From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD482C77B7C for ; Fri, 5 May 2023 18:34:29 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 03DBA6B008C; Fri, 5 May 2023 14:34:29 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id F3A146B0095; Fri, 5 May 2023 14:34:28 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id E1FD86B0096; Fri, 5 May 2023 14:34:28 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by kanga.kvack.org (Postfix) with ESMTP id D0D316B008C for ; Fri, 5 May 2023 14:34:28 -0400 (EDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E9F9B60BAD; Fri, 5 May 2023 18:34:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1D7BC433EF; Fri, 5 May 2023 18:34:24 +0000 (UTC) Date: Fri, 5 May 2023 19:34:21 +0100 From: Catalin Marinas To: Florent Revest Cc: linux-kernel@vger.kernel.org, linux-mm@kvack.org, akpm@linux-foundation.org, anshuman.khandual@arm.com, joey.gouly@arm.com, mhocko@suse.com, keescook@chromium.org, david@redhat.com, peterx@redhat.com, izbyshev@ispras.ru, nd@arm.com, broonie@kernel.org, szabolcs.nagy@arm.com Subject: Re: [PATCH 3/4] mm: Add a NO_INHERIT flag to the PR_SET_MDWE prctl Message-ID: References: <20230504170942.822147-1-revest@chromium.org> <20230504170942.822147-4-revest@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230504170942.822147-4-revest@chromium.org> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, May 04, 2023 at 07:09:41PM +0200, Florent Revest wrote: > This extends the current PR_SET_MDWE prctl arg with a bit to indicate > that the process doesn't want MDWE protection to propagate to children. > > To implement this no-inherit mode, the tag in current->mm->flags must be > absent from MMF_INIT_MASK. This means that the encoding for "MDWE but > without inherit" is different in the prctl than in the mm flags. This > leads to a bit of bit-mangling in the prctl implementation. That bit mangling is not that bad but it complicates the code a bit, especially if we'll add new bits in the future. We also need to check both the original and the no-inherit bits for each feature. Another question is whether we want to support more fine-grained inheriting or just a big knob that disables inheriting for all the (future) MDWE flags. I think a somewhat simpler way would be to clear the flags on fork(), either based on a big MMF_HAS_MDWE_NO_INHERIT knob or individual ones. Something like below (completely untested): diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h index 0ee96ea7a0e9..ca83a0c8d19c 100644 --- a/include/linux/sched/coredump.h +++ b/include/linux/sched/coredump.h @@ -91,4 +91,12 @@ static inline int get_dumpable(struct mm_struct *mm) MMF_DISABLE_THP_MASK | MMF_HAS_MDWE_MASK) #define MMF_VM_MERGE_ANY 29 + +#define MMF_INIT_FLAGS(flags) ({ \ + unsigned long new_flags = flags; \ + if (new_flags & (1UL << MMF_HAS_MDWE_NO_INHERIT)) \ + new_flags &= ~(1UL << MMF_HAS_MDWE_MASK); \ + new_flags & MMF_INIT_MASK; \ +}) + #endif /* _LINUX_SCHED_COREDUMP_H */ diff --git a/kernel/fork.c b/kernel/fork.c index ed4e01daccaa..53f0b68a5451 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1288,7 +1288,7 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, hugetlb_count_init(mm); if (current->mm) { - mm->flags = current->mm->flags & MMF_INIT_MASK; + mm->flags = MMF_INIT_FLAGS(current->mm->flags); mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK; } else { mm->flags = default_dump_filter; The checks in MMF_INIT_FLAGS() can grow in time if we add more bits in there but we still only keep a single flag that determines whether the feature is enabled (maybe that's more like bikeshedding at this moment when we have a single bit). (fun remark: I see you cc'ed nd@arm.com'; that's not a real person, it's what our IT folk asked us to add on cc so that the Exchange server doesn't append the legal disclaimer; most lists are covered already without such cc but I guess people feel safer to add it, just in case) -- Catalin