From patchwork Fri May 19 01:19:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13247581 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0FB19C7EE2E for ; Fri, 19 May 2023 01:19:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 58132900003; Thu, 18 May 2023 21:19:31 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 50AFB280001; Thu, 18 May 2023 21:19:31 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 298B5900005; Thu, 18 May 2023 21:19:31 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 12D23900003 for ; Thu, 18 May 2023 21:19:31 -0400 (EDT) Received: from smtpin26.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id CD58E1607D9 for ; Fri, 19 May 2023 01:19:30 +0000 (UTC) X-FDA: 80805246900.26.401CFCF Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) by imf25.hostedemail.com (Postfix) with ESMTP id E60A0A0006 for ; Fri, 19 May 2023 01:19:28 +0000 (UTC) Authentication-Results: imf25.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=GibbkWqf; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf25.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.177 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684459169; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=amUmjeQdjogZim3KCvDHtpibL1Mlx7r/unbXJ7VLzz4=; b=YIV2gUr55d4PvxXaht9fm+hDePHVh/AIJyesrTyMLziCFNgarI2Lf7r17tQYXCbslXnIZr PGqLMvlqHCFfxaEn983Estt04+aLZOk1qQgWDsrYzg5SwCsZu7X7OYcQdegrP5I0VPYfdu BLKnMBsL1dGphz7mZ+nsUbGOcu807QI= ARC-Authentication-Results: i=1; imf25.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=GibbkWqf; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf25.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.177 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684459169; a=rsa-sha256; cv=none; b=2g8MrQsruWuzc0x+5MJkgegzDuL13DExUKN8504gVRFqM/cQhBi+4YBepXMNEEZaIzu6mj QX97OCLjyGuPkYrSdGf2AIPcXG1Gg2+QKX+SQ4LN1d0gm5yS914tK0KybhAvCaKRw4kEQX lab584SQfAiT9ANAdT3oAmV9EXqtzkQ= Received: by mail-pf1-f177.google.com with SMTP id d2e1a72fcca58-64d247a023aso831740b3a.2 for ; Thu, 18 May 2023 18:19:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684459168; x=1687051168; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=amUmjeQdjogZim3KCvDHtpibL1Mlx7r/unbXJ7VLzz4=; b=GibbkWqfiwuo0GDKTjKpCXZxRAC34F6flBcYc63YtvRDvtZ56HZtHKuhrJYSdwe3/+ 6kPjFdVzSbPq+cF3lXOpkjZLCMYa7ei/z4zXxpzej0So1g37PcWmqewUZUgxYJCMM+RN jmAWbhNUMedM1L5m+UzN6elDn6LRlSsQzlPeM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684459168; x=1687051168; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=amUmjeQdjogZim3KCvDHtpibL1Mlx7r/unbXJ7VLzz4=; b=SEktL/SnoH9+576WUwveGcTEcnCQyWovKRozu7zL7OnryURkR3QmHF78cqOMwz1/No Qv0idbIT2/C3g0eI9dz6ozVkv9UKGkjwlGcSkQc4yRQqY5oB95QFbU+EDlyuWVD8xULd B4UbrYqAW2l5NSqXW4Msu5HDZvBVmA8tR4Pxmx/0wJrs6ZXfykOUNDT3qLNOdgQIkjGw UvlfUOxmLdbAGHf2PDfuG+MGqsY1+mF29ID35jPhmF0dLlsY2mMm1Gxl7kdrTHfWg7ya 202TmHLDOHziCH5Z9nSlAAWSgizFSZbAt9zNStVzzQXGYU7Lmu33A9dP0s6g65TuOmYJ etow== X-Gm-Message-State: AC+VfDx7qKFuiWbl+wPjN54U/fQwWEHEtxyPDH8uYDQ1mlGZCQZU+Lyh ql2tciJd+E7icABfz769qaSpyA== X-Google-Smtp-Source: ACHHUZ6CRfRqSBxkPWsay/WrlVhskzJPviRUVesausHDoJ1nxVzNabu1OJDVAOucE5hVphusdAmIbw== X-Received: by 2002:a05:6a00:134c:b0:648:64fe:b14b with SMTP id k12-20020a056a00134c00b0064864feb14bmr881854pfu.32.1684459167669; Thu, 18 May 2023 18:19:27 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id b6-20020a630c06000000b00502ecb91940sm1824283pgl.55.2023.05.18.18.19.26 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 18 May 2023 18:19:27 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v1 1/6] PKEY: Introduce PKEY_ENFORCE_API flag Date: Fri, 19 May 2023 01:19:09 +0000 Message-ID: <20230519011915.846407-2-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog In-Reply-To: <20230519011915.846407-1-jeffxu@chromium.org> References: <20230519011915.846407-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: E60A0A0006 X-Stat-Signature: kso73d9mhrzrf4qfp795rg5ir6i47j14 X-Rspam-User: X-HE-Tag: 1684459168-191708 X-HE-Meta: U2FsdGVkX19+gj8snpqc1f9a+r4I5Di3ikmnyR9pakYRnJ7hrnDlZCkX8ZBzqaIg/4V1SBSFb+21XPP3UQngyR8w2NurF0pEHJ3r26gFU2srtX0/GcfIwIdh0VmtrdPq72waJoUozri6+tMlLN8H0j4oyYGCaIcwNUGJ0cWkyhsLOVYK3jibAAt/4II+YWAcUUaqhVkeUpUB5mLWS/w4x5YVViUe0PgaONXbBHIahSKuxjJG1UWJ0cCVsCchiDnDxAhu1KrtLEG7PXLSYR2o0BGQkK0aDRPLqaqRzKrHW9BLBDd+lVTjEy0HjnTNmh9SdjnzuGU1RZhWbAqcyux5bA4FORrFQOtN6PABvI5aYwWNrPCAd+ewNl0Bx4BVCFqgoRWNnYXGCA3OKUu4tAEo6hcM0+z41DQEmkSg8d1vXlTv7RnOy42HWZath3yzvcK5RGIAcVNDuEahzJBMnJ8pp7sqcOGP7ll82WdNCYlSN1Ykxpvz2IeaEkU/gKF6VYGH0bRR3JtPOPr1KWg8MCDm+VcCMwVAYSivfzIY18GsGZoPfyqo8GW8Pdlkyg8bl7noVIz8jeXqXnDBBCHgb4j/PnS1HDrZ9Yx+x3DtX05xjF5OUOehXkUQ1OtBIP4Tn6giZI5tZHHpg5U7I1K29J4gg9dB3/9wpcaDoaO2DVTLPIspYpT0Fz7B3sq5+MnwVnxbiQYf78AowPLEb0D7hS92gK5E4THiirhIvEnY2EpXhwEVQFIjWvgvgJA0QHMdYbJkIlHXeLjMgXygPodfJ9lw3WmTi+ipHBItSpwq8XB4odeRs5Q65VakHhrekDUIFrivVBoX14nJdTr4L2cSuBGq9+wmalEftSkyc8sMkaneUb5Wg2Z0X5tBtsIAzueV3EJbvwAgDR8IDhkCLRYjGGfz/5T/jVLNGS2E3hbPuiRiXRUrfW1d5SJbmnrTG2KBkJZYJe88ZBcY22ljuX/Wm+I /nCE6evb i1xpe2/64ijeahbEhihMMj59kmqsIhsUXs7OFEyB5o8JUWs3k3G5pqaaCVtrX5H68jJq0MP/ZmqokiuJwbniTJCYSIhfX4g3B5vruyn23ehQONG6otWJhYuUxFCNyVWMFhw36QLmNNczWLE9/aNaVpiL97OrpqtVrAJS6UXZtfZyGBgtNYIW7n4FVGXYN7CUVjHMk4dmLFrFsRUv0S4zQRsGkKQ6lAG0c6HP8Jliq7pOtQVJgcsOg+KRmVVpg5WSfUDT6Wl74Tp5g99+xuIRh+nFp/hYbDm8+UDlc3rXG9MzCPOduDAh8UXg2tbniBSHWV3i1R2vMpDodN9iRToQxKkOQVGgO0LxWmv6uaP3oioVmiMx57D2HDul9nw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu This patch introduces a new flag, PKEY_ENFORCE_API, to the pkey_alloc() function. When a PKEY is created with this flag, it is enforced that any thread that wants to make changes to the memory mapping (such as mprotect/munmap) of the memory must have write access to the PKEY. This is to prevent unauthorized access to protected memory. PKEYs created without this flag will continue to work as they do now, for backwards compatibility. Signed-off-by: Jeff Xu --- arch/powerpc/include/asm/pkeys.h | 11 ++++++++- arch/x86/include/asm/mmu.h | 7 ++++++ arch/x86/include/asm/pkeys.h | 42 ++++++++++++++++++++++++++++++-- arch/x86/mm/pkeys.c | 2 +- include/linux/pkeys.h | 9 ++++++- include/uapi/linux/mman.h | 5 ++++ mm/mprotect.c | 6 ++--- 7 files changed, 74 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/include/asm/pkeys.h b/arch/powerpc/include/asm/pkeys.h index 59a2c7dbc78f..943333ac0fee 100644 --- a/arch/powerpc/include/asm/pkeys.h +++ b/arch/powerpc/include/asm/pkeys.h @@ -82,7 +82,7 @@ static inline bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey) * Relies on the mmap_lock to protect against concurrency in mm_pkey_alloc() and * mm_pkey_free(). */ -static inline int mm_pkey_alloc(struct mm_struct *mm) +static inline int mm_pkey_alloc(struct mm_struct *mm, unsigned long flags) { /* * Note: this is the one and only place we make sure that the pkey is @@ -168,5 +168,14 @@ static inline bool arch_pkeys_enabled(void) return mmu_has_feature(MMU_FTR_PKEY); } +static inline bool arch_check_pkey_alloc_flags(unsigned long flags) +{ + /* No flags supported yet. */ + if (flags) + return false; + + return true; +} + extern void pkey_mm_init(struct mm_struct *mm); #endif /*_ASM_POWERPC_KEYS_H */ diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h index 0da5c227f490..d97594b44d9a 100644 --- a/arch/x86/include/asm/mmu.h +++ b/arch/x86/include/asm/mmu.h @@ -66,6 +66,13 @@ typedef struct { */ u16 pkey_allocation_map; s16 execute_only_pkey; + /* + * One bit per protection key. + * When set, thread must have write permission on corresponding + * PKRU in order to call memory mapping API, such as mprotect, + * munmap, etc. + */ + u16 pkey_enforce_api_map; #endif } mm_context_t; diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h index 2e6c04d8a45b..ecadf04a8251 100644 --- a/arch/x86/include/asm/pkeys.h +++ b/arch/x86/include/asm/pkeys.h @@ -51,6 +51,17 @@ static inline int arch_override_mprotect_pkey(struct vm_area_struct *vma, mm_pkey_allocation_map(mm) &= ~(1U << pkey); \ } while (0) +#define mm_pkey_enforce_api_map(mm) (mm->context.pkey_enforce_api_map) +#define mm_set_pkey_enforce_api(mm, pkey) \ + { \ + mm_pkey_enforce_api_map(mm) |= (1U << pkey); \ + } + +#define mm_clear_pkey_enforce_api(mm, pkey) \ + { \ + mm_pkey_enforce_api_map(mm) &= ~(1U << pkey); \ + } + static inline bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey) { @@ -74,11 +85,25 @@ bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey) return mm_pkey_allocation_map(mm) & (1U << pkey); } +/* + * Return true if the pkey has ENFORCE_API flag during allocation. + */ +static inline bool mm_pkey_enforce_api(struct mm_struct *mm, int pkey) +{ + /* + * Only pkey created by user space has the flag. + * execute_only_pkey check is in mm_pkey_is_allocated(). + */ + if (pkey != ARCH_DEFAULT_PKEY && mm_pkey_is_allocated(mm, pkey)) + return mm_pkey_enforce_api_map(mm) & (1U << pkey); + + return false; +} + /* * Returns a positive, 4-bit key on success, or -1 on failure. */ -static inline -int mm_pkey_alloc(struct mm_struct *mm) +static inline int mm_pkey_alloc(struct mm_struct *mm, unsigned long flags) { /* * Note: this is the one and only place we make sure @@ -101,6 +126,9 @@ int mm_pkey_alloc(struct mm_struct *mm) mm_set_pkey_allocated(mm, ret); + if (flags & PKEY_ENFORCE_API) + mm_set_pkey_enforce_api(mm, ret); + return ret; } @@ -110,6 +138,7 @@ int mm_pkey_free(struct mm_struct *mm, int pkey) if (!mm_pkey_is_allocated(mm, pkey)) return -EINVAL; + mm_clear_pkey_enforce_api(mm, pkey); mm_set_pkey_free(mm, pkey); return 0; @@ -123,4 +152,13 @@ static inline int vma_pkey(struct vm_area_struct *vma) return (vma->vm_flags & vma_pkey_mask) >> VM_PKEY_SHIFT; } +static inline bool arch_check_pkey_alloc_flags(unsigned long flags) +{ + unsigned long valid_flags = PKEY_ENFORCE_API; + + if (flags & ~valid_flags) + return false; + + return true; +} #endif /*_ASM_X86_PKEYS_H */ diff --git a/arch/x86/mm/pkeys.c b/arch/x86/mm/pkeys.c index 7418c367e328..a76981f44acf 100644 --- a/arch/x86/mm/pkeys.c +++ b/arch/x86/mm/pkeys.c @@ -20,7 +20,7 @@ int __execute_only_pkey(struct mm_struct *mm) /* Do we need to assign a pkey for mm's execute-only maps? */ if (execute_only_pkey == -1) { /* Go allocate one to use, which might fail */ - execute_only_pkey = mm_pkey_alloc(mm); + execute_only_pkey = mm_pkey_alloc(mm, 0); if (execute_only_pkey < 0) return -1; need_to_set_mm_pkey = true; diff --git a/include/linux/pkeys.h b/include/linux/pkeys.h index 86be8bf27b41..81a482c3e051 100644 --- a/include/linux/pkeys.h +++ b/include/linux/pkeys.h @@ -3,6 +3,7 @@ #define _LINUX_PKEYS_H #include +#include #define ARCH_DEFAULT_PKEY 0 @@ -25,7 +26,7 @@ static inline bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey) return (pkey == 0); } -static inline int mm_pkey_alloc(struct mm_struct *mm) +static inline int mm_pkey_alloc(struct mm_struct *mm, unsigned long flags) { return -1; } @@ -46,6 +47,12 @@ static inline bool arch_pkeys_enabled(void) return false; } +static inline bool arch_check_pkey_alloc_flags(unsigned long flags) +{ + if (flags) + return false; + return true; +} #endif /* ! CONFIG_ARCH_HAS_PKEYS */ #endif /* _LINUX_PKEYS_H */ diff --git a/include/uapi/linux/mman.h b/include/uapi/linux/mman.h index f55bc680b5b0..8c69b9a7ff5b 100644 --- a/include/uapi/linux/mman.h +++ b/include/uapi/linux/mman.h @@ -41,4 +41,9 @@ #define MAP_HUGE_2GB HUGETLB_FLAG_ENCODE_2GB #define MAP_HUGE_16GB HUGETLB_FLAG_ENCODE_16GB +/* + * Flags for pkey_alloc + */ +#define PKEY_ENFORCE_API (1 << 0) + #endif /* _UAPI_LINUX_MMAN_H */ diff --git a/mm/mprotect.c b/mm/mprotect.c index 92d3d3ca390a..8a68fdca8487 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -894,15 +894,15 @@ SYSCALL_DEFINE2(pkey_alloc, unsigned long, flags, unsigned long, init_val) int pkey; int ret; - /* No flags supported yet. */ - if (flags) + if (!arch_check_pkey_alloc_flags(flags)) return -EINVAL; + /* check for unsupported init values */ if (init_val & ~PKEY_ACCESS_MASK) return -EINVAL; mmap_write_lock(current->mm); - pkey = mm_pkey_alloc(current->mm); + pkey = mm_pkey_alloc(current->mm, flags); ret = -ENOSPC; if (pkey == -1) From patchwork Fri May 19 01:19:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13247582 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0381AC7EE29 for ; Fri, 19 May 2023 01:19:33 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2747B280002; Thu, 18 May 2023 21:19:32 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1FCBC280001; Thu, 18 May 2023 21:19:32 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 02733280002; Thu, 18 May 2023 21:19:31 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id E0747280001 for ; Thu, 18 May 2023 21:19:31 -0400 (EDT) Received: from smtpin22.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id B50D3160135 for ; Fri, 19 May 2023 01:19:31 +0000 (UTC) X-FDA: 80805246942.22.2E5A972 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) by imf27.hostedemail.com (Postfix) with ESMTP id D52FF40009 for ; Fri, 19 May 2023 01:19:29 +0000 (UTC) Authentication-Results: imf27.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=OGPd3mn4; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf27.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.216.48 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684459169; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=TQS98FLuUxt8kfip9Nk8O1hVfeuWAt0sl7+06c/6tso=; b=rQwV439VtXYCzGbwNXOiGLJowG3vv/R4hKdSUP/BpA7k29AXWPgyHFPKDPbKxWzVTjxJYy fp5YyOxVi4Qf+kfwx4hFgwEPtXiJQD/40NBkEIRi8YLvq4AS+3H3EHmkvEAixIFA/mZ00Y 6b9OpNv8BXVFreoBSPC0Fpopf54DYh4= ARC-Authentication-Results: i=1; imf27.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=OGPd3mn4; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf27.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.216.48 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684459169; a=rsa-sha256; cv=none; b=IQdIl/kBr8dgchM0RwSmpTdst0cj5QLAWjDSRPZdfLw/QM41g2CZRkK/C5ikxZzQ/jaku1 Jg/YYMVWU9W08CwyvyJFc4etx3gBQE+IBKvlwxXIVu6VKbb9j3juFCsTeflUa20cVeCtcB f2Tw8KEz7jXnw4R9L2c7ggG1WY4dV0Q= Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-253570deb8dso1416541a91.1 for ; Thu, 18 May 2023 18:19:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684459169; x=1687051169; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TQS98FLuUxt8kfip9Nk8O1hVfeuWAt0sl7+06c/6tso=; b=OGPd3mn4AXIrc1RRZIu250DTtUsK1KYvi8EfuJPLZrZrm+XTM1dOslqaOYntJ4QlnF P1XUdOXQFW2q48KVb2YvQI1UOuJ6zvUuQNOwxGx4Ltcqz+zGeskAKaAjKOirPNTB39HS jBq/1Yq0YsewgO7yu5hZy+p7qvRI04QhhT2rY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684459169; x=1687051169; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TQS98FLuUxt8kfip9Nk8O1hVfeuWAt0sl7+06c/6tso=; b=U4RIJNs+SAWYZq7HyeGbAXqwyHndEPtYkMjSQR3NqFJFsy/43wzmRE25htbGTzZtUi f7p6DHmetzWh0SW2/QM/6tPwW4Gw2DfYQjPYWtHsj4zBIp/GYChMmmkUnUv2EwfOGbZR WmPnJUeS1qjzPN+Gjt5WKuJ6wZYFPF1tpJTX6caN36XgGimp8tytffN/Pf4HMetSZw79 RaTQr8ygLZdcmps60cU7PO/SvN28hNmYqv47b/w2NhAIUDuPThR+EVE6JwBP3QK7BmF7 8OoikLIW0fbxjuWlQbuM1DxHVORUWSzIGBnUJEo14DzsIT+grhJhcWbY3iMMRyrxWVyn ZtDQ== X-Gm-Message-State: AC+VfDxeCtXIw6g1GjmJzSSJ28+3ptMWr/6qFZjzwhRRD6PZo1HFnmYi /tGpZvP/N4owXjMV8cXIx242qA== X-Google-Smtp-Source: ACHHUZ61pfxccHt/KzXaf0wYbWk/1Tu3oFrft5OWJaPA3VQ8PQiXauBnEJkKqfgy+TrBmMg73D6nkg== X-Received: by 2002:a17:90b:3ecc:b0:246:85ec:d816 with SMTP id rm12-20020a17090b3ecc00b0024685ecd816mr538354pjb.3.1684459168766; Thu, 18 May 2023 18:19:28 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id a19-20020a17090acb9300b0025356cce0e4sm279592pju.24.2023.05.18.18.19.27 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 18 May 2023 18:19:28 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v1 2/6] PKEY: Add arch_check_pkey_enforce_api() Date: Fri, 19 May 2023 01:19:10 +0000 Message-ID: <20230519011915.846407-3-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog In-Reply-To: <20230519011915.846407-1-jeffxu@chromium.org> References: <20230519011915.846407-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspam-User: X-Rspamd-Server: rspam12 X-Rspamd-Queue-Id: D52FF40009 X-Stat-Signature: gog97rtbapt8hjenwhmwjtw5ghc8ygno X-HE-Tag: 1684459169-345939 X-HE-Meta: U2FsdGVkX1+Z2IF4YLIvdPtptoW7eoPGFEaCgnCvVMn2qnpEaeuCTXrTy+JIGBt6+/aZ/vMjGAvD0Z6ch9rhYQQ/ooqZNmy/6iQ5EaT0IZ9gOTK3yD94x5LkokIz5690LKAYjw5Uw6rdwiB1DP8IFw3T+WSXBscpWxpyLnRMyfDWp8wHZQ9ZR2kd6fmzWlnDj2h0frRAZ5vHCJaa+j/GABlv2HxCafDylFVffJ2JxbCTJVGX9hPph8rse8RlXrELXxKAlqWoU7sG8QVEWFLON/ZhBLL1BJ1L9hYG3euknqShua0wiIg+YPi8g1+FkhDqBgr0QEtSkikyfs0BLYkMPyTdLvzEy2jtpXgn349+PwsWKkBaWOlaTF96rgFsuTjI9rNc9Km5QeAIPNq6QPtxaXRip1SgkPwZ/F1WdIr7jlq4qEChEECfrmx6N8T14XZSbFVADIUS2ZjsDTIyY5OIuzGWirwHjhmRPSnHrYt4NPxQXCfVoJE10fu8jem6+zO98u90UPqPyhpjddB5Ul4NhxoNuRAla3wcZdpUBPq+htRz+6LBWYnA1SpcU/KWCRVcx5T+8YRj5oXE6mHboZP0rQ3kINEt4CtoJZkuUJa0FaHpgjIrgHVC2F1/NQOsiDGkxsz8rROsFhDJJ3f6VDpjeM4EuzXpxcxDri9M8T3XemKjIkt6w0Yu0bob9P/o4OIUsBZdWCGRDjmDeJz44L5K3iJkIROsFQNqJ1b2D6cnOlo1uNYFTCoqNjrV8wWMq/dyJnYOvhYGK4Pwezfqx+6fgpOW1RMEUom+v3Ki5YmFMyaRh3tWJnowCxoOmATYGGFeC/s41EAHLKBIXof0jsVXUK3RkNXemPxRtDCiQaXMdU1Hc6GFoVGfSf9gs93ezGSIHW7YVWCn+rLw7cv42ru6H6ZnDAwR67kcROTh8sRVRJaXvP2Ez06yehpgV1tkWBWl89jrEktd+SNbVnGMqPl J/0W1H1g GXxW+NhJ+0/ltr5vSGPbm6livsJK9UdWJ0Fb7DNsuzNopnh8aP9BF1ugzb4aAViLJ1QSswoJlbmnyJkVvpi1JAUGodODXnQpTJs/tV4170vG6rbZZivHunmVV0ugx24Js2aR1CgGHS45q/VZ/etzc4YPu3Suu6ZzwPgGbOu7EZBYusuBTrSf2cLvi2qSLYyr3JN7ZzRYHzS+tmbr3el8YlrKgF+9OAmO3z7wpWq6/fu42b2zqmS75qACwutnfohKY/fsbHe4xhY9jJ4i0Cq9/Vy3miWG/Wh1kAu6S4QzWPKjbaGWWq6Hh+Q5r3WmSka2Qms5YgeUvBVqSKSZjjpiJrYZykdYkR5QqNGbym7l1cn6DvsvCPrC3o+8CSA== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu This patch adds an architecture-independent function, arch_check_pkey_enforce_api(), that checks whether the calling thread has write access to the PKRU for a given range of memory. If the memory range is protected by PKEY_ENFORCE_API, then the thread must have write access to the PKRU in order to make changes to the memory mapping (such as mprotect/munmap). This function is used by the kernel to enforce the PKEY_ENFORCE_API flag. Signed-off-by: Jeff Xu --- arch/powerpc/include/asm/pkeys.h | 8 +++++ arch/x86/include/asm/pkeys.h | 50 ++++++++++++++++++++++++++++++++ include/linux/pkeys.h | 9 ++++++ 3 files changed, 67 insertions(+) diff --git a/arch/powerpc/include/asm/pkeys.h b/arch/powerpc/include/asm/pkeys.h index 943333ac0fee..24c481e5e95b 100644 --- a/arch/powerpc/include/asm/pkeys.h +++ b/arch/powerpc/include/asm/pkeys.h @@ -177,5 +177,13 @@ static inline bool arch_check_pkey_alloc_flags(unsigned long flags) return true; } +static inline int arch_check_pkey_enforce_api(struct mm_struct *mm, + unsigned long start, + unsigned long end) +{ + /* Allow by default */ + return 0; +} + extern void pkey_mm_init(struct mm_struct *mm); #endif /*_ASM_POWERPC_KEYS_H */ diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h index ecadf04a8251..8b94ffc4ca32 100644 --- a/arch/x86/include/asm/pkeys.h +++ b/arch/x86/include/asm/pkeys.h @@ -161,4 +161,54 @@ static inline bool arch_check_pkey_alloc_flags(unsigned long flags) return true; } + +static inline int __arch_check_vma_pkey_for_write(struct vm_area_struct *vma) +{ + int pkey = vma_pkey(vma); + + if (mm_pkey_enforce_api(vma->vm_mm, pkey)) { + if (!__pkru_allows_write(read_pkru(), pkey)) + return -EACCES; + } + + return 0; +} + +/* + * arch_check_pkey_enforce_api is used by the kernel to enforce + * PKEY_ENFORCE_API flag. + * It checks whether the calling thread has write access to the PKRU + * for a given range of memory. If the memory range is protected by + * PKEY_ENFORCE_API, then the thread must have write access to the + * PKRU in order to make changes to the memory mapping, such as + * mprotect/munmap. + */ +static inline int arch_check_pkey_enforce_api(struct mm_struct *mm, + unsigned long start, + unsigned long end) +{ + int error; + struct vm_area_struct *vma; + + if (!arch_pkeys_enabled()) + return 0; + + while (true) { + vma = find_vma_intersection(mm, start, end); + if (!vma) + break; + + error = __arch_check_vma_pkey_for_write(vma); + if (error) + return error; + + if (vma->vm_end >= end) + break; + + start = vma->vm_end; + } + + return 0; +} + #endif /*_ASM_X86_PKEYS_H */ diff --git a/include/linux/pkeys.h b/include/linux/pkeys.h index 81a482c3e051..7b00689e1c24 100644 --- a/include/linux/pkeys.h +++ b/include/linux/pkeys.h @@ -53,6 +53,15 @@ static inline bool arch_check_pkey_alloc_flags(unsigned long flags) return false; return true; } + +static inline int arch_check_pkey_enforce_api(struct mm_struct *mm, + unsigned long start, + unsigned long end) +{ + // Allow by default. + return 0; +} + #endif /* ! CONFIG_ARCH_HAS_PKEYS */ #endif /* _LINUX_PKEYS_H */ From patchwork Fri May 19 01:19:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13247583 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97C29C7EE2C for ; Fri, 19 May 2023 01:19:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 2259E280003; Thu, 18 May 2023 21:19:33 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 1B13D280001; Thu, 18 May 2023 21:19:33 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EF4BD280003; Thu, 18 May 2023 21:19:32 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id DE5B5280001 for ; Thu, 18 May 2023 21:19:32 -0400 (EDT) Received: from smtpin18.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id B45D4AE41A for ; Fri, 19 May 2023 01:19:32 +0000 (UTC) X-FDA: 80805246984.18.4163B3F Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) by imf05.hostedemail.com (Postfix) with ESMTP id CDB3E100012 for ; Fri, 19 May 2023 01:19:30 +0000 (UTC) Authentication-Results: imf05.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=JWIfslA4; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf05.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.182 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684459170; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=DlYfhs3BTQ2EJ5c00OoF7xAAokRQfPc4lQTpfzHm9OE=; b=cIKgdc//jN1W1MCSe6c0vcHjxB0U9gqRWsUufaNwJNsIB1MB0GuZcnM6Sj5WALzgVc6na/ dwb6tnPZqHd4L07+Qcjj33/+6RyN2psiE8ObPWpybvBeKlmLzk1q4HsYjmX2ttxIrioDxo 9tjOjrI95Z/pmDCBfYSPaKd1Q5YxQDo= ARC-Authentication-Results: i=1; imf05.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=JWIfslA4; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf05.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.182 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684459170; a=rsa-sha256; cv=none; b=eSOPJs7MxALPLnykAjX07QK5ysmJHB+45WrPiHYEXirJI1xekLPRTcBUr16YDVp6SZsj35 nj+5VxaZ0y7Gt5OndgpPxOLH0VFfvoOK+qPsOJXLb8HH9BTjAOKcreCiMLCZNOVkTUyFew 7lTI8jWXrSL70Rw7wNllfoBgp0gO00Y= Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-64d2981e3abso669542b3a.1 for ; Thu, 18 May 2023 18:19:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684459169; x=1687051169; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=DlYfhs3BTQ2EJ5c00OoF7xAAokRQfPc4lQTpfzHm9OE=; b=JWIfslA4UKDBw1Mp583btzlGGK8G9E6xpS7M8yt3iOyE0agyVlu+KO5Lxq4vpucXSU HH1YA4BQeb7OL6OLVkoix4UxlcxXNVOrDy2c5gWBw82vyYqfMb8tY9sDkBb9j+Na0b8j 0kO3Cd+a0jrUOyQcvN7J2vDvvbkTYN/CiGCqY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684459169; x=1687051169; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=DlYfhs3BTQ2EJ5c00OoF7xAAokRQfPc4lQTpfzHm9OE=; b=TphhJ/JJnh3elMzf6JkXu7+UAPc4Cia8W8zq3AE0jRbK5C0Dt8lUnsBbaTSQxduZZo UcKvdMJ3f/+Vyza+GrwdCXAoG1AHb/nQEu0FztS7f8WKfgvEfKbjiQ2yUbm0SDsEmh0o JpeCEbUW5TwzVaReTOPtjcYuk0XkfQAK1ybWNZaB/BP1B6fq/MY6q8LHOwm5j13z3Yf8 DlAmUwjnb+T+NGShIOe+rbVlXVuKtVJhI/SCGf1PfIalm1GngLi2Zby4iLcQVFF7yMaF i+ItWnXey0ll4K6XJlp2HJYPH8+pa5x4+5Ix3oE+7VvktyGeL22fyTnbTIiH7O+RZyep RmOg== X-Gm-Message-State: AC+VfDwtFkiPh19WTBetTN7/Pjv7hfbOCkdlaZwvilMfIYdphZxorN0g M2uc/FGEWN6icZL9YWVx9F2Bdg== X-Google-Smtp-Source: ACHHUZ65BMUPG6NH0sSEE5yDD+qKd1DPXj0Iug+5r1nNE9fAXNvkKS48swgrqtg3LFDKz96p8HSxUA== X-Received: by 2002:a05:6a20:8422:b0:ef:205f:8184 with SMTP id c34-20020a056a20842200b000ef205f8184mr425525pzd.13.1684459169739; Thu, 18 May 2023 18:19:29 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id c24-20020a62e818000000b00643864d03dfsm1960424pfi.171.2023.05.18.18.19.29 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 18 May 2023 18:19:29 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v1 3/6] PKEY: Apply PKEY_ENFORCE_API to mprotect Date: Fri, 19 May 2023 01:19:11 +0000 Message-ID: <20230519011915.846407-4-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog In-Reply-To: <20230519011915.846407-1-jeffxu@chromium.org> References: <20230519011915.846407-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspam-User: X-Stat-Signature: az3qx86sphmaw95nhzq91djchgwh7mya X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: CDB3E100012 X-HE-Tag: 1684459170-22946 X-HE-Meta: U2FsdGVkX19HVPN9wfmKL9cZ9qYZzM2WEHpxlGZwwSNBmjAjRe7Si41bnwdPjGPoz3PcrDTNwV++ZwuG8uDKKBMUK/l2sxhFAG0oFz+JuLvGV9SJutlVDPPkfbQFQ9kMbB1sVsRLOA78b1Oe8vANtxns+ETp7mWgIvVQVpwStJIc09Q3YgGvYAxAf9mRxGk0NVFGVcoxtoCDPj07udCuOE5dJr2bgJlPRd3H8xW/xxP2DkaMao9yDdERfHmgsQ3qK534uVxhosB++OKc+YfsU/S9ZXKxQALUuDoLo4l04dSHqscU5KU44+yHUEpr/XF87w1u5Rl1SZ3PdUS10sCNQu9uCRBBauSC4PYRzljh+36df0Q5KqzUGqh5qsIUMZ/m9/0JFfw3ki7cw9ChJ0N5pTXKEjJpAqTC3su5fq8ovd3H4rMwqG1jqcOu5Na1NCsZVpZMZ96CIZC+rGxOW1YWrV1UlRt5xsk/wVrKCDlOfkDNKWfAIst9smCRNybjZlH+ffCOUAac8+wUdEJML+yV07GyvS0Vc4q/0Y0kgGAHNx4NSrhPzjJHvr/oskEIQRlsXyQhbFL5JJTQzQtMa/SwU0OdBYvwTEi/Mg5j4TvswR3LqojoQIj6pSdXJIj6DimkO0Y3hIXbxs552tv1PqlBoqq6Jx7tJkSWE2yH7G+8OT76DlzyCqsDPA0i9NG7XJIoOo+ZRVM1opJZ8jxCNcT28ySjwTp5u8IAGxXjTPTVMfY/f+tLGL9IYD7bZDjX7WUwlQcUxZA0JdB32Z1ANEUenwVwBxVbqoNffmT5QQKMSqchOnlZUmsv7A4e+KRacXWeQsSEAGLtRpsmg+/FxJStjuW/N7m7pYT+cW330GTX7+0KD28mcd3loOwnLHP3S7nQOzvslByeoXXhQZ+I8zw+NnUBkO9PpTPwBD6s3uT5wF57PWIckTpuUeaj+c1O+BXVaoKzNif5bYbD0yuzyUF Rixa7ndL t0Js0fzqV7NwZyQoTiNSyU9XmUA9Xg3hgoztM9PBvI+LdTcN6naQSolwxfdw2yoZyqra2f4lPgvIbMVSJyjtkyed0pISaS8g6XSplCGfaMEui1tgr+ljjCx6WolpVpJbedIdeoKSnK20u2cgB49frKu49p4N8+LuXgotyWdJN3wRur+WhnlcP0vVdb++qqsF2QN9KeS/idOn4qPuP3ePOlesJ8qGs3R7nVvIQPkdmRMlKJJGmFb7F+kgFxjItZhIewjqsUQllXrN2DXSjycwsaOHTtT5rxTrIqRNFX12z0UzlMZt13SzjoLNn+I+KV17/K4ZbgWYO8n7VmLnvO4xi12SlRKb5/bYk7aX9qN51PY0vppc/eyi6/nGda54mqC1z+IRUpfd4Dmub+mzXA4IdJ1zCemwm3BBocPwK X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu This patch enables PKEY_ENFORCE_API for the mprotect and mprotect_pkey syscalls. Signed-off-by: Jeff Xu --- mm/mprotect.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/mm/mprotect.c b/mm/mprotect.c index 8a68fdca8487..1db30b8baac3 100644 --- a/mm/mprotect.c +++ b/mm/mprotect.c @@ -794,6 +794,17 @@ static int do_mprotect_pkey(unsigned long start, size_t len, } } + /* + * arch_check_pkey_enforce_api checks if current thread + * has the PKEY permission to modify the memory mapping. + * Note: this should only apply to the cases that do_mprotect_pkey + * is called from syscall entry. Ref. to munmap for other cases. + */ + if (arch_check_pkey_enforce_api(current->mm, start, end) < 0) { + error = -EACCES; + goto out; + } + prev = vma_prev(&vmi); if (start > vma->vm_start) prev = vma; From patchwork Fri May 19 01:19:12 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13247584 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8703BC7EE2D for ; Fri, 19 May 2023 01:19:37 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6E23B280004; Thu, 18 May 2023 21:19:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 61C3D280001; Thu, 18 May 2023 21:19:34 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3D552280004; Thu, 18 May 2023 21:19:34 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 27646280001 for ; Thu, 18 May 2023 21:19:34 -0400 (EDT) Received: from smtpin14.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay02.hostedemail.com (Postfix) with ESMTP id F0492120995 for ; Fri, 19 May 2023 01:19:33 +0000 (UTC) X-FDA: 80805247026.14.52DE9AD Received: from mail-pg1-f171.google.com (mail-pg1-f171.google.com [209.85.215.171]) by imf20.hostedemail.com (Postfix) with ESMTP id F3C561C0004 for ; Fri, 19 May 2023 01:19:31 +0000 (UTC) Authentication-Results: imf20.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=Xz+5GZCb; spf=pass (imf20.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.215.171 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684459172; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=qzO3EawE44DmDL2RDFGxHbI+J47AsuGzE5x/fc5YRSs=; b=1suEl5vOc3AHk8K4bZnGCpeWKPJIwYOxdkprU1j16RNJyEufwmROlYGdcib0Y5ENARBt7a +e4iEeQSU/JY0XJnZfzm+d5npHBU42zdl5/zVjf/GvLeI3+DfwH+aH2DP+4YgoyE9zG1Ll DeF/utA5mub2V5jSIWMR2/jWTLnhj4k= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684459172; a=rsa-sha256; cv=none; b=n0fJ8bjvomH+RkcZu8urKbxzQFrAtYdr/xjbMWA3+CTROApBADdKxMgzQxd1Ez+nk+sTUE gj3SM/LhSmqOCJZIB4ZcwTW2pvvCtloAVgHX9XG5EWNuvvkfvkk0meG6/6ZBqdPaCGMP6t O93KxnYxqq9NNqygnjvV8GWgCxxIHmw= ARC-Authentication-Results: i=1; imf20.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=Xz+5GZCb; spf=pass (imf20.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.215.171 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org Received: by mail-pg1-f171.google.com with SMTP id 41be03b00d2f7-51b4ef5378bso2476929a12.1 for ; Thu, 18 May 2023 18:19:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684459171; x=1687051171; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=qzO3EawE44DmDL2RDFGxHbI+J47AsuGzE5x/fc5YRSs=; b=Xz+5GZCb3fba+tXdlILZoYQkV4SVPHj5Vwq3DIRmzGvX64eYAzu0JkwUukNwnffs54 M9v00G5vG3JMYqhRAZSNj3NjdZf+5DSxJMHNq9AQDEWFtawgnIFbemZ5wunbbCOLlxtw ghWDWiFb7TtOseQ9yPeyC/EQ4o67LIc0xOhfo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684459171; x=1687051171; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=qzO3EawE44DmDL2RDFGxHbI+J47AsuGzE5x/fc5YRSs=; b=ECh5GPvTj1xt1GS7XnB9sYP4VfmZME3/fobN+QW+yzjmyfuaviH3P1LUyhMV1EAcSv hK67nkAgmC3QchIYVxF09cyZRKfUzw0AI3fAv+F39vmPhC6CBXW2/jXuDgu5n8iKaEYF m/5HxlcGDJ/5miXdt9KCGBezIAHz/liLeo9wdxM76PFeKDcOQltwiHC57/KabSfh8JF8 9ykXyjMWROwgyZyr3PNLfmM4xK1DgTtfyvCUOLk9OQWMRbZHG9FTmGcE79U3cAtjhzfN sDdHnY+dFaJWV8ycWjbLwQyvHsPE2RdPbVBIOahHTAyNgyWTv08d3bKzgIPIUjGczLGX Ad9w== X-Gm-Message-State: AC+VfDyObcGPxYJXOOeq7adgAmL6NRsEuUVxz/YjGl/v7f588CW8+uk4 cFaVVR4ATm6BVM63pFayE20SLA== X-Google-Smtp-Source: ACHHUZ6Fs6CYowy/agA+FF47C4n9YuZUo/3YX8PaB++LosNzsroEAzIx6Gf688Y9ZcsCjvKb79F0WQ== X-Received: by 2002:a05:6a20:c18d:b0:102:7aec:6dcc with SMTP id bg13-20020a056a20c18d00b001027aec6dccmr299922pzb.27.1684459170711; Thu, 18 May 2023 18:19:30 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id f62-20020a17090a704400b0023d386e4806sm294372pjk.57.2023.05.18.18.19.30 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 18 May 2023 18:19:30 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v1 4/6] PKEY:selftest pkey_enforce_api for mprotect Date: Fri, 19 May 2023 01:19:12 +0000 Message-ID: <20230519011915.846407-5-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog In-Reply-To: <20230519011915.846407-1-jeffxu@chromium.org> References: <20230519011915.846407-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspamd-Queue-Id: F3C561C0004 X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: iuotbjzsygkyke1stfghxxz9f1zdr13s X-HE-Tag: 1684459171-413764 X-HE-Meta: U2FsdGVkX18Mxb8gmuoxzXruzsyRq2DDab+52HvgX4VdR5CfoMrqnyr95Q116MiQp8tdYvfN8cebLWEEZ7XPYkYSNG/m43L0DefL1E2nvrEvUO8iM7FYsThaDUjISIbjxST1MzQvGZJztTM/TWSQnqtZgpfo0G6QmgHkbRjwHGyzA6XR/7ttXVj8gqLYgD8+doUtLIYk1iLzol5LjbaUxCB9BX8l9FKLOZnkxpyzDHHb5WgoBS1YRzp7tb2GaDPpNL8NZYpi+/Qj8SavxVXR0z1pRTf6u5aIImHPFbhK3ftXie7e0aCVq/DT/BaRWpBHAaIcHN4N3zrKCayH+NYGIH3Gd15IaxmYUnFNcsUW7AGS5q8wVNrjEZOMRmz/4kPopIdZ2DkjsGV+rcA+HFXHx0WEdxxZY2mEKN0Ndui7Kp749OBRZcHCl20CH1k/GU8apKF6uQLTeJdjbJrbt5vWhyCCeYs1KgfPbE7ivYT646NEmubu1B7w/IUneLSODEMtpDdCIIax+gTbpe1NvFtKQ9SLzdaBmFBG60oQAozNyUvX6N6ikJ76v+FgmxK65CdPYZ0OhI4IpyK3NjRf3yalR7HubKXI++qWQ6EbPyJb2xF68/Kb6JR6c2bFUZqWSoS0bKabAb6g/zSz7WWw52tqXumQULXLkux5PYGHh7leOwS2EEUJCnfO+bfRyE0JGB2WSeQAkPqsIQkyhTq14GyanLRD6ufJvXfM06ZJ2HbfcYjn/ZG45Vo89IqsSG0GmX+zTfiMsjGOmNHSLTXVQn4zL0JITkwozTFYKUamL/usatulRaoZmIhhZNQs2ztL9pj+TFmgbbSjKBxXGQODpOxT4ZwdKSnf29kUIBOnwA/pBSlzlAhuiSL6ePrvFk9SC9kVqPmpe9aLhItLcHLQA3Ox+yNFTF7Pz2tctLMPlrGQLh7a8nlCvRf+5bjKHHJIy/iFDeKInpUP7svKwIITtIK UglHiNJd P2AEBUc/aapv256rk4qYftSiblwb+MO7l97ZWsZE4wKD52g7FHLLbPP5KUTJIPf8iMV6MYuvOiXCYhVObhQebhjOWDZSW7MzorY6Ys+LxuSDdFCSAAmX1eWv3dRAzf0ggjJDRRcWOxGI49moD/0WOit8TH2pp1zqd62gX9muDGQpDGDQF3Q5o74Wq8X5y3IuyFBvoEhPKdi7qMzCSnT83EL/lMQyfmqdfwwhSlgiuweG31F50aBeAZb0UXKhSymH8vpoy4kfRphhfQoTb3+Bl4rqYnnZesLiNOGL3fBNf6IPEC68YaUfCKclnS4+aEYE/KjRiGsrXbbn245MdphslcrdvC2iMO08pCWwS+iD7bXW2d9EB08o8oZxe6A== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu Add selftest for pkey_enforce_api for mprotect. Signed-off-by: Jeff Xu --- tools/testing/selftests/mm/Makefile | 1 + tools/testing/selftests/mm/pkey_enforce_api.c | 875 ++++++++++++++++++ 2 files changed, 876 insertions(+) create mode 100644 tools/testing/selftests/mm/pkey_enforce_api.c diff --git a/tools/testing/selftests/mm/Makefile b/tools/testing/selftests/mm/Makefile index 23af4633f0f4..93437a394128 100644 --- a/tools/testing/selftests/mm/Makefile +++ b/tools/testing/selftests/mm/Makefile @@ -71,6 +71,7 @@ CAN_BUILD_X86_64 := $(shell ./../x86/check_cc.sh "$(CC)" ../x86/trivial_64bit_pr CAN_BUILD_WITH_NOPIE := $(shell ./../x86/check_cc.sh "$(CC)" ../x86/trivial_program.c -no-pie) VMTARGETS := protection_keys +VMTARGETS += pkey_enforce_api BINARIES_32 := $(VMTARGETS:%=%_32) BINARIES_64 := $(VMTARGETS:%=%_64) diff --git a/tools/testing/selftests/mm/pkey_enforce_api.c b/tools/testing/selftests/mm/pkey_enforce_api.c new file mode 100644 index 000000000000..23663c89bc9c --- /dev/null +++ b/tools/testing/selftests/mm/pkey_enforce_api.c @@ -0,0 +1,875 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Tests pkey_enforce_api + * + * Compile like this: + * gcc -mxsave -o pkey_enforce_api -O2 -g -std=gnu99 -pthread -Wall pkey_enforce_api.c \ + * -lrt -ldl -lm + * gcc -mxsave -m32 -o pkey_enforce_api_32 -O2 -g -std=gnu99 -pthread -Wall pkey_enforce_api.c \ + * -lrt -ldl -lm + */ +#define _GNU_SOURCE +#define __SANE_USERSPACE_TYPES__ +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include "../kselftest.h" +#include + +#if defined(__i386__) || defined(__x86_64__) /* arch */ + +#define dprintf0(args...) +#define dprintf1(args...) +#define dprintf2(args...) +#define dprintf3(args...) +#define dprintf4(args...) + +#ifndef u16 +#define u16 __u16 +#endif + +#ifndef u32 +#define u32 __u32 +#endif + +#ifndef u64 +#define u64 __u64 +#endif + +#ifndef PTR_ERR_ENOTSUP +#define PTR_ERR_ENOTSUP ((void *)-ENOTSUP) +#endif + +int read_ptr(int *ptr) +{ + return *ptr; +} + +void expected_pkey_fault(int pkey) +{ +} + +#include "pkey-x86.h" + +#ifndef PKEY_ENFORCE_API +#define PKEY_ENFORCE_API 1 +#endif + +#define PKEY_MASK (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE) + +#define LOG_TEST_ENTER(x) \ + { \ + printf("%s, enforce=%d\n", __func__, x); \ + } +static inline u64 set_pkey_bits(u64 reg, int pkey, u64 flags) +{ + u32 shift = pkey_bit_position(pkey); + /* mask out bits from pkey in old value */ + reg &= ~((u64)PKEY_MASK << shift); + /* OR in new bits for pkey */ + reg |= (flags & PKEY_MASK) << shift; + return reg; +} + +static inline u64 get_pkey_bits(u64 reg, int pkey) +{ + u32 shift = pkey_bit_position(pkey); + /* + * shift down the relevant bits to the lowest two, then + * mask off all the other higher bits + */ + return ((reg >> shift) & PKEY_MASK); +} + +static u32 get_pkey(int pkey) +{ + return (u32)get_pkey_bits(__read_pkey_reg(), pkey); +} + +static void set_pkey(int pkey, unsigned long pkey_value) +{ + u32 mask = (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE); + u64 new_pkey_reg; + + assert(!(pkey_value & ~mask)); + new_pkey_reg = set_pkey_bits(__read_pkey_reg(), pkey, pkey_value); + __write_pkey_reg(new_pkey_reg); +} + +void pkey_disable_set(int pkey, int value) +{ + int pkey_new; + + assert(value & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE)); + + pkey_new = get_pkey(pkey); + pkey_new |= value; + set_pkey(pkey, pkey_new); +} + +void pkey_disable_clear(int pkey, int value) +{ + int pkey_new; + + assert(value & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE)); + + pkey_new = get_pkey(pkey); + pkey_new &= ~value; + + set_pkey(pkey, pkey_new); +} + +void pkey_write_allow(int pkey) +{ + pkey_disable_clear(pkey, PKEY_DISABLE_WRITE); +} +void pkey_write_deny(int pkey) +{ + pkey_disable_set(pkey, PKEY_DISABLE_WRITE); +} +void pkey_access_allow(int pkey) +{ + pkey_disable_clear(pkey, PKEY_DISABLE_ACCESS); +} +void pkey_access_deny(int pkey) +{ + pkey_disable_set(pkey, PKEY_DISABLE_ACCESS); +} + +int sys_mprotect(void *ptr, size_t size, unsigned long prot) +{ + int sret; + + errno = 0; + sret = syscall(SYS_mprotect, ptr, size, prot); + return sret; +} + +int sys_mprotect_pkey(void *ptr, size_t size, unsigned long orig_prot, + unsigned long pkey) +{ + int sret; + + errno = 0; + sret = syscall(SYS_mprotect_key, ptr, size, orig_prot, pkey); + return sret; +} + +int sys_pkey_alloc(unsigned long flags, unsigned long init_val) +{ + int ret = syscall(SYS_pkey_alloc, flags, init_val); + return ret; +} + +int sys_pkey_free(unsigned long pkey) +{ + int ret = syscall(SYS_pkey_free, pkey); + return ret; +} + +bool can_create_pkey(void) +{ + int pkey; + + pkey = sys_pkey_alloc(0, 0); + if (pkey <= 0) + return false; + + sys_pkey_free(pkey); + return true; +} + +static inline int is_pkeys_supported(void) +{ + /* check if the cpu supports pkeys */ + if (!cpu_has_pkeys() || !can_create_pkey()) + return 0; + return 1; +} + +int pkey_alloc_with_check(bool enforce) +{ + int pkey; + + if (enforce) + pkey = sys_pkey_alloc(PKEY_ENFORCE_API, 0); + else + pkey = sys_pkey_alloc(0, 0); + + assert(pkey > 0); + return pkey; +} + +void *addr1 = (void *)0x5000000; +void *addr2 = (void *)0x5001000; +void *addr3 = (void *)0x5002000; +void *addr4 = (void *)0x5003000; + +void setup_single_address_with_pkey(bool enforce, int size, int *pkeyOut, + void **ptrOut) +{ + int pkey; + void *ptr; + int ret; + + pkey = pkey_alloc_with_check(enforce); + + ptr = mmap(NULL, size, PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); + assert(ptr != (void *)-1); + + // assign pkey to the memory. + ret = sys_mprotect_pkey((void *)ptr, size, PROT_READ, pkey); + assert(!ret); + + *pkeyOut = pkey; + *ptrOut = ptr; +} + +void setup_single_fixed_address_with_pkey(bool enforce, int size, int *pkeyOut, + void **ptrOut) +{ + int pkey; + void *ptr; + int ret; + + pkey = pkey_alloc_with_check(enforce); + + ptr = mmap(addr1, size, PROT_READ, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0); + assert(ptr == (void *)addr1); + + // assign pkey to the memory. + ret = sys_mprotect_pkey((void *)ptr, size, PROT_READ, pkey); + assert(!ret); + + *pkeyOut = pkey; + *ptrOut = ptr; +} + +void clean_single_address_with_pkey(int pkey, void *ptr, int size) +{ + int ret; + + ret = munmap(ptr, size); + assert(!ret); + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +void setup_two_continues_fixed_address_with_pkey(bool enforce, int size, + int *pkeyOut, void **ptrOut, + void **ptr2Out) +{ + void *ptr; + void *ptr2; + int pkey; + int ret; + + pkey = pkey_alloc_with_check(enforce); + + ptr = mmap(addr1, size, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr == addr1); + + ptr2 = mmap(addr2, size, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr2 == addr2); + + // assign pkey to both addresses in the same call (merged) + ret = sys_mprotect_pkey(ptr, size * 2, + PROT_READ | PROT_WRITE | PROT_EXEC, pkey); + assert(!ret); + *pkeyOut = pkey; + *ptrOut = ptr; + *ptr2Out = ptr2; +} + +void clean_two_address_with_pkey(int size, int pkey, void *ptr, void *ptr2) +{ + int ret; + + ret = munmap(ptr, size); + assert(!ret); + + ret = munmap(ptr2, size); + assert(!ret); + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +// pkey_alloc with flags. +void test_pkey_alloc(bool enforce) +{ + int ret; + + LOG_TEST_ENTER(enforce); + + ret = sys_pkey_alloc(0, 0); + assert(ret > 0); + ret = sys_pkey_free(ret); + assert(ret == 0); + + if (enforce) { + ret = sys_pkey_alloc(PKEY_ENFORCE_API, 0); + assert(ret > 0); + ret = sys_pkey_free(ret); + assert(ret == 0); + + // invalid flag. + ret = sys_pkey_alloc(0x4, 0); + assert(ret != 0); + } +} + +// mmap one address. +// assign pkey on the address. +// mprotect is denied when no-writeable PKRU in enforce mode. +void test_mprotect_single_address(bool enforce) +{ + int pkey; + int ret; + void *ptr; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_single_fixed_address_with_pkey(enforce, size, &pkey, &ptr); + + // disable write access. + pkey_write_deny(pkey); + + ret = sys_mprotect_pkey(ptr, size, PROT_READ | PROT_WRITE, pkey); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + ret = sys_mprotect(ptr, size, PROT_READ | PROT_WRITE); + if (enforce) + assert(ret < 0); + else + assert(ret == 0); + + pkey_write_allow(pkey); + + ret = sys_mprotect_pkey(ptr, size, PROT_READ, pkey); + assert(!ret); + + ret = sys_mprotect(ptr, size, PROT_READ); + assert(ret == 0); + + clean_single_address_with_pkey(pkey, ptr, size); +} + +// mmap two address (continuous two pages). +// assign PKEY to them with one mprotect_pkey call (merged address). +// mprotect is denied when non-writeable PKRU in enforce mode. +void test_mprotect_two_address_merge(bool enforce) +{ + int pkey; + int ret; + void *ptr; + void *ptr2; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_two_continues_fixed_address_with_pkey(enforce, size, &pkey, &ptr, + &ptr2); + + // disable write. + pkey_write_deny(pkey); + + // modify the protection on both addresses (merged). + ret = sys_mprotect(ptr, size * 2, PROT_READ | PROT_WRITE | PROT_EXEC); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + ret = sys_mprotect_pkey(ptr, size * 2, + PROT_READ | PROT_WRITE | PROT_EXEC, pkey); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + // modify the protection on both addresses (merged). + ret = sys_mprotect(ptr, size * 2, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + ret = sys_mprotect_pkey(ptr, size * 2, + PROT_READ | PROT_WRITE | PROT_EXEC, pkey); + assert(!ret); + + clean_two_address_with_pkey(size, pkey, ptr, ptr2); +} + +void setup_two_continues_fixed_address_protect_second_with_pkey( + bool enforce, int size, int *pkeyOut, void **ptrOut, void **ptr2Out) +{ + void *ptr; + void *ptr2; + int pkey; + int ret; + + LOG_TEST_ENTER(enforce); + + pkey = pkey_alloc_with_check(enforce); + + // mmap two addresses (continuous two pages). + ptr = mmap(addr1, size, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr == addr1); + + ptr2 = mmap(addr2, size, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr2 == addr2); + + // assign pkey to the second page. + ret = sys_mprotect_pkey(addr2, size, PROT_READ | PROT_WRITE | PROT_EXEC, + pkey); + assert(!ret); + + *pkeyOut = pkey; + *ptrOut = ptr; + *ptr2Out = ptr2; +} + +// mmap two address (continuous two pages). +// assign PKEY to the second address. +// mprotect on the second address is denied properly. +// mprotect on both addresses (merged) is denied properly. +void test_mprotect_two_address_deny_second(bool enforce) +{ + int pkey; + int ret; + void *ptr; + void *ptr2; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_two_continues_fixed_address_protect_second_with_pkey( + enforce, size, &pkey, &ptr, &ptr2); + + // disable write through pkey. + pkey_write_deny(pkey); + + // modify the first addr is allowed. + ret = sys_mprotect(ptr, size, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + // modify the second mmap is protected by pkey. + ret = sys_mprotect(ptr2, size, PROT_READ | PROT_WRITE | PROT_EXEC); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + // mprotect both addresses (merged). + ret = sys_mprotect_pkey(ptr, size * 2, + PROT_READ | PROT_WRITE | PROT_EXEC, pkey); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + ret = sys_mprotect(ptr, size * 2, PROT_READ | PROT_WRITE | PROT_EXEC); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + ret = sys_mprotect_pkey(ptr, size * 2, PROT_READ, pkey); + assert(!ret); + + ret = sys_mprotect(ptr, size * 2, PROT_READ); + assert(!ret); + + clean_two_address_with_pkey(size, pkey, ptr, ptr2); +} + +void setup_4pages_fixed_protect_second_page(bool enforce, int size, + int *pkeyOut, void **ptrOut, + void **ptr2Out, void **ptr3Out) +{ + int pkey; + int ret; + void *ptr; + + pkey = pkey_alloc_with_check(enforce); + + // allocate 4 pages. + ptr = mmap(addr1, size * 4, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr == addr1); + + // assign pkey to the second address. + ret = sys_mprotect_pkey(addr2, size, PROT_READ | PROT_WRITE | PROT_EXEC, + pkey); + assert(!ret); + + *pkeyOut = pkey; + *ptrOut = ptr; + *ptr2Out = addr2; + *ptr3Out = addr3; +} + +// mmap one address with 4 pages. +// assign PKEY to the second page only. +// mprotect on the first page is allowed. +// mprotect on the second page is protected in enforce mode. +// mprotect on memory range that includes the second pages is protected. +void test_mprotect_vma_middle_addr(bool enforce) +{ + int pkey; + int ret; + void *ptr, *ptr2, *ptr3; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_4pages_fixed_protect_second_page(enforce, size, &pkey, &ptr, + &ptr2, &ptr3); + + // disable write through pkey. + pkey_write_deny(pkey); + + // modify to the first page is allowed. + ret = sys_mprotect(ptr, size, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + // modify to the third page is allowed. + ret = sys_mprotect(ptr3, size, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + // modify to the second page is protected by pkey. + ret = sys_mprotect(ptr2, size, PROT_READ | PROT_WRITE | PROT_EXEC); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + // modify to memory range that includes the second page is protected. + ret = sys_mprotect_pkey(ptr, size * 4, + PROT_READ | PROT_WRITE | PROT_EXEC, pkey); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + ret = sys_mprotect(ptr, size * 4, PROT_READ | PROT_WRITE | PROT_EXEC); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + ret = sys_mprotect(addr2, size, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + ret = sys_mprotect_pkey(ptr, size * 4, + PROT_READ | PROT_WRITE | PROT_EXEC, pkey); + assert(!ret); + + clean_single_address_with_pkey(pkey, ptr, size * 4); +} + +// mmap one address with 4 pages. +// assign PKEY to the second page only. +// mprotect on the second page, but size is unaligned. +void test_mprotect_unaligned(bool enforce) +{ + int pkey; + int ret; + void *ptr, *ptr2, *ptr3; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_4pages_fixed_protect_second_page(enforce, size, &pkey, &ptr, + &ptr2, &ptr3); + + // disable write through pkey. + pkey_write_deny(pkey); + + // modify to the first page is allowed. + ret = sys_mprotect(ptr, size, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + // modify to the second page is protected by pkey. + ret = sys_mprotect(ptr2, size - 1, PROT_READ | PROT_WRITE | PROT_EXEC); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + ret = sys_mprotect(addr2, size - 1, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + clean_single_address_with_pkey(pkey, ptr, size * 4); +} + +// mmap one address with 4 pages. +// assign PKEY to the second page only. +// mprotect on the second page, but size is unaligned. +void test_mprotect_unaligned2(bool enforce) +{ + int pkey; + int ret; + void *ptr, *ptr2, *ptr3; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_4pages_fixed_protect_second_page(enforce, size, &pkey, &ptr, + &ptr2, &ptr3); + + // disable write through pkey. + pkey_write_deny(pkey); + + // modify to the first page is allowed. + ret = sys_mprotect(ptr, size, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + // modify to the second page is protected by pkey. + ret = sys_mprotect(ptr2, size + 1, PROT_READ | PROT_WRITE | PROT_EXEC); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + ret = sys_mprotect(addr2, size + 1, PROT_READ | PROT_WRITE | PROT_EXEC); + assert(!ret); + + clean_single_address_with_pkey(pkey, ptr, size * 4); +} + +void setup_address_with_gap_two_pkeys(bool enforce, int size, int *pkeyOut, + int *pkey2Out, void **ptrOut, + void **ptr2Out) +{ + int pkey, pkey2; + void *ptr, *ptr2; + int ret; + + pkey = pkey_alloc_with_check(enforce); + pkey2 = pkey_alloc_with_check(enforce); + + ptr = mmap(addr1, size, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr == (void *)addr1); + + ptr2 = mmap(addr3, size, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr2 == (void *)addr3); + + // assign pkey to the memory. + ret = sys_mprotect_pkey((void *)ptr, size, PROT_READ, pkey); + assert(!ret); + + // assign pkey to the memory. + ret = sys_mprotect_pkey((void *)ptr2, size, PROT_READ, pkey2); + assert(!ret); + + *pkeyOut = pkey; + *ptrOut = ptr; + + *pkey2Out = pkey2; + *ptr2Out = ptr2; +} + +void clean_address_with_pag_two_pkeys(int pkey, void *ptr, int pkey2, + void *ptr2, int size) +{ + int ret; + + ret = munmap(ptr, size); + assert(!ret); + + ret = sys_pkey_free(pkey); + assert(ret == 0); + + ret = munmap(ptr2, size); + assert(!ret); + + ret = sys_pkey_free(pkey2); + assert(ret == 0); +} + +// mmap two addresses, with a page gap between two. +// assign pkeys on both address. +// disable access to the second address. +// mprotect from start of address1 to the end of address 2, +// because there is a gap in the memory range, mprotect will fail. +void test_mprotect_gapped_address_with_two_pkeys(bool enforce) +{ + int pkey, pkey2; + int ret; + void *ptr, *ptr2; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_address_with_gap_two_pkeys(enforce, size, &pkey, &pkey2, &ptr, + &ptr2); + + // disable write access. + pkey_write_deny(pkey2); + + ret = sys_mprotect_pkey(ptr, size * 3, PROT_READ | PROT_WRITE, pkey); + assert(ret < 0); + + ret = sys_mprotect(ptr, size * 3, PROT_READ | PROT_WRITE); + assert(ret < 0); + + pkey_write_allow(pkey2); + + ret = sys_mprotect_pkey(ptr, size * 3, PROT_READ, pkey); + assert(ret < 0); + + ret = sys_mprotect(ptr, size * 3, PROT_READ); + assert(ret < 0); + + clean_address_with_pag_two_pkeys(pkey, ptr, pkey2, ptr2, size); +} + +struct thread_info { + int pkey; + void *addr; + int size; + bool enforce; +}; + +void *thread_mprotect(void *arg) +{ + struct thread_info *tinfo = arg; + void *ptr = tinfo->addr; + int size = tinfo->size; + bool enforce = tinfo->enforce; + int pkey = tinfo->pkey; + int ret; + + // disable write access. + pkey_write_deny(pkey); + ret = sys_mprotect_pkey(ptr, size, PROT_READ | PROT_WRITE, pkey); + + if (enforce) + assert(ret < 0); + else + assert(!ret); + + ret = sys_mprotect(ptr, size, PROT_READ | PROT_WRITE); + if (enforce) + assert(ret < 0); + else + assert(ret == 0); + + pkey_write_allow(pkey); + + ret = sys_mprotect_pkey(ptr, size, PROT_READ, pkey); + assert(!ret); + + ret = sys_mprotect(ptr, size, PROT_READ); + assert(ret == 0); + return NULL; +} + +// mmap one address. +// assign pkey on the address. +// in child thread, mprotect is denied when no-writeable PKRU in enforce mode. +void test_mprotect_child_thread(bool enforce) +{ + int pkey; + int ret; + void *ptr; + int size = PAGE_SIZE; + pthread_t thread; + struct thread_info tinfo; + + LOG_TEST_ENTER(enforce); + + setup_single_fixed_address_with_pkey(enforce, size, &pkey, &ptr); + tinfo.size = size; + tinfo.addr = ptr; + tinfo.enforce = enforce; + tinfo.pkey = pkey; + + ret = pthread_create(&thread, NULL, thread_mprotect, (void *)&tinfo); + assert(ret == 0); + pthread_join(thread, NULL); + + clean_single_address_with_pkey(pkey, ptr, size); +} + +void test_enforce_api(void) +{ + for (int i = 0; i < 2; i++) { + bool enforce = (i == 1); + + test_pkey_alloc(enforce); + + test_mprotect_single_address(enforce); + test_mprotect_two_address_merge(enforce); + test_mprotect_two_address_deny_second(enforce); + test_mprotect_vma_middle_addr(enforce); + test_mprotect_unaligned(enforce); + test_mprotect_unaligned2(enforce); + test_mprotect_child_thread(enforce); + test_mprotect_gapped_address_with_two_pkeys(enforce); + } +} + +int main(void) +{ + int pkeys_supported = is_pkeys_supported(); + + printf("pid: %d\n", getpid()); + printf("has pkeys: %d\n", pkeys_supported); + if (!pkeys_supported) { + printf("PKEY not supported, skip the test.\n"); + exit(0); + } + + test_enforce_api(); + printf("done (all tests OK)\n"); + return 0; +} +#else /* arch */ +int main(void) +{ + printf("SKIP: not supported arch\n"); + return 0; +} +#endif /* arch */ From patchwork Fri May 19 01:19:13 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13247585 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09B5EC77B73 for ; Fri, 19 May 2023 01:19:39 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D22EF280005; Thu, 18 May 2023 21:19:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CAC65280001; Thu, 18 May 2023 21:19:34 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AB114280005; Thu, 18 May 2023 21:19:34 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 93688280001 for ; Thu, 18 May 2023 21:19:34 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 5E199A09B8 for ; Fri, 19 May 2023 01:19:34 +0000 (UTC) X-FDA: 80805247068.12.2F7E299 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) by imf14.hostedemail.com (Postfix) with ESMTP id 8AF5110000E for ; Fri, 19 May 2023 01:19:32 +0000 (UTC) Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=KyUoiw4E; spf=pass (imf14.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.215.179 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684459172; a=rsa-sha256; cv=none; b=kz51ftLBXxg7StQyEmDTC+ZERAzUKSIiZLqBtHDLwneesyKFAYozCZyFReA99G/s1a0O11 3532QcanFH7OzsFLqNaje1IJ5X+Lnq+ImtjOUiHbnFfS4R2m37xUtCZAf92K7ypyN0BboZ faxG8OA6h4FnhBGS4XJXbdJ+A8Ezym4= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=KyUoiw4E; spf=pass (imf14.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.215.179 as permitted sender) smtp.mailfrom=jeffxu@chromium.org; dmarc=pass (policy=none) header.from=chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684459172; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=UP7PrspRcAj60L7H0nNNXk2sIZvcVn8Hzlm0pHNc5DI=; b=ZTO0B50jtO5Fo0w4mPLvGiMHhhThUofkxwXqe/O6jVGOK9Bx12iyMnmpm9iKCACriq+ZKC 54lWqoNw/QxgtHmT/kSsMi5klmawNRFE7rk7k5Elzphd5a79cWysb1GvvphrHujeoefGgL TByMIf0D+E0dRq4cHeKwoD0oTRTBF7I= Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-53404873a19so1850428a12.3 for ; Thu, 18 May 2023 18:19:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684459171; x=1687051171; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=UP7PrspRcAj60L7H0nNNXk2sIZvcVn8Hzlm0pHNc5DI=; b=KyUoiw4ElMe/LNfLauu3mRsWtl6tLzsjFFWTg2362wmgmg2Ddqu/eccJT5ajd/WVCK u1l0ug+0cIrf8bFw6zRHAri7y+MBhpSJTKovSJLlNyH0CjoNHHPa7W+0dgGBS04gOyOU DCYEDZN/Ib9Kcmnqo4b0yFdJ8ouzcRriQUlWU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684459171; x=1687051171; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=UP7PrspRcAj60L7H0nNNXk2sIZvcVn8Hzlm0pHNc5DI=; b=OGfqMyOO7ECbsdQKvzDr/Y6QU6HCwSmKMC/Wl16x8LY+GIsnNXHKdE6q9eNEqUEi17 AeZ9OwtKXS8AFqLM6VPCVSI0lMZ9Pd99dnn18SeE6UjDaqsej34JC42ZiHlUBBmNlSBm T09MnSJjjp4LEBklqEbdR0GIE+GM2+aNSAHvu5l/EyJH4st4s8gI2xr6ltBzF8zT/vJX aWeSX4IZXthVGyIQtB4Tt1/5hkPwnbq6pgyKkBY16U0060X7O12ylugLOAa2I61NRI7i XPy9/G4/SkyNGmAfrKhmjResC0/LA/X1qOlJLSilpgHNESUhpWyOk6bMVBiwrluOOfZU OcQQ== X-Gm-Message-State: AC+VfDxOIO1vFi/lRssDYdQ6UNhMTxTsBydztzEjbOYMLM5IRGcbn3Rm V2I3Sz27MsbFzNDqm6PFxXSk6A== X-Google-Smtp-Source: ACHHUZ68oo3FWI/wrCU6PluVlfGvpW5h8fWIl8HSfv8KKt7tiRrAfmCm24UxHEFUgu6q95GiIgMiZw== X-Received: by 2002:a17:902:dac7:b0:1ac:7e95:74be with SMTP id q7-20020a170902dac700b001ac7e9574bemr1183574plx.28.1684459171540; Thu, 18 May 2023 18:19:31 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id ji17-20020a170903325100b001960706141fsm2102839plb.149.2023.05.18.18.19.31 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 18 May 2023 18:19:31 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v1 5/6] PKEY: Apply PKEY_ENFORCE_API to munmap Date: Fri, 19 May 2023 01:19:13 +0000 Message-ID: <20230519011915.846407-6-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog In-Reply-To: <20230519011915.846407-1-jeffxu@chromium.org> References: <20230519011915.846407-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspamd-Server: rspam08 X-Rspamd-Queue-Id: 8AF5110000E X-Stat-Signature: aoma6hfcs1r7e3m34ueja7nbpw8fawck X-Rspam-User: X-HE-Tag: 1684459172-431552 X-HE-Meta: U2FsdGVkX1/Z48zfp6tQpKqKUHpgkNur19TPCOn7HLUj3ht6a3Ervqy3K0TdWDZwwYhPhWv86zTwQqr47XRLhqKjPUVE9/zuWPn7GpcnKTyTYnYB2v6tyHjWwHR8duUAG7SNnbPD2Ktp3nONMbTWcxoP7jImsRTIt3wrtpTmQi5HcTKgA8Gy/bb9J6idw2oCJ7KmRqIJ4mq7UY7WYQA2zFOTPQUAKGbB34O7bk4VJ2jfrs58KCBPc+YHABgwWxhhzu/MD0Vo/c5+B3Mzc6ura6ZLy1HwA1Ey50PxUpXPOJ8DfmLVM4oMfzqxkEmUvz26kzkBt5A+qXQGcGOFaTQZ1rP6eeHVox1z78q+x0j34tOzMsPHf8pTI2JA0WzZNyI6GkHMPUeYmNH7N5ANbHNkaUVmG81xupKQDhrrKigXc3r7aiHon48oQjukDHRzLo5Fc8cM4+GeO9nl8cNRqgzxvYI0w6EFiMWuE3yJdSq7jVpi/kwx/IkkUDtrmCpemMemcz31av+iYWtCqg/Dte9X7GMidh+poY7m5M3j5PwVR9rWmQR6C+Ich0XUlmezjfcnc0bknBwcXlbkc/fqjOW21QxMZu8h0erbXNPS565wvA6Hyse6sOiIK4rEl14GZeyT0EeXyp1+4AUkGerET4ZVTzkrFqHkS+tdToviO1GTbnL88W+qb1Lo6sjkEmXHg0NIgbYkiXbDFv/G6yIeVx1QC8RqYKwjvfVnB8WVzRC+6+VC97h7bCaMNfr3pOlcu9AtGezj5/W7dRK76PUs+mdH/s645fepFJPJpvJy40pS8PGnTctm0A9dx2dBbfs148mvhLKIStvbWa3hkLj9psQNjrzRkHIxhUBHy1/VpOQ+b0kED+dqXWb/pOqilkGcSb4+Do4g/iMPOLdXg40NaVUWnf91DPzafBGsN1vTPeEyU1SH8FeH08PXZinjcvOfPo+kV1lXns/tazkaWvnhiz3 hcQRYXJG gAyXfDHTNOQ3OXPH5PoCyn5VsBV2jttN36ZMZTpBl7u3kN+Cc/CqMJWYpM2sMLdTwD7jBL1HY/KCqnUFqLDBkKQ3CIz7g8I3p7D/ipOT5QofkvLyl9QjDoy/I4DZpmwgc3VPOu6XXn80K8pvXDLoIYN85xXBMHzNCRgHSJsSMO2UkqGwasVSPgR5Wd9j6npkij0faFLSHF4Bd3Jw5W9FrsGgmN/ihx/a82a16PY2woOA4hbE2luC0X+G+6EEz4lDacyx3SBsSCQI/+wxGQLWBMXzbO3J9hsOMauxSpjY/FRpgcbWIxVACzqZ1NdMxNqDVHLx0efMUctzJKpIsWdz+mGjGkSGHlH7sBeO3ZV58EvqHzWe6SyNbh/SJkg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu This patch enables PKEY_ENFORCE_API for the munmap syscall. Signed-off-by: Jeff Xu --- include/linux/mm.h | 8 +++++++- mm/mmap.c | 31 +++++++++++++++++++++++-------- mm/mremap.c | 6 ++++-- 3 files changed, 34 insertions(+), 11 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 27ce77080c79..795cdeee2ea7 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -429,6 +429,12 @@ extern unsigned int kobjsize(const void *objp); #endif #define VM_FLAGS_CLEAR (ARCH_VM_PKEY_FLAGS | VM_ARCH_CLEAR) +/* The current call stack is originated from user space or kernel */ +enum caller_origin { + ON_BEHALF_OF_KERNEL = 0, + ON_BEHALF_OF_USERSPACE, +}; + /* * mapping from the currently active vm_flags protection bits (the * low four bits) to a page protection mask.. @@ -3136,7 +3142,7 @@ extern unsigned long do_mmap(struct file *file, unsigned long addr, unsigned long pgoff, unsigned long *populate, struct list_head *uf); extern int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, unsigned long start, size_t len, struct list_head *uf, - bool downgrade); + bool downgrade, enum caller_origin called); extern int do_munmap(struct mm_struct *, unsigned long, size_t, struct list_head *uf); extern int do_madvise(struct mm_struct *mm, unsigned long start, size_t len_in, int behavior); diff --git a/mm/mmap.c b/mm/mmap.c index 13678edaa22c..3de95a6a4397 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2498,6 +2498,7 @@ do_vmi_align_munmap(struct vma_iterator *vmi, struct vm_area_struct *vma, * @uf: The userfaultfd list_head * @downgrade: set to true if the user wants to attempt to write_downgrade the * mmap_lock + * @called: originated from user space or kernel * * This function takes a @mas that is either pointing to the previous VMA or set * to MA_START and sets it up to remove the mapping(s). The @len will be @@ -2507,7 +2508,7 @@ do_vmi_align_munmap(struct vma_iterator *vmi, struct vm_area_struct *vma, */ int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, unsigned long start, size_t len, struct list_head *uf, - bool downgrade) + bool downgrade, enum caller_origin called) { unsigned long end; struct vm_area_struct *vma; @@ -2519,6 +2520,15 @@ int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, if (end == start) return -EINVAL; + /* + * When called by syscall from userspace, check if the calling + * thread has the PKEY permission to modify the memory mapping. + */ + if (called == ON_BEHALF_OF_USERSPACE && + arch_check_pkey_enforce_api(mm, start, end) < 0) { + return -EACCES; + } + /* arch_unmap() might do unmaps itself. */ arch_unmap(mm, start, end); @@ -2541,7 +2551,7 @@ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len, { VMA_ITERATOR(vmi, mm, start); - return do_vmi_munmap(&vmi, mm, start, len, uf, false); + return do_vmi_munmap(&vmi, mm, start, len, uf, false, ON_BEHALF_OF_KERNEL); } unsigned long mmap_region(struct file *file, unsigned long addr, @@ -2575,7 +2585,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr, } /* Unmap any existing mapping in the area */ - if (do_vmi_munmap(&vmi, mm, addr, len, uf, false)) + if (do_vmi_munmap(&vmi, mm, addr, len, uf, false, + ON_BEHALF_OF_KERNEL)) return -ENOMEM; /* @@ -2792,7 +2803,11 @@ unsigned long mmap_region(struct file *file, unsigned long addr, return error; } -static int __vm_munmap(unsigned long start, size_t len, bool downgrade) +/* + * @called: originated from user space or kernel + */ +static int __vm_munmap(unsigned long start, size_t len, bool downgrade, + enum caller_origin called) { int ret; struct mm_struct *mm = current->mm; @@ -2802,7 +2817,7 @@ static int __vm_munmap(unsigned long start, size_t len, bool downgrade) if (mmap_write_lock_killable(mm)) return -EINTR; - ret = do_vmi_munmap(&vmi, mm, start, len, &uf, downgrade); + ret = do_vmi_munmap(&vmi, mm, start, len, &uf, downgrade, called); /* * Returning 1 indicates mmap_lock is downgraded. * But 1 is not legal return value of vm_munmap() and munmap(), reset @@ -2820,14 +2835,14 @@ static int __vm_munmap(unsigned long start, size_t len, bool downgrade) int vm_munmap(unsigned long start, size_t len) { - return __vm_munmap(start, len, false); + return __vm_munmap(start, len, false, ON_BEHALF_OF_KERNEL); } EXPORT_SYMBOL(vm_munmap); SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len) { addr = untagged_addr(addr); - return __vm_munmap(addr, len, true); + return __vm_munmap(addr, len, true, ON_BEHALF_OF_USERSPACE); } @@ -3055,7 +3070,7 @@ int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags) if (ret) goto limits_failed; - ret = do_vmi_munmap(&vmi, mm, addr, len, &uf, 0); + ret = do_vmi_munmap(&vmi, mm, addr, len, &uf, 0, ON_BEHALF_OF_KERNEL); if (ret) goto munmap_failed; diff --git a/mm/mremap.c b/mm/mremap.c index b11ce6c92099..a3f576effbb1 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -703,7 +703,8 @@ static unsigned long move_vma(struct vm_area_struct *vma, } vma_iter_init(&vmi, mm, old_addr); - if (do_vmi_munmap(&vmi, mm, old_addr, old_len, uf_unmap, false) < 0) { + if (do_vmi_munmap(&vmi, mm, old_addr, old_len, uf_unmap, false, + ON_BEHALF_OF_KERNEL) < 0) { /* OOM: unable to split vma, just get accounts right */ if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP)) vm_acct_memory(old_len >> PAGE_SHIFT); @@ -993,7 +994,8 @@ SYSCALL_DEFINE5(mremap, unsigned long, addr, unsigned long, old_len, VMA_ITERATOR(vmi, mm, addr + new_len); retval = do_vmi_munmap(&vmi, mm, addr + new_len, - old_len - new_len, &uf_unmap, true); + old_len - new_len, &uf_unmap, true, + ON_BEHALF_OF_KERNEL); /* Returning 1 indicates mmap_lock is downgraded to read. */ if (retval == 1) { downgraded = true; From patchwork Fri May 19 01:19:14 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Xu X-Patchwork-Id: 13247586 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3D54C77B7A for ; Fri, 19 May 2023 01:19:41 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 1163B280006; Thu, 18 May 2023 21:19:36 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 09F9C280001; Thu, 18 May 2023 21:19:35 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CABE0280006; Thu, 18 May 2023 21:19:35 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id B1EA1280001 for ; Thu, 18 May 2023 21:19:35 -0400 (EDT) Received: from smtpin07.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay05.hostedemail.com (Postfix) with ESMTP id 85A67408D4 for ; Fri, 19 May 2023 01:19:35 +0000 (UTC) X-FDA: 80805247110.07.81B61C2 Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) by imf02.hostedemail.com (Postfix) with ESMTP id 9FDC68000C for ; Fri, 19 May 2023 01:19:33 +0000 (UTC) Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=jyj0rZJ2; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf02.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.182 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684459173; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=oD0d2al7XFldRkjYP37ZWtTdhmPaRGV8lU2SKIN3qFc=; b=OkihmIsEpFH/VYAMXMoO3h+Anplam+eErHYf1B/hq9vc9FGNjFnkj2fxWZDfCBaDVjbFnG HlPYDh1MH19Fh44Xc8BPigDQdeM70gr6kCDFnjJApmNZW7NFrv9QUYvS77YD6CtmJdXlAp taG4ak12PxuWgWrvt5Z7hdDr/fK4IFM= ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b=jyj0rZJ2; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf02.hostedemail.com: domain of jeffxu@chromium.org designates 209.85.210.182 as permitted sender) smtp.mailfrom=jeffxu@chromium.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684459173; a=rsa-sha256; cv=none; b=VQEQokHMHcVvYNbnWHzX4qE6uhm1eF2z/azduB3M0IU4xf1YhC1A9hguOzDga7VNSgGwCd D/4Kf3r3TEn5nIgqqi8aJCO/0tHt5vrElO+yhxeQ+xSElk8FaLhrn7vixqDPg2leaaGt1T fE5raqEXhvmiRqbu4c6t7MVT+hHJQdc= Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-64d2f99c8c3so185521b3a.0 for ; Thu, 18 May 2023 18:19:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1684459172; x=1687051172; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=oD0d2al7XFldRkjYP37ZWtTdhmPaRGV8lU2SKIN3qFc=; b=jyj0rZJ2+kbh8T1zO6wM8DlV8sGh/w75MLMPMO9zUvD75OwqU1+pvdIyqLBxBdrY3a rXB8rBUenQPxYI61rjx4jyVBrs9t9RT0RsQbQNuzyJdowe7fQEFAAgCJnY1Fu+bAdVH6 13412jqIvJM2IWcUlxkkmtmlW5xdC2AjmAUT8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684459172; x=1687051172; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oD0d2al7XFldRkjYP37ZWtTdhmPaRGV8lU2SKIN3qFc=; b=UI3/SUXDbgwwnFpTEu5f1GvoFyboaodHIluTVp9goRK0iOqI6Sql4/s+Qyu+DuL3yI CWYAdNHD9994JwIrLbD9xwpjBi1Q0fXgybGWF2N3YQjEx8MukLCqGExA44NwqSTh3SEK wcmRRU1+Onu/UYqsbHs/OcKTegTcpGZmWTSd9pyxPk9lJ0DB3JWKA5yrc9iQtGnk9zqv TCUpkbr5FILEDQlsmRernDuy04MCcOAZ9XgcglmD8n8SfGZPRqtpYYTw70lMzT4vbRtB rUnWjWvYxYDR6vmaTI3f9qmJ9S8u6ehdQ/zDCCExQPU6wkk/f2f1pZbnH3ikRD+kSVi2 13HA== X-Gm-Message-State: AC+VfDwLPg2XKzgKM64yL9ekOS1IthPwqaUByYs+aJJuLqJQmBC/WXKA 7NFXVmk2shuHSWcTIEQBV0YSMA== X-Google-Smtp-Source: ACHHUZ42BZjasyTlYVo4TSyJkLSwklWvipEkYbBHJRJJtGjHJCThYSy2w2UYA4ZbbF07O8znAL15AQ== X-Received: by 2002:a05:6a00:a91:b0:64a:fa71:a98f with SMTP id b17-20020a056a000a9100b0064afa71a98fmr926851pfl.13.1684459172511; Thu, 18 May 2023 18:19:32 -0700 (PDT) Received: from localhost (183.43.230.35.bc.googleusercontent.com. [35.230.43.183]) by smtp.gmail.com with UTF8SMTPSA id p15-20020a63c14f000000b00528db73ed70sm1870456pgi.3.2023.05.18.18.19.31 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 18 May 2023 18:19:32 -0700 (PDT) From: jeffxu@chromium.org To: dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, keescook@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com Cc: akpm@linux-foundation.org, jeffxu@google.com, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v1 6/6] PKEY:selftest pkey_enforce_api for munmap Date: Fri, 19 May 2023 01:19:14 +0000 Message-ID: <20230519011915.846407-7-jeffxu@chromium.org> X-Mailer: git-send-email 2.40.1.698.g37aff9b760-goog In-Reply-To: <20230519011915.846407-1-jeffxu@chromium.org> References: <20230519011915.846407-1-jeffxu@chromium.org> MIME-Version: 1.0 X-Rspamd-Server: rspam09 X-Rspamd-Queue-Id: 9FDC68000C X-Stat-Signature: w45tht187qxodf7r33rzaqy35zfq6h76 X-Rspam-User: X-HE-Tag: 1684459173-742605 X-HE-Meta: U2FsdGVkX18+1Pq47a26dkZXL2L9P8RIMoQHshEDMuUUeuVzbSaleBEnng9i86LOJohUHNmUOWc9o2Dj5hPLQzaJ6eVCQ6EH8crjjsfVtRgGHpWYHXUz2K9gEo7N/1R42YpgP+SbMz251/P6a9yxy6JNnO7KIHMIBCDnuktlnzue0wxD7zHsc73WGq/ITufVRkmmoIP7UBdbGenxHBMnJ14D/H7P2nHICTTG+6nobsq4LS1pe66rnTjbD9nZMkD7jpWtjf9MeKomAV7llEcxJmsg8Hqnn393lRCIzUMXoohaYxH85nc6T06LmB8S+VbzkiA9mYon78MjGrbS7SuE1M9VkD0WB25KWe1UTTlsq9X0/qag8D5eUAKVVsW0NSTvo82WoObGLG0XjbFG8FdcQzZwcty5/nO0WntRRPBFHogqmRqBj+75WK4i8vPbJh/rW59AQbLzXVmzw0vZANpZTpI+q6VEChfdlcr6Zgf+XQSDHyQAtNKuVFlmnDyWJ4CoprMTq0ZC139OkJBZKKPO465qBH7qlaVB1Alh1jx2NuyTApmNKpHsGxxHHHb51EOCE1hughGL9A7i9rMkpjdVkIATTZQl9ySFhAkaYCm58mNoR+zfwQlMyW9P3XzRyWT6vjV1cc+lJpHQsIBO9sZ/xdeYmYWxARS0cUYSLn1Ab7Jn2JyKg1cr7rZDKz6oLSfYGNcN54keoUVB0j+5ah0g8L1VkmUIvy3E5Uprdu1etEWl91PQC1XS7b0CVelCZV7C0/pO62eeKnYakaE32Piiue6b3Hx7vXyERZeN5bbL1YjkMiax3KZGfC6SDRXtCBUcqItg4bgK1XN7B7I+cb5U6qQXV+CQkYerXSMGBAEbgCWlMMCzaFrp/UHW8g5LETOIhlcGAjxKtrcGI5Ugwhh7FclunP6o2AyVIWFe+OBvTD1alKV1941kA+gKZq/BupHo0tF4SJ6EIM7GTuTLhm7 04yVnVcT FK0NWsG9Cfz00txY+4nh1HFtRP/yof/qzWGWy/5bVHUluwWGMXa0wE83GS1Sw/W/JbaW58XmXjJf1W9xwWKGjcXEmV3mtiejspUvWOb+x+JCdKzhnURG2sO9+oeI2E1gMGUQBtNd6vWPDImHrYIdJa0V5KMG7+byhTyvejTxULwnhVhOZnXi+2qf1wwWoR4Ta904V6+5iIxVOGMyFwWXtHMSptMAPN4emCoMnMdGI4dJuFiqC7XhViIJekYsA24VOcccRAHNMqLOZhi5UKKTK6CBjl/u1Hmiw2Rk0pwizBSRRCfQE0SKLoUiDR+FW2OCQXyK45g11zr70KeycwUr458+Gam04rR0g1F2mmivgSlSTOyJXljYg1oV36g== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: From: Jeff Xu Add selftest for pkey_enforce_api for mprotect Signed-off-by: Jeff Xu --- tools/testing/selftests/mm/pkey_enforce_api.c | 437 ++++++++++++++++++ 1 file changed, 437 insertions(+) diff --git a/tools/testing/selftests/mm/pkey_enforce_api.c b/tools/testing/selftests/mm/pkey_enforce_api.c index 23663c89bc9c..92aa29248e1f 100644 --- a/tools/testing/selftests/mm/pkey_enforce_api.c +++ b/tools/testing/selftests/mm/pkey_enforce_api.c @@ -833,6 +833,429 @@ void test_mprotect_child_thread(bool enforce) clean_single_address_with_pkey(pkey, ptr, size); } +// mmap one address with one page. +// assign PKEY to the address. +// munmap on the address is protected. +void test_munmap_single_address(bool enforce) +{ + int pkey; + int ret; + void *ptr; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_single_address_with_pkey(enforce, size, &pkey, &ptr); + + // disable write access. + pkey_write_deny(pkey); + + ret = munmap(ptr, size); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(ptr, size); + assert(!ret); + } + + clean_single_address_with_pkey(pkey, ptr, size); +} + +// mmap two address (continuous two pages). +// assign PKEY to them with one mprotect_pkey call (merged address). +// munmap two address in one call (merged address). +void test_munmap_two_address_merge(bool enforce) +{ + int pkey; + int ret; + void *ptr; + void *ptr2; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_two_continues_fixed_address_with_pkey(enforce, size, &pkey, &ptr, + &ptr2); + + // disable write. + pkey_write_deny(pkey); + + // munmap on both addresses with one call (merged). + ret = munmap(ptr, size * 2); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(ptr, size * 2); + assert(!ret); + } + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +// mmap two address (continuous two pages). +// assign PKEY to the second address. +// munmap on the second address is protected. +void test_munmap_two_address_deny_second(bool enforce) +{ + int pkey; + int ret; + void *ptr; + void *ptr2; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_two_continues_fixed_address_protect_second_with_pkey( + enforce, size, &pkey, &ptr, &ptr2); + + // disable write through pkey. + pkey_write_deny(pkey); + + ret = munmap(ptr2, size); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + ret = munmap(ptr, size); + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(ptr2, size); + assert(!ret); + } + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +// mmap two address (continuous two pages). +// assign PKEY to the second address. +// munmap on the range that includes the second address. +void test_munmap_two_address_deny_range(bool enforce) +{ + int pkey; + int ret; + void *ptr; + void *ptr2; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_two_continues_fixed_address_protect_second_with_pkey( + enforce, size, &pkey, &ptr, &ptr2); + + // disable write through pkey. + pkey_write_deny(pkey); + + ret = munmap(ptr, size * 2); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(ptr, size * 2); + assert(!ret); + } + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +// mmap one address with 4 pages. +// assign PKEY to the second page only. +// munmap on memory range that includes the second pages is protected. +void test_munmap_vma_middle_addr(bool enforce) +{ + int pkey; + int ret; + void *ptr, *ptr2, *ptr3; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_4pages_fixed_protect_second_page(enforce, size, &pkey, &ptr, + &ptr2, &ptr3); + + // disable write through pkey. + pkey_write_deny(pkey); + + // munmap support merge, we are going to make sure we don't regress. + ret = munmap(addr1, size * 4); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(ptr, size * 4); + assert(!ret); + } + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +// mmap one address with 4 pages. +// assign PKEY to the second page only. +// munmap from 2nd page. +void test_munmap_shrink(bool enforce) +{ + int pkey; + int ret; + void *ptr, *ptr2, *ptr3; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_4pages_fixed_protect_second_page(enforce, size, &pkey, &ptr, + &ptr2, &ptr3); + + // disable write through pkey. + pkey_write_deny(pkey); + + // munmap support merge, we are going to make sure we don't regress. + ret = munmap(ptr2, size * 3); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(ptr2, size * 3); + assert(!ret); + } + + ret = munmap(ptr, size); + assert(!ret); + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +// mmap one address with 4 pages. +// assign PKEY to the second page only. +// munmap from 2nd page but size is less than one page +void test_munmap_unaligned(bool enforce) +{ + int pkey; + int ret; + void *ptr, *ptr2, *ptr3; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_4pages_fixed_protect_second_page(enforce, size, &pkey, &ptr, + &ptr2, &ptr3); + + // disable write through pkey. + pkey_write_deny(pkey); + + // munmap support merge, we are going to make sure we don't regress. + ret = munmap(ptr2, size - 1); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(ptr2, size - 1); + assert(!ret); + } + + ret = munmap(ptr, size * 4); + assert(!ret); + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +// mmap one address with 4 pages. +// assign PKEY to the second page only. +// munmap from 2nd page but size is less than one page +void test_munmap_unaligned2(bool enforce) +{ + int pkey; + int ret; + void *ptr, *ptr2, *ptr3; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_4pages_fixed_protect_second_page(enforce, size, &pkey, &ptr, + &ptr2, &ptr3); + + // disable write through pkey. + pkey_write_deny(pkey); + + // munmap support merge, we are going to make sure we don't regress. + ret = munmap(ptr2, size + 1); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(ptr2, size + 1); + assert(!ret); + } + + ret = munmap(ptr, size * 4); + assert(!ret); + + ret = sys_pkey_free(pkey); + assert(ret == 0); +} + +// mmap one address with one page. +// assign PKEY to the address. +// munmap on the address but with size of 4 pages(should OK). +void test_munmap_outbound_addr(bool enforce) +{ + int pkey; + int ret; + void *ptr; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_single_fixed_address_with_pkey(enforce, size, &pkey, &ptr); + + // disable write through pkey. + pkey_write_deny(pkey); + + // Interesting enough, this is allowed, even the other 3 pages are not allocated. + ret = munmap(addr1, size * 4); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey); + + if (enforce) { + ret = munmap(addr1, size * 4); + assert(!ret); + } + + clean_single_address_with_pkey(pkey, ptr, size); +} +// mmap two addresses, with a page gap between two. +// assign pkeys on both address. +// disable access to the second address. +// munmap from start of address1 to the end of address 2, +// because there is a gap in the memory range, mprotect will fail. +void test_munmap_gapped_address_with_two_pkeys(bool enforce) +{ + int pkey, pkey2; + int ret; + void *ptr, *ptr2; + int size = PAGE_SIZE; + + LOG_TEST_ENTER(enforce); + + setup_address_with_gap_two_pkeys(enforce, size, &pkey, &pkey2, &ptr, + &ptr2); + + // disable write access. + pkey_write_deny(pkey2); + + // Interesting enough, this is allowed, even there is a gap beween address 1 and 2. + ret = munmap(addr1, size * 3); + if (enforce) + assert(ret < 0); + else + assert(!ret); + + pkey_write_allow(pkey2); + if (enforce) { + ret = munmap(addr1, size * 3); + assert(!ret); + } +} + +// use write-deny pkey and see if program can exit properly. +// This is manual test, run it at end if needed. +void test_exit_munmap_disable_write(void) +{ + int pkey; + int ret; + void *ptr; + int size = PAGE_SIZE; + + pkey = sys_pkey_alloc(PKEY_ENFORCE_API, 0); + assert(pkey > 0); + + // allocate 1 page. + ptr = mmap(addr1, size, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr == addr1); + + // assign pkey to the first address. + ret = sys_mprotect_pkey(ptr, size, PROT_READ | PROT_WRITE | PROT_EXEC, + pkey); + assert(!ret); + + // disable write through pkey. + pkey_write_deny(pkey); + + ret = munmap(ptr, size); + assert(ret < 0); +} + +// use disable-all pkey and see if program can exit properly. +// This is manual test, run it at end if needed. +void test_exit_munmap_disable_all(void) +{ + int pkey; + int ret; + void *ptr; + int size = PAGE_SIZE; + + pkey = sys_pkey_alloc(PKEY_ENFORCE_API, 0); + assert(pkey > 0); + + // allocate 1 page. + ptr = mmap(addr2, size, PROT_READ, + MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0); + assert(ptr == addr2); + + // assign pkey to the first address. + ret = sys_mprotect_pkey(ptr, size, PROT_READ | PROT_WRITE | PROT_EXEC, + pkey); + assert(!ret); + + // disable write through pkey. + pkey_access_deny(pkey); + + ret = munmap(addr1, size); + assert(ret < 0); +} + void test_enforce_api(void) { for (int i = 0; i < 2; i++) { @@ -848,7 +1271,21 @@ void test_enforce_api(void) test_mprotect_unaligned2(enforce); test_mprotect_child_thread(enforce); test_mprotect_gapped_address_with_two_pkeys(enforce); + + test_munmap_single_address(enforce); + test_munmap_two_address_merge(enforce); + test_munmap_two_address_deny_second(enforce); + test_munmap_two_address_deny_range(enforce); + test_munmap_vma_middle_addr(enforce); + test_munmap_outbound_addr(enforce); + test_munmap_shrink(enforce); + test_munmap_unaligned(enforce); + test_munmap_unaligned2(enforce); + test_munmap_gapped_address_with_two_pkeys(enforce); } + + test_exit_munmap_disable_write(); + test_exit_munmap_disable_all(); } int main(void)