From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2A25C77B75 for ; Wed, 19 Apr 2023 01:16:44 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E9EE88E0002; Tue, 18 Apr 2023 21:16:43 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E4F458E0001; Tue, 18 Apr 2023 21:16:43 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D3E3E8E0002; Tue, 18 Apr 2023 21:16:43 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id C44828E0001 for ; Tue, 18 Apr 2023 21:16:43 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id 96EAA1C6633 for ; Wed, 19 Apr 2023 01:16:43 +0000 (UTC) X-FDA: 80696375886.12.E7DF2DA Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf21.hostedemail.com (Postfix) with ESMTP id C332C1C0007 for ; Wed, 19 Apr 2023 01:16:40 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=KYVVRGun; spf=pass (imf21.hostedemail.com: domain of longman@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=longman@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1681867000; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=kOBnveSOjqfldaC+dMN0HauptgWXOYKbnsQgtF4Vvns=; b=mZ1g4/Lv0tLkMDYQ76iOh2ffn0qdmS0EINcDE/Ce0iQ9B8EDY93uD1yo78WOHXRSw5At56 570DJ+3FOS4T2w6XtqbkXSYdTKZKREIiEN52qMySDPaCYKqVBzK/fOTGDxyNADF/aB10cz MRGJu0BNxa5EY4fm15/wqkG0RFPv7bM= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=KYVVRGun; spf=pass (imf21.hostedemail.com: domain of longman@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=longman@redhat.com; dmarc=pass (policy=none) header.from=redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1681867000; a=rsa-sha256; cv=none; b=LhGiXqnJ5ijgxCKjDKNf6WA3O+LFXubnz+Tt4ctVm//sIa71Jje6vYiTGIv9mtBrwlkGRV ndMycPtaH+mhD9Z1v78ztQ2mEde3/Sy9MoX+83d5KjOejW6oNoub+j84Vr7eeSrF0cWHEY 8eRiLv233sTaMd76GJ+o5GEknbkS3+M= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1681867000; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=kOBnveSOjqfldaC+dMN0HauptgWXOYKbnsQgtF4Vvns=; b=KYVVRGunkG8SKMEY2yHlJSo3GtFE8fCmmlFwMerfaSq7Iq8pn2K+qUiBH4xxQfFzFn1ShJ PBNMxvEi3PU546rZMilxr7mSgcl5lN4mO5bfoMItd1i1ieGwYO8hBUdsDpuVRifV9jeHFr MZ477HSY5/Sjbxbuq/hA9bzpU6Wxi8I= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-286-MoQpVtKQN_iYCgFYAlw6uQ-1; Tue, 18 Apr 2023 21:16:38 -0400 X-MC-Unique: MoQpVtKQN_iYCgFYAlw6uQ-1 Received: from smtp.corp.redhat.com (int-mx10.intmail.prod.int.rdu2.redhat.com [10.11.54.10]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 061DC101A531; Wed, 19 Apr 2023 01:16:38 +0000 (UTC) Received: from [10.22.34.98] (unknown [10.22.34.98]) by smtp.corp.redhat.com (Postfix) with ESMTP id A6816400DC9; Wed, 19 Apr 2023 01:16:37 +0000 (UTC) Message-ID: <6c3c68b1-c4d4-dd82-58e8-f7013fb6c8e5@redhat.com> Date: Tue, 18 Apr 2023 21:16:37 -0400 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.7.1 Subject: Re: [PATCH] mm/mmap: Map MAP_STACK to VM_STACK Content-Language: en-US To: Andrew Morton Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org, Joe Mario , Barry Marson , Rafael Aquini References: <20230418210230.3495922-1-longman@redhat.com> <20230418141852.75e551e57e97f4b522957c5c@linux-foundation.org> From: Waiman Long In-Reply-To: <20230418141852.75e551e57e97f4b522957c5c@linux-foundation.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Scanned-By: MIMEDefang 3.1 on 10.11.54.10 X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: C332C1C0007 X-Stat-Signature: i6hhexistz1dd773uhkrtdn9eh391xz4 X-HE-Tag: 1681867000-445874 X-HE-Meta: U2FsdGVkX196YH7XghO5Dtu3/XJ0Xb0WlOwVY/xSOvNhKSl1OCGz75RUTCYVe5GRwIXnRdl1GOVSqaGIpboV9B14rVyqlNKpsKz400gR/RnREZCAIJZWlwnoHL2FRPi0kHFP3e2AHuTNANKgLl2cCAwMHhysGfaHzuhW7h+eJSU/Fhc036yRVymAe7PDZ7pTjfrAyC10xZYikgfLTVIQHytnUdZexpIB8GH65qFPt6ppCM1srZsCqtAEjOyrVrS6ATy0Prr/daC27du/l+JEn3B6L32+DlyWH9gBRPnEsP5AC2+hTv70UPzJB9yEw6UeX07hVsAFK1qoFk9EC2OvKuPsNOOaUOMTyMje6uUGlw3UkNiFE93lxEY1x/qrxbGGUu3SAdIEvxrhJ5vIfNFAvz4ohtQIZZtGM7YbFl0vFnJ/idDQogNt5Mzk5yVZ+mHD6Z4yrbBqcwC0qRNekG1RhDJe7vCwwLkRIXLGajDvvSI70wQPIHcbKXpzn2/5ZsB9fbGG5uXFbTk16jnIBCJyk7Wo422+CF+GKLdQzrF699bPCtSRMdNhvsmn7xG204Mls0EM0yTuyokp7elKYg/vsv9SwBrQibty8dafeU8sQRiO8OtIYbzZBk8GgphD4ZqgNdx/JuJ4iPVOGgfw1GVlsBfcSCnwVrB/KA0X4GQskODr0B18BZF2oVwTMDqPzpdUulrZ3/euKx3DNJLEaUOST0Q+Pcu6cJT8Pp7mm0nYnBDpaGbsGLHADSSASceQ4NtxDJc+W/QuXkggvhwfMPltH9BjgLqwI51e6Y8N5ZsSSFw7wSbny+T3G8B38vDUxM8t7YyL8sjS4PbAUabhdqxlwmXrSmKybFsSmPsqZzK2jCdtxzcnDAsNOAgn/m9d8lFSYG7EEpDi5uYDGJrsWktJ0S9dM6mYMpBy5l9E593KnDKITIi0To7ohzBLnyDeWV0GMS4duke6L6P4S5zE/Is B28GUtDI LODdR6FsncYQ1VGUrKeBfYqhtNN/RhF8b76zEpxfxoABVMIun9voOLVb2NiprC7DniRvL0/g+E54X7N+JXcuAAA/FQKJjgLDwuEefslwtfzXKCpqZWXHMHDRiBLy8k0KmprNSxWDhQSjb4wRkfRXIayMBfcYf/obTrAy2vOP/QOKv+/f0J8rlG0ypYK3iayJWzG/HlQDWlbEr7WYHfwPp1R9b5iTyB4z6bUjoF0dF2A5BQdqyfJUd9KuESw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 4/18/23 17:18, Andrew Morton wrote: > On Tue, 18 Apr 2023 17:02:30 -0400 Waiman Long wrote: > >> One of the flags of mmap(2) is MAP_STACK to request a memory segment >> suitable for a process or thread stack. The kernel currently ignores >> this flags. Glibc uses MAP_STACK when mmapping a thread stack. However, >> selinux has an execstack check in selinux_file_mprotect() which disallows >> a stack VMA to be made executable. >> >> Since MAP_STACK is a noop, it is possible for a stack VMA to be merged >> with an adjacent anonymous VMA. With that merging, using mprotect(2) >> to change a part of the merged anonymous VMA to make it executable may >> fail. This can lead to sporadic failure of applications that need to >> make those changes. > "Sporadic failure of applications" sounds quite serious. Can you > provide more details? The problem boils down to the fact that it is possible for user code to mmap a region of memory and then for the kernel to merge the VMA for that memory with the VMA for one of the application's thread stacks. This is causing random SEGVs with one of our large customer application. At a high level, this is what's happening:  1) App runs creating lots of threads.  2) It mmap's 256K pages of anonymous memory.  3) It writes executable code to that memory.  4) It calls mprotect() with PROT_EXEC on that memory so     it can subsequently execute the code. The above mprotect() will fail if the mmap'd region's VMA gets merged with the VMA for one of the thread stacks.  That's because the default RHEL SELinux policy is to not allow executable stacks. > > Did you consider a -stable backport? I'm unable to judge, because the > description of the userspace effects is so thin, Yes, stable backport can be considered. > >> One possible fix is to make sure that a stack VMA will not be merged >> with a non-stack anonymous VMA. That requires a vm flag that can be >> used to distinguish a stack VMA from a regular anonymous VMA. One >> can add a new dummy vm flag for that purpose. However, there is only >> 1 bit left in the lower 32 bits of vm_flags. Another alternative is >> to use an existing vm flag. VM_STACK (= VM_GROWSDOWN for most arches) >> can certainly be used for this purpose. The downside is that it is a >> slight change in existing behavior. >> >> Making a stack VMA growable by default certainly fits the need of a >> process or thread stack. This patch now maps MAP_STACK to VM_STACK to >> prevent unwanted merging with adjacent non-stack VMAs and make the VMA >> more suitable for being used as a stack. >> >> ... >> >> --- a/include/linux/mman.h >> +++ b/include/linux/mman.h >> @@ -152,6 +152,7 @@ calc_vm_flag_bits(unsigned long flags) >> return _calc_vm_trans(flags, MAP_GROWSDOWN, VM_GROWSDOWN ) | >> _calc_vm_trans(flags, MAP_LOCKED, VM_LOCKED ) | >> _calc_vm_trans(flags, MAP_SYNC, VM_SYNC ) | >> + _calc_vm_trans(flags, MAP_STACK, VM_STACK ) | >> arch_calc_vm_flag_bits(flags); >> } > The mmap(2) manpage says > > This flag is currently a no-op on Linux. However, by employing > this flag, applications can ensure that they transparently ob- tain > support if the flag is implemented in the future. Thus, it is used > in the glibc threading implementation to allow for the fact that some > architectures may (later) require special treat- ment for stack > allocations. A further reason to employ this flag is portability: > MAP_STACK exists (and has an effect) on some other systems (e.g., > some of the BSDs). > > so please propose an update for this? OK, will do. Thanks, Longman