From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60FB9C7EE23 for ; Tue, 16 May 2023 22:25:30 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id C6C49900006; Tue, 16 May 2023 18:25:29 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C1C87900002; Tue, 16 May 2023 18:25:29 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id ABD59900006; Tue, 16 May 2023 18:25:29 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 99330900002 for ; Tue, 16 May 2023 18:25:29 -0400 (EDT) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 580101A0353 for ; Tue, 16 May 2023 22:25:29 +0000 (UTC) X-FDA: 80797550778.15.59E40C6 Received: from mail-ed1-f51.google.com (mail-ed1-f51.google.com [209.85.208.51]) by imf19.hostedemail.com (Postfix) with ESMTP id 683A71A000F for ; Tue, 16 May 2023 22:25:27 +0000 (UTC) Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=nPMklpwu; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf19.hostedemail.com: domain of jeffxu@google.com designates 209.85.208.51 as permitted sender) smtp.mailfrom=jeffxu@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684275927; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=fsruOfx1bcVhMOcogHRbjQUtZfueJR8BYRLENPgR3EM=; b=FRtiVwrr90Gw+6EYGVwPfXAB/5Eqqrv3qdFIybyEQ6RzyU/6BbIriNl13Exw/CUjLVgqGi iNCGCIXWM7A4c0jkYt9TbZi2JxowzbceQ8aN1jM4VD0Ie9JIoSF+sL5lCy1MXqroAFD78w vVyUwa7/addz+qpm0caiU8xVlS+xWdw= ARC-Authentication-Results: i=1; imf19.hostedemail.com; dkim=pass header.d=google.com header.s=20221208 header.b=nPMklpwu; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf19.hostedemail.com: domain of jeffxu@google.com designates 209.85.208.51 as permitted sender) smtp.mailfrom=jeffxu@google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684275927; a=rsa-sha256; cv=none; b=l42Q+w05KKrEc1/p9KOjP7iqVWvdizFijpkLZJCn1TB0qwqSKFCWvrF+uFq8sxFo7vbXFg haRiGTcom+zlJAtYQUihTELD+kr3XprRulMRRl0Bh9Hsy1V959E8nz+/0TM56j2xBizDLk rH4kvPkD7mcO2IjJcLK+nXwyMthSYQc= Received: by mail-ed1-f51.google.com with SMTP id 4fb4d7f45d1cf-50dba8a52dcso1662a12.0 for ; Tue, 16 May 2023 15:25:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20221208; t=1684275926; x=1686867926; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=fsruOfx1bcVhMOcogHRbjQUtZfueJR8BYRLENPgR3EM=; b=nPMklpwuztnmJsZD5kYHbZk0A4Or9Gp42GrUE6S8mGkzO+p8Q1RGHNOcI9WUQKqniU gn0ajatAen6X7gzIymHoX91rfmlRWZySK/RySMNQAK5kOjMZlgPjP9hI6f4PqPpzcv1A LBGyQlE8hMCsRx6k7yS+9vCI2yhm6TyFxXN+0wWDEVAg6jByIHe8wrmjpYAM7Iz8TFFW EbMp6JKLcQV2GjBthPVWbAumM5Nq/xcQPdoYShR8dnGJP8ipVo9oyDAVf/X3Fw/CGfc6 jP7xbBtYQAsh40WgMFQ0B7WQ0XW57W6jOlkhRKNG/uCkGGZ6UI5mWA0n5ZXSyAGT3RNj Eb7g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1684275926; x=1686867926; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=fsruOfx1bcVhMOcogHRbjQUtZfueJR8BYRLENPgR3EM=; b=Z6qlocDTNg253d4guEan1t/vGyphXZEOIQwwOAupMGyIlDT3N3YejXjsYcwzNxVV2H 8jKxViOqvyjA1NBviRI/nFdzmogdur/1qWy20Av6G+q7x50ah8aYnUafQH4ig9vB5zyL Bln6ROKQj4mFTsMiPIAc0N6Fdx5YuejHcLFrSL1qQebWXwnnbxRpWxGtXp50Kt4sDZv8 OsJn4pSFf/bAdn8ZWWJhQ8IQxDF+sCyPT3HSy1q9wdFD6lb7VBIRlpKN23XjiMwkp1iK vY1oUpE/10wtO1DIn0isuZzWHocqtK/UpTTz8HE4nA/GYyDcf74BkrcM+Jokd4hIlq6c j/Gg== X-Gm-Message-State: AC+VfDzOO622TwBVFKU0AN75pZlJD4YQttOl7RgwjADHIrX2Os8FkncU 9nPVUFQefKc2wTfdQ+hGOB/3D3yEEbkIpe1cTlL5Yw== X-Google-Smtp-Source: ACHHUZ51dfc73YPcyqVjoCb3D7RdXmZi/sdfnvq+Tb4ZqLn4Jn/M2T1iMMHGBEMD+Ydy/6sYnT5ZYuoTWrcrofrv5xQ= X-Received: by 2002:a50:9515:0:b0:4bc:dee8:94ca with SMTP id u21-20020a509515000000b004bcdee894camr7459eda.7.1684275925862; Tue, 16 May 2023 15:25:25 -0700 (PDT) MIME-Version: 1.0 References: <20230515130553.2311248-1-jeffxu@chromium.org> <20230515130553.2311248-6-jeffxu@chromium.org> <202305161302.16BF756DEA@keescook> In-Reply-To: <202305161302.16BF756DEA@keescook> From: Jeff Xu Date: Tue, 16 May 2023 15:24:49 -0700 Message-ID: Subject: Re: [PATCH 5/6] KEY: Apply PKEY_ENFORCE_API to munmap To: Kees Cook Cc: jeffxu@chromium.org, dave.hansen@intel.com, luto@kernel.org, jorgelo@chromium.org, groeck@chromium.org, jannh@google.com, sroettger@google.com, akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, linux-hardening@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Stat-Signature: 56csd7fo1asz5xqip45eqoticuur5ikj X-Rspam-User: X-Rspamd-Queue-Id: 683A71A000F X-Rspamd-Server: rspam07 X-HE-Tag: 1684275927-911709 X-HE-Meta: U2FsdGVkX1+z0T6gVgooVhdxhQd5EUD5HchbyEApKFMHS1hmzhXG9CgGBsQlljtGKOURvJRdodFRVmN5+samVvlkRXZl2FWekhxKkP4enrwY1lwv5V7mIpxpH6XdgsYOywzXbJhUwtU7ZvrNhUtLHGbNgxuCjSytSqi1CaJxm7c1VxqLU6J+EqLg0nXnGejlcaLqo/ciBrwheKj3Y/1M7vcZRDolqq8XIwJQXTOoxjeOwtHBRVHBfKHpIgpD7tXL573L67QxQoUSwdb1PoGD/ZtJX3JwvSTOgjcRrLEKC/HguSK5X9fttBlWnFM22cDRHY6ETwgQLMAQ2IDlWIDgWH/CDTZxgo4JxvgdJHyW/ifTuH+rg7Q+3/TbWc4A+wH8TNW3Qy+UW//XHA+3IzYAkiiVBFyu8SSTZ3jcd1/ft9T9/NzRRHCUkoncQqTCi2FTEECtkPYUudG22MyqEcTMgReXKmQhyzKTSCzsEPVHgoDEZ3k8WHjPNfkoQZYTp/9oviTwdlKenZ0saKB+2WDs2VNDDRRCTjZPE5cH2x2YalzEsu31MtIievNey2dkWrGW2b0Jwcxybc2wkWuU/bDbYgUUj18hZTg4/LK8dA5+jKwvqP+sQi8uH8k/G0hAzSaoKe/lfNJM34vLu1B4mNxXiD7urKoZT/zzQ4hJjG9po/fftuiyRgCJIzMzr3Ym6JIBRdfDQ8lOgFHhOmaLAyqCufuoQTx1L+hDCGn2rmaS+ELf2tyVi2AIhPj7l7MGfOPoBCw85HJpk1m8UlsMRtPC6TKgB6FoNb8HYa588qHjtG7Gmk0d3manMKA3AJ6ZlgLMhPaFFyprGzyBARywl1P3LKSJ+alYV4BGtcn5AQM44/pKO7BqdtnKNSjx6lEO4QIzZSGFRDa25k8/e5R9uFBnGpRxtqKxekyfH86NNa3s/9qAxsFMkhq7/Es0/ys3Ql82qsucsvryq+dreT3V35m nwh4vrl1 i3LRH9ewoeGDjkNDsOAGXEaBYhCmLaz9II9ssiEC4b4nm1NNBvJpUETcpPG255ORIVjZ2CWKbWUlU4gGdaBD48Ozex+esL1I/M3BNW6HqqSENv+cka0zwnS8nNgAZIszPM3y/172/93O14GQ90LL4cPooiG5fcdPJFXwDRqmsCrbXUuo61TXMz6JgPBChOpcpshQins6J6SWdYv313swRrSfmBIoiU0uLVkIsChmK3WS1lfMWZC9L/0gxHFRAqS9wMhNispnz7Cy/srjCKZ9QVYMOs47zqercNSuknMh0BvTfcyGCNuF/ukm6tYrg01sD1lGeOm5wSSJ/bLHQW11MRkVVwRQWRhNsjzrYmCL3yePODCg= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, May 16, 2023 at 1:13=E2=80=AFPM Kees Cook w= rote: > > On Mon, May 15, 2023 at 01:05:51PM +0000, jeffxu@chromium.org wrote: > > From: Jeff Xu > > > > This patch enables PKEY_ENFORCE_API for the munmap > > syscall. > > > > Signed-off-by: Jeff Xu > > --- > > include/linux/mm.h | 2 +- > > mm/mmap.c | 34 ++++++++++++++++++++++++++-------- > > mm/mremap.c | 6 ++++-- > > 3 files changed, 31 insertions(+), 11 deletions(-) > > > > diff --git a/include/linux/mm.h b/include/linux/mm.h > > index 27ce77080c79..48076e845d53 100644 > > --- a/include/linux/mm.h > > +++ b/include/linux/mm.h > > @@ -3136,7 +3136,7 @@ extern unsigned long do_mmap(struct file *file, u= nsigned long addr, > > unsigned long pgoff, unsigned long *populate, struct list_head *u= f); > > extern int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *m= m, > > unsigned long start, size_t len, struct list_hea= d *uf, > > - bool downgrade); > > + bool downgrade, bool syscall); > > For type checking and readability, I suggest using an enum instead of > "bool". Perhaps something like: > > enum caller_origin { > ON_BEHALF_OF_KERNEL =3D 0, > ON_BEHALF_OF_USERSPACE, > }; > Sure, it makes sense. > extern int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, > unsigned long start, size_t len, struct list_hea= d *uf, > - bool downgrade); > + bool downgrade, enum caller_origin called); > > > extern int do_munmap(struct mm_struct *, unsigned long, size_t, > > struct list_head *uf); > > extern int do_madvise(struct mm_struct *mm, unsigned long start, size_= t len_in, int behavior); > > diff --git a/mm/mmap.c b/mm/mmap.c > > index 13678edaa22c..29329aa794a6 100644 > > --- a/mm/mmap.c > > +++ b/mm/mmap.c > > @@ -2498,6 +2498,7 @@ do_vmi_align_munmap(struct vma_iterator *vmi, str= uct vm_area_struct *vma, > > * @uf: The userfaultfd list_head > > * @downgrade: set to true if the user wants to attempt to write_downg= rade the > > * mmap_lock > > + * @syscall: set to true if this is called from syscall entry > > * > > * This function takes a @mas that is either pointing to the previous = VMA or set > > * to MA_START and sets it up to remove the mapping(s). The @len will= be > > @@ -2507,7 +2508,7 @@ do_vmi_align_munmap(struct vma_iterator *vmi, str= uct vm_area_struct *vma, > > */ > > int do_vmi_munmap(struct vma_iterator *vmi, struct mm_struct *mm, > > unsigned long start, size_t len, struct list_head *uf, > > - bool downgrade) > > + bool downgrade, bool syscall) > > { > > unsigned long end; > > struct vm_area_struct *vma; > > @@ -2519,6 +2520,19 @@ int do_vmi_munmap(struct vma_iterator *vmi, stru= ct mm_struct *mm, > > if (end =3D=3D start) > > return -EINVAL; > > > > + /* > > + * When called by syscall from userspace, check if the calling > > + * thread has the PKEY permission to modify the memory mapping. > > + */ > > + if (syscall && arch_check_pkey_enforce_api(mm, start, end) < 0) { > > if (called =3D=3D ON_BEHALF_OF_USERSPACE && > arch_check_pkey_enforce_api(mm, start, end) < 0) { > > > + char comm[TASK_COMM_LEN]; > > + > > + pr_warn_ratelimited( > > + "munmap was denied on PKEY_ENFORCE_API memory, pi= d=3D%d '%s'\n", > > + task_pid_nr(current), get_task_comm(comm, current= )); > > + return -EACCES; > > + } > > + > > /* arch_unmap() might do unmaps itself. */ > > arch_unmap(mm, start, end); > > > > @@ -2541,7 +2555,7 @@ int do_munmap(struct mm_struct *mm, unsigned long= start, size_t len, > > { > > VMA_ITERATOR(vmi, mm, start); > > > > - return do_vmi_munmap(&vmi, mm, start, len, uf, false); > > + return do_vmi_munmap(&vmi, mm, start, len, uf, false, false); > > + return do_vmi_munmap(&vmi, mm, start, len, uf, false, ON_BEHALF_O= F_KERNEL); > > > [...] > > SYSCALL_DEFINE2(munmap, unsigned long, addr, size_t, len) > > { > > addr =3D untagged_addr(addr); > > - return __vm_munmap(addr, len, true); > > + return __vm_munmap(addr, len, true, true); > > + return __vm_munmap(addr, len, true, ON_BEHALF_OF_USERSPACE); > > etc. > > -- > Kees Cook Thanks! -Jeff Xu