From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 08D73C63777 for ; Mon, 23 Nov 2020 19:17:59 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 637EC20738 for ; Mon, 23 Nov 2020 19:17:58 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ecz6nru9" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 637EC20738 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id C791A6B0036; Mon, 23 Nov 2020 14:17:57 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id C27F26B005D; Mon, 23 Nov 2020 14:17:57 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id AF00F6B006E; Mon, 23 Nov 2020 14:17:57 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0250.hostedemail.com [216.40.44.250]) by kanga.kvack.org (Postfix) with ESMTP id 7E5276B0036 for ; Mon, 23 Nov 2020 14:17:57 -0500 (EST) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 1AC6F1EE6 for ; Mon, 23 Nov 2020 19:17:57 +0000 (UTC) X-FDA: 77516642994.27.land85_4a00e5d27367 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin27.hostedemail.com (Postfix) with ESMTP id D57B03D668 for ; Mon, 23 Nov 2020 19:17:56 +0000 (UTC) X-HE-Tag: land85_4a00e5d27367 X-Filterd-Recvd-Size: 7168 Received: from mail-ej1-f67.google.com (mail-ej1-f67.google.com [209.85.218.67]) by imf39.hostedemail.com (Postfix) with ESMTP for ; Mon, 23 Nov 2020 19:17:56 +0000 (UTC) Received: by mail-ej1-f67.google.com with SMTP id i19so24905510ejx.9 for ; Mon, 23 Nov 2020 11:17:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=HdQbgY+fGm8jxB4Ao2qaLqB1m6FKX93p0ZpDSNmzhRg=; b=ecz6nru9/eO/okMaZi3M1SqeAWBy3jSLMgd0jjhCQTgpbarec4ajNZc2z34SiLaYXP QaJ9mapXUBOQPHDszmlLh7XP42arbTRfXumSHa93MXICjloDTusJOZUbBPLUWOXgbgKZ pQ9+nKsc1i6ipcAuXP0mxabxLfUkdI0xLURbCfbeS8wWY5rV7x0QYGWPjdqiSV52K55x r78U+tHwgUxkiwIykrn1oTB8ldikaa6SeVOhCeVlAv4TB8gcYfIO54wMnjufMeoPn641 F1cxLMBeI9aeXeCsYDbEt+ePAmXOLWf4j+g0oiKvF1rdE0jaZD3q/81yQfnX86AGm3aN H+Cw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=HdQbgY+fGm8jxB4Ao2qaLqB1m6FKX93p0ZpDSNmzhRg=; b=m3q4VLzCvG0eXR37G8LKy/umMhSyWVfQRztx6YSybuJF3hNzJPzS6t6XDctCAQy+oD Rqx1qmJzPQSdvFY6DBoN94GyISB8b47QTIGb3LFQofF2uKejlLi5VARmuBY+O5vu9chy P3Dbvcg1a0AOsbuFCAWioVa1clh5yfVdC82gTkCwlPmW8e1p8ZaMpr70g8eZGBOV9XDk AU23V/w6p6Kg1sQTJzOzHyOA+6+KXM8De2+p8jB5LdRbVlT9PATLwV/fbytzArWNxbx/ YoTqTtJ58mM3Xu5N3I9kUflu/eMN7l8Cm6ug2BJ2l8mXEgqSOrOO8mfoCJTw0fEdeGbu Q2fQ== X-Gm-Message-State: AOAM531HTslOuG2KHHmKUPNIVv2L1PVs82iJk441GJZkzBMWa9skpylj 6Zv0yo06cDLxwaCaBMWQ0jHcMkLYrk6vqhtUfby0Kw== X-Google-Smtp-Source: ABdhPJxls2+tu09Rb1v/Dt0hKt61j+cTOrCnH79IazHpSsNU2scVK5iT+mwhaQK0QUof4aS2TvFYL72oX+JQ5QIXnVs= X-Received: by 2002:a17:906:c059:: with SMTP id bm25mr1009217ejb.20.1606159074807; Mon, 23 Nov 2020 11:17:54 -0800 (PST) MIME-Version: 1.0 References: <20201120030411.2690816-1-lokeshgidra@google.com> <20201120030411.2690816-2-lokeshgidra@google.com> <20201120153337.431dc36c1975507bb1e44596@linux-foundation.org> In-Reply-To: <20201120153337.431dc36c1975507bb1e44596@linux-foundation.org> From: Lokesh Gidra Date: Mon, 23 Nov 2020 11:17:43 -0800 Message-ID: Subject: Re: [PATCH v6 1/2] Add UFFD_USER_MODE_ONLY To: Andrew Morton Cc: Kees Cook , Jonathan Corbet , Peter Xu , Andrea Arcangeli , Sebastian Andrzej Siewior , Alexander Viro , Stephen Smalley , Eric Biggers , Daniel Colascione , "Joel Fernandes (Google)" , Linux FS Devel , linux-kernel , linux-doc@vger.kernel.org, Kalesh Singh , Calin Juravle , Suren Baghdasaryan , Jeffrey Vander Stoep , "Cc: Android Kernel" , Mike Rapoport , Shaohua Li , Jerome Glisse , Mauro Carvalho Chehab , Johannes Weiner , Mel Gorman , Nitin Gupta , Vlastimil Babka , Iurii Zaikin , Luis Chamberlain , linux-mm@kvack.kernel.org, Daniel Colascione , "open list:MEMORY MANAGEMENT" Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Nov 20, 2020 at 3:33 PM Andrew Morton wrote: > > On Thu, 19 Nov 2020 19:04:10 -0800 Lokesh Gidra wrote: > > > userfaultfd handles page faults from both user and kernel code. > > Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes > > the resulting userfaultfd object refuse to handle faults from kernel > > mode, treating these faults as if SIGBUS were always raised, causing > > the kernel code to fail with EFAULT. > > > > A future patch adds a knob allowing administrators to give some > > processes the ability to create userfaultfd file objects only if they > > pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes > > will exploit userfaultfd's ability to delay kernel page faults to open > > timing windows for future exploits. > > Can we assume that an update to the userfaultfd(2) manpage is in the > works? > Yes, I'm working on it. Can the kernel version which will have these patches be known now so that I can mention it in the manpage? > > --- a/fs/userfaultfd.c > > +++ b/fs/userfaultfd.c > > @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) > > > > if (ctx->features & UFFD_FEATURE_SIGBUS) > > goto out; > > + if ((vmf->flags & FAULT_FLAG_USER) == 0 && > > + ctx->flags & UFFD_USER_MODE_ONLY) { > > + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd " > > + "sysctl knob to 1 if kernel faults must be handled " > > + "without obtaining CAP_SYS_PTRACE capability\n"); > > + goto out; > > + } > > > > /* > > * If it's already released don't get it. This avoids to loop > > @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) > > BUG_ON(!current->mm); > > > > /* Check the UFFD_* constants for consistency. */ > > + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS); > > Are we sure this is true for all architectures? Yes, none of the architectures are using the least-significant bit for O_CLOEXEC or O_NONBLOCK. > > > BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC); > > BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK); > > > > - if (flags & ~UFFD_SHARED_FCNTL_FLAGS) > > + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY)) > > return -EINVAL; > > > > ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL); > > diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h > > index e7e98bde221f..5f2d88212f7c 100644 > > --- a/include/uapi/linux/userfaultfd.h > > +++ b/include/uapi/linux/userfaultfd.h > > @@ -257,4 +257,13 @@ struct uffdio_writeprotect { > > __u64 mode; > > }; > > > > +/* > > + * Flags for the userfaultfd(2) system call itself. > > + */ > > + > > +/* > > + * Create a userfaultfd that can handle page faults only in user mode. > > + */ > > +#define UFFD_USER_MODE_ONLY 1 > > + > > #endif /* _LINUX_USERFAULTFD_H */ > > It would be nice to define this in include/linux/userfaultfd_k.h, > alongside the other flags. But I guess it has to be here because it's > part of the userspace API.