From patchwork Tue Apr 25 07:14:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Lorenzo Stoakes X-Patchwork-Id: 13222902 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B321BC77B78 for ; Tue, 25 Apr 2023 07:14:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233505AbjDYHOW (ORCPT ); Tue, 25 Apr 2023 03:14:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36040 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233311AbjDYHOV (ORCPT ); Tue, 25 Apr 2023 03:14:21 -0400 Received: from mail-wm1-x32d.google.com (mail-wm1-x32d.google.com [IPv6:2a00:1450:4864:20::32d]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 748A69001; Tue, 25 Apr 2023 00:14:20 -0700 (PDT) Received: by mail-wm1-x32d.google.com with SMTP id 5b1f17b1804b1-3f178da21afso35364495e9.1; Tue, 25 Apr 2023 00:14:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20221208; t=1682406859; x=1684998859; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=yjgzdqrbPo7+Td+Wlne0g57m41H7q9g5vLYpPDzT+qw=; b=H6uBR9WAiN3nmtRogzKnpHyF+tj7CFYbFApxatJP1VLKGlPzsCJ25finM3hrSD0TEB XfOldeEJUhs/ALeP7EP6+mTWtQrLcql/7gRagSd2UsEVk6dOtOVqwu+fHLSYibPjJ6sb lfh1f+YYWcf4GP7VXXXzEejq9r0Co3wq2ip3LqUMigGlznjo31/lUKWLuIIc0IlTJIDb dL+v/hGG5bbSSG9J0HDhLj+KsUrvRopsq2vI0ls5gl/cgjerlsF9u86OWWWjJDtKmUdV IFPEkfr3t8/hkfk2cywUJTNAy1Ngjcu0MDpEQ4OwgZG18kbtqh1YdMWEM5VVO0i0Srmw cGGQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1682406859; x=1684998859; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=yjgzdqrbPo7+Td+Wlne0g57m41H7q9g5vLYpPDzT+qw=; b=HgSjYlBjnf3j6bjUP3fCF7i4Lte/biafaYzP5t/Druz1cGsIOijX84BW13D10JDqob fiiaT3F5gUAUGQZROeVRR3/3qA2zWRuNh7mHOrgttYh49nsqIUyUpEFR6941Bval7dIi N4h3o2EvCQGDcB/qIGZLhltiigVzlcXWt5sS726TQkdM6Aj7DrwJ5nE5zJeEREge+62Y Qq7iIe9hq5MYMgc/JfqL+Xl5H0IAgFI73XxPJSKbCz84cCVTEaLF/LD+btyubVJXs7lF ZJoSJ4tJuT9hS+v/L3Dl9NI7F/tZ3GaKS1h+7vdBnZnd55VuXzH1DWQej/dMfdggNiRa zwbQ== X-Gm-Message-State: AAQBX9f5st0yzFymCtCwCnLx9uGHXzTWQoV6HrEAlDp+/0oEWtU0FxGN GdS4RufH3Nb9gLfEjnuhfT0= X-Google-Smtp-Source: AKy350aSZ0ogFp8y55zCmLsghq92v+eab4GmjRhmzl2lUP7Ai4SILM+68B2FMmp0r+I/N2CUHcFWng== X-Received: by 2002:a7b:cd09:0:b0:3f1:6980:2d2e with SMTP id f9-20020a7bcd09000000b003f169802d2emr9984982wmj.22.1682406858687; Tue, 25 Apr 2023 00:14:18 -0700 (PDT) Received: from lucifer.home (host86-156-84-164.range86-156.btcentralplus.com. [86.156.84.164]) by smtp.googlemail.com with ESMTPSA id c16-20020a05600c0ad000b003f198dfbbfcsm8382138wmr.19.2023.04.25.00.14.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Apr 2023 00:14:17 -0700 (PDT) From: Lorenzo Stoakes To: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Andrew Morton Cc: Jason Gunthorpe , Jens Axboe , Matthew Wilcox , Dennis Dalessandro , Leon Romanovsky , Christian Benvenuti , Nelson Escobar , Bernard Metzler , Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Mark Rutland , Alexander Shishkin , Jiri Olsa , Namhyung Kim , Ian Rogers , Adrian Hunter , Bjorn Topel , Magnus Karlsson , Maciej Fijalkowski , Jonathan Lemon , "David S . Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Christian Brauner , Richard Cochran , Alexei Starovoitov , Daniel Borkmann , Jesper Dangaard Brouer , John Fastabend , linux-fsdevel@vger.kernel.org, linux-perf-users@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, Oleg Nesterov , Jason Gunthorpe , John Hubbard , Jan Kara , "Kirill A . Shutemov" , Pavel Begunkov , Lorenzo Stoakes Subject: [PATCH v3] mm/gup: disallow GUP writing to file-backed mappings by default Date: Tue, 25 Apr 2023 08:14:14 +0100 Message-Id: <23c19e27ef0745f6d3125976e047ee0da62569d4.1682406295.git.lstoakes@gmail.com> X-Mailer: git-send-email 2.40.0 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org GUP does not correctly implement write-notify semantics, nor does it guarantee that the underlying pages are correctly dirtied, which could lead to a kernel oops or data corruption when writing to file-backed mappings. This is only relevant when the mappings are file-backed and the underlying file system requires folio dirty tracking. File systems which do not, such as shmem or hugetlb, are not at risk and therefore can be written to without issue. Unfortunately this limitation of GUP has been present for some time and requires future rework of the GUP API in order to provide correct write access to such mappings. In the meantime, we add a check for the most broken GUP case - FOLL_LONGTERM - which really under no circumstances can safely access dirty-tracked file mappings. Suggested-by: Jason Gunthorpe Signed-off-by: Lorenzo Stoakes --- v3: - Rebased on latest mm-unstable as of 24th April 2023. - Explicitly check whether file system requires folio dirtying. Note that vma_wants_writenotify() could not be used directly as it is very much focused on determining if the PTE r/w should be set (e.g. assuming private mapping does not require it as already set, soft dirty considerations). - Tested code against shmem and hugetlb mappings - confirmed that these are not disallowed by the check. - Eliminate FOLL_ALLOW_BROKEN_FILE_MAPPING flag and instead perform check only for FOLL_LONGTERM pins. - As a result, limit check to internal GUP code. v2: - Add accidentally excluded ptrace_access_vm() use of FOLL_ALLOW_BROKEN_FILE_MAPPING. - Tweak commit message. https://lore.kernel.org/all/c8ee7e02d3d4f50bb3e40855c53bda39eec85b7d.1682321768.git.lstoakes@gmail.com/ v1: https://lore.kernel.org/all/f86dc089b460c80805e321747b0898fd1efe93d7.1682168199.git.lstoakes@gmail.com/ mm/gup.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) -- 2.40.0 diff --git a/mm/gup.c b/mm/gup.c index 1f72a717232b..f77810ee8a9f 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -4,6 +4,7 @@ #include #include +#include #include #include #include @@ -959,16 +960,58 @@ static int faultin_page(struct vm_area_struct *vma, return 0; } +/* + * Writing to file-backed mappings which require folio dirty tracking using GUP + * is a fundamentally broken operation as kernel write access to GUP mappings + * may not adhere to the semantics expected by a file system. + */ +static inline bool can_write_file_mapping(struct vm_area_struct *vma, + unsigned long gup_flags) +{ + const struct vm_operations_struct *vm_ops = vma->vm_ops; + const struct file *file = vma->vm_file; + + /* If we aren't pinning then no problematic write can occur. */ + if (!(gup_flags & (FOLL_GET | FOLL_PIN))) + return true; + + /* We limit this check to the most egregious case - a long term pin. */ + if (!(gup_flags & FOLL_LONGTERM)) + return true; + + /* + * If the underlying file system needs to be notified of writes, then it + * requires correct dirty tracking which we cannot guarantee. + */ + if (vm_ops && (vm_ops->page_mkwrite || vm_ops->pfn_mkwrite)) + return false; + + /* + * If no pfn_mkwrite() is specified, no dirty tracking is required for a + * PFN map. + */ + if (vma->vm_flags & VM_PFNMAP) + return true; + + /* + * Even if the file system does not require write notification, if its + * underlying mapping can writeback, dirty tracking will be required. + */ + return !file || !file->f_mapping || + !mapping_can_writeback(file->f_mapping); +} + static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) { vm_flags_t vm_flags = vma->vm_flags; int write = (gup_flags & FOLL_WRITE); int foreign = (gup_flags & FOLL_REMOTE); + bool vma_anon = vma_is_anonymous(vma); if (vm_flags & (VM_IO | VM_PFNMAP)) return -EFAULT; - if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) + if ((gup_flags & FOLL_ANON) && !vma_anon) return -EFAULT; if ((gup_flags & FOLL_LONGTERM) && vma_is_fsdax(vma)) @@ -978,6 +1021,9 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) return -EFAULT; if (write) { + if (!vma_anon && !can_write_file_mapping(vma, gup_flags)) + return -EFAULT; + if (!(vm_flags & VM_WRITE)) { if (!(gup_flags & FOLL_FORCE)) return -EFAULT;