Inc. + * + * Author: Jeff Xu + */ + +#include +#include +#include +#include +#include +#include +#include +#include "internal.h" + +static inline bool vma_is_sealed(struct vm_area_struct *vma) +{ + return (vma->vm_flags & VM_SEALED); +} + +static inline void set_vma_sealed(struct vm_area_struct *vma) +{ + vm_flags_set(vma, VM_SEALED); +} + +/* + * check if a vma is sealed for modification. + * return true, if modification is allowed. + */ +static bool can_modify_vma(struct vm_area_struct *vma) +{ + if (vma_is_sealed(vma)) + return false; + + return true; +} + +static bool is_madv_discard(int behavior) +{ + return behavior & + (MADV_FREE | MADV_DONTNEED | MADV_DONTNEED_LOCKED | + MADV_REMOVE | MADV_DONTFORK | MADV_WIPEONFORK); +} + +static bool is_ro_anon(struct vm_area_struct *vma) +{ + /* check anonymous mapping. */ + if (vma->vm_file || vma->vm_flags & VM_SHARED) + return false; + + /* + * check for non-writable: + * PROT=RO or PKRU is not writeable. + */ + if (!(vma->vm_flags & VM_WRITE) || + !arch_vma_access_permitted(vma, true, false, false)) + return true; + + return false; +} + +/* + * Check if the vmas of a memory range are allowed to be modified. + * the memory ranger can have a gap (unallocated memory). + * return true, if it is allowed. + */ +bool can_modify_mm(struct mm_struct *mm, unsigned long start, unsigned long end) +{ + struct vm_area_struct *vma; + + VMA_ITERATOR(vmi, mm, start); + + /* going through each vma to check. */ + for_each_vma_range(vmi, vma, end) { + if (!can_modify_vma(vma)) + return false; + } + + /* Allow by default. */ + return true; +} + +/* + * Check if the vmas of a memory range are allowed to be modified by madvise. + * the memory ranger can have a gap (unallocated memory). + * return true, if it is allowed. + */ +bool can_modify_mm_madv(struct mm_struct *mm, unsigned long start, unsigned long end, + int behavior) +{ + struct vm_area_struct *vma; + + VMA_ITERATOR(vmi, mm, start); + + if (!is_madv_discard(behavior)) + return true; + + /* going through each vma to check. */ + for_each_vma_range(vmi, vma, end) + if (is_ro_anon(vma) && !can_modify_vma(vma)) + return false; + + /* Allow by default. */ + return true; +} + +static int mseal_fixup(struct vma_iterator *vmi, struct vm_area_struct *vma, + struct vm_area_struct **prev, unsigned long start, + unsigned long end, vm_flags_t newflags) +{ + int ret = 0; + vm_flags_t oldflags = vma->vm_flags; + + if (newflags == oldflags) + goto out; + + vma = vma_modify_flags(vmi, *prev, vma, start, end, newflags); + if (IS_ERR(vma)) { + ret = PTR_ERR(vma); + goto out; + } + + set_vma_sealed(vma); +out: + *prev = vma; + return ret; +} + +/* + * Check for do_mseal: + * 1> start is part of a valid vma. + * 2> end is part of a valid vma. + * 3> No gap (unallocated address) between start and end. + * 4> map is sealable. + */ +static int check_mm_seal(unsigned long start, unsigned long end) +{ + struct vm_area_struct *vma; + unsigned long nstart = start; + + VMA_ITERATOR(vmi, current->mm, start); + + /* going through each vma to check. */ + for_each_vma_range(vmi, vma, end) { + if (vma->vm_start > nstart) + /* unallocated memory found. */ + return -ENOMEM; + + if (vma->vm_end >= end) + return 0; + + nstart = vma->vm_end; + } + + return -ENOMEM; +} + +/* + * Apply sealing. + */ +static int apply_mm_seal(unsigned long start, unsigned long end) +{ + unsigned long nstart; + struct vm_area_struct *vma, *prev; + + VMA_ITERATOR(vmi, current->mm, start); + + vma = vma_iter_load(&vmi); + /* + * Note: check_mm_seal should already checked ENOMEM case. + * so vma should not be null, same for the other ENOMEM cases. + */ + prev = vma_prev(&vmi); + if (start > vma->vm_start) + prev = vma; + + nstart = start; + for_each_vma_range(vmi, vma, end) { + int error; + unsigned long tmp; + vm_flags_t newflags; + + newflags = vma->vm_flags | VM_SEALED; + tmp = vma->vm_end; + if (tmp > end) + tmp = end; + error = mseal_fixup(&vmi, vma, &prev, nstart, tmp, newflags); + if (error) + return error; + nstart = vma_iter_end(&vmi); + } + + return 0; +} + +/* + * mseal(2) seals the VM's meta data from + * selected syscalls. + * + * addr/len: VM address range. + * + * The address range by addr/len must meet: + * start (addr) must be in a valid VMA. + * end (addr + len) must be in a valid VMA. + * no gap (unallocated memory) between start and end. + * start (addr) must be page aligned. + * + * len: len will be page aligned implicitly. + * + * Below VMA operations are blocked after sealing. + * 1> Unmapping, moving to another location, and shrinking + * the size, via munmap() and mremap(), can leave an empty + * space, therefore can be replaced with a VMA with a new + * set of attributes. + * 2> Moving or expanding a different vma into the current location, + * via mremap(). + * 3> Modifying a VMA via mmap(MAP_FIXED). + * 4> Size expansion, via mremap(), does not appear to pose any + * specific risks to sealed VMAs. It is included anyway because + * the use case is unclear. In any case, users can rely on + * merging to expand a sealed VMA. + * 5> mprotect and pkey_mprotect. + * 6> Some destructive madvice() behavior (e.g. MADV_DONTNEED) + * for anonymous memory, when users don't have write permission to the + * memory. Those behaviors can alter region contents by discarding pages, + * effectively a memset(0) for anonymous memory. + * + * flags: reserved. + * + * return values: + * zero: success. + * -EINVAL: + * invalid input flags. + * start address is not page aligned. + * Address arange (start + len) overflow. + * -ENOMEM: + * addr is not a valid address (not allocated). + * end (start + len) is not a valid address. + * a gap (unallocated memory) between start and end. + * -EPERM: + * - In 32 bit architecture, sealing is not supported. + * Note: + * user can call mseal(2) multiple times, adding a seal on an + * already sealed memory is a no-action (no error). + * + * unseal() is not supported. + */ +static int do_mseal(unsigned long start, size_t len_in, unsigned long flags) +{ + size_t len; + int ret = 0; + unsigned long end; + struct mm_struct *mm = current->mm; + + ret = can_do_mseal(flags); + if (ret) + return ret; + + start = untagged_addr(start); + if (!PAGE_ALIGNED(start)) + return -EINVAL; + + len = PAGE_ALIGN(len_in); + /* Check to see whether len was rounded up from small -ve to zero. */ + if (len_in && !len) + return -EINVAL; + + end = start + len; + if (end < start) + return -EINVAL; + + if (end == start) + return 0; + + if (mmap_write_lock_killable(mm)) + return -EINTR; + + /* + * First pass, this helps to avoid + * partial sealing in case of error in input address range, + * e.g. ENOMEM error. + */ + ret = check_mm_seal(start, end); + if (ret) + goto out; + + /* + * Second pass, this should success, unless there are errors + * from vma_modify_flags, e.g. merge/split error, or process + * reaching the max supported VMAs, however, those cases shall + * be rare. + */ + ret = apply_mm_seal(start, end); + +out: + mmap_write_unlock(current->mm); + return ret; +} + +SYSCALL_DEFINE3(mseal, unsigned long, start, size_t, len, unsigned long, + flags) +{ + return do_mseal(start, len, flags); +}