From: Peter Zijlstra <peterz@infradead.org> To: Andy Lutomirski <luto@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de>, LKML <linux-kernel@vger.kernel.org>, X86 ML <x86@kernel.org>, Linus Torvalds <torvalds@linux-foundation.org>, Dave Hansen <dave.hansen@intel.com>, Borislav Petkov <bpetkov@suse.de>, Greg KH <gregkh@linuxfoundation.org>, Kees Cook <keescook@google.com>, Hugh Dickins <hughd@google.com>, Brian Gerst <brgerst@gmail.com>, Josh Poimboeuf <jpoimboe@redhat.com>, Denys Vlasenko <dvlasenk@redhat.com>, Boris Ostrovsky <boris.ostrovsky@oracle.com>, Juergen Gross <jgross@suse.com>, David Laight <David.Laight@aculab.com>, Eduardo Valentin <eduval@amazon.com>, aliguori@amazon.com, Will Deacon <will.deacon@arm.com>, "linux-mm@kvack.org" <linux-mm@kvack.org>, kirill.shutemov@linux.intel.com, aneesh.kumar@linux.vnet.ibm.com Subject: Re: [patch 05/16] mm: Allow special mappings with user access cleared Date: Wed, 13 Dec 2017 13:22:11 +0100 [thread overview] Message-ID: <20171213122211.bxcb7xjdwla2bqol@hirez.programming.kicks-ass.net> (raw) In-Reply-To: <CALCETrXLeGGw+g7GiGDmReXgOxjB-cjmehdryOsFK4JB5BJAFQ@mail.gmail.com> On Tue, Dec 12, 2017 at 10:00:08AM -0800, Andy Lutomirski wrote: > On Tue, Dec 12, 2017 at 9:32 AM, Thomas Gleixner <tglx@linutronix.de> wrote: > > From: Peter Zijstra <peterz@infradead.org> > > > > In order to create VMAs that are not accessible to userspace create a new > > VM_NOUSER flag. This can be used in conjunction with > > install_special_mapping() to inject 'kernel' data into the userspace map. > > > > Similar to how arch_vm_get_page_prot() allows adding _PAGE_flags to > > pgprot_t, introduce arch_vm_get_page_prot_excl() which masks > > _PAGE_flags from pgprot_t and use this to implement VM_NOUSER for x86. > > How does this interact with get_user_pages(), etc? So I went through that code and I think I found a bug related to this. get_user_pages_fast() will ultimately end up doing pte_access_permitted() before getting the page, follow_page OTOH does not do this, which makes for a curious difference between the two. So I'm thinking we want the below irrespective of the VM_NOUSER patch, but with VM_NOUSER it would mean write(2) will no longer be able to access the page. diff --git a/mm/gup.c b/mm/gup.c index dfcde13f289a..b852f37a2b0c 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -153,6 +153,11 @@ static struct page *follow_page_pte(struct vm_area_struct *vma, } if (flags & FOLL_GET) { + if (!pte_access_permitted(pte, !!(flags & FOLL_WRITE))) { + page = ERR_PTR(-EFAULT); + goto out; + } + get_page(page); /* drop the pgmap reference now that we hold the page */
WARNING: multiple messages have this Message-ID (diff)
From: Peter Zijlstra <peterz@infradead.org> To: Andy Lutomirski <luto@kernel.org> Cc: Thomas Gleixner <tglx@linutronix.de>, LKML <linux-kernel@vger.kernel.org>, X86 ML <x86@kernel.org>, Linus Torvalds <torvalds@linux-foundation.org>, Dave Hansen <dave.hansen@intel.com>, Borislav Petkov <bpetkov@suse.de>, Greg KH <gregkh@linuxfoundation.org>, Kees Cook <keescook@google.com>, Hugh Dickins <hughd@google.com>, Brian Gerst <brgerst@gmail.com>, Josh Poimboeuf <jpoimboe@redhat.com>, Denys Vlasenko <dvlasenk@redhat.com>, Boris Ostrovsky <boris.ostrovsky@oracle.com>, Juergen Gross <jgross@suse.com>, David Laight <David.Laight@aculab.com>, Eduardo Valentin <eduval@amazon.com>, aliguori@amazon.com, Will Deacon <will.deacon@arm.com>, "linux-mm@kvack.org" <linux-mm@kvack.org>, kirill.shutemov@linux.intel.com, aneesh.kumar@linux.vnet.ibm.com Subject: Re: [patch 05/16] mm: Allow special mappings with user access cleared Date: Wed, 13 Dec 2017 13:22:11 +0100 [thread overview] Message-ID: <20171213122211.bxcb7xjdwla2bqol@hirez.programming.kicks-ass.net> (raw) In-Reply-To: <CALCETrXLeGGw+g7GiGDmReXgOxjB-cjmehdryOsFK4JB5BJAFQ@mail.gmail.com> On Tue, Dec 12, 2017 at 10:00:08AM -0800, Andy Lutomirski wrote: > On Tue, Dec 12, 2017 at 9:32 AM, Thomas Gleixner <tglx@linutronix.de> wrote: > > From: Peter Zijstra <peterz@infradead.org> > > > > In order to create VMAs that are not accessible to userspace create a new > > VM_NOUSER flag. This can be used in conjunction with > > install_special_mapping() to inject 'kernel' data into the userspace map. > > > > Similar to how arch_vm_get_page_prot() allows adding _PAGE_flags to > > pgprot_t, introduce arch_vm_get_page_prot_excl() which masks > > _PAGE_flags from pgprot_t and use this to implement VM_NOUSER for x86. > > How does this interact with get_user_pages(), etc? So I went through that code and I think I found a bug related to this. get_user_pages_fast() will ultimately end up doing pte_access_permitted() before getting the page, follow_page OTOH does not do this, which makes for a curious difference between the two. So I'm thinking we want the below irrespective of the VM_NOUSER patch, but with VM_NOUSER it would mean write(2) will no longer be able to access the page. diff --git a/mm/gup.c b/mm/gup.c index dfcde13f289a..b852f37a2b0c 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -153,6 +153,11 @@ static struct page *follow_page_pte(struct vm_area_struct *vma, } if (flags & FOLL_GET) { + if (!pte_access_permitted(pte, !!(flags & FOLL_WRITE))) { + page = ERR_PTR(-EFAULT); + goto out; + } + get_page(page); /* drop the pgmap reference now that we hold the page */ -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2017-12-13 12:22 UTC|newest] Thread overview: 134+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-12-12 17:32 [patch 00/16] x86/ldt: Use a VMA based read only mapping Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 01/16] arch: Allow arch_dup_mmap() to fail Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 02/16] x86/ldt: Rework locking Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 03/16] x86/ldt: Prevent ldt inheritance on exec Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 04/16] mm/softdirty: Move VM_SOFTDIRTY into high bits Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 05/16] mm: Allow special mappings with user access cleared Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 18:00 ` Andy Lutomirski 2017-12-12 18:00 ` Andy Lutomirski 2017-12-12 18:05 ` Peter Zijlstra 2017-12-12 18:05 ` Peter Zijlstra 2017-12-12 18:06 ` Andy Lutomirski 2017-12-12 18:06 ` Andy Lutomirski 2017-12-12 18:25 ` Peter Zijlstra 2017-12-12 18:25 ` Peter Zijlstra 2017-12-13 12:22 ` Peter Zijlstra [this message] 2017-12-13 12:22 ` Peter Zijlstra 2017-12-13 12:57 ` Kirill A. Shutemov 2017-12-13 12:57 ` Kirill A. Shutemov 2017-12-13 14:34 ` Peter Zijlstra 2017-12-13 14:34 ` Peter Zijlstra 2017-12-13 14:43 ` Kirill A. Shutemov 2017-12-13 14:43 ` Kirill A. Shutemov 2017-12-13 15:00 ` Peter Zijlstra 2017-12-13 15:00 ` Peter Zijlstra 2017-12-13 15:04 ` Peter Zijlstra 2017-12-13 15:04 ` Peter Zijlstra 2017-12-13 15:14 ` Dave Hansen 2017-12-13 15:14 ` Dave Hansen 2017-12-13 15:32 ` Peter Zijlstra 2017-12-13 15:32 ` Peter Zijlstra 2017-12-13 15:47 ` Dave Hansen 2017-12-13 15:47 ` Dave Hansen 2017-12-13 15:54 ` Peter Zijlstra 2017-12-13 15:54 ` Peter Zijlstra 2017-12-13 18:08 ` Linus Torvalds 2017-12-13 18:08 ` Linus Torvalds 2017-12-13 18:21 ` Dave Hansen 2017-12-13 18:21 ` Dave Hansen 2017-12-13 18:23 ` Linus Torvalds 2017-12-13 18:23 ` Linus Torvalds 2017-12-13 18:31 ` Andy Lutomirski 2017-12-13 18:31 ` Andy Lutomirski 2017-12-13 18:32 ` Peter Zijlstra 2017-12-13 18:32 ` Peter Zijlstra 2017-12-13 18:35 ` Linus Torvalds 2017-12-13 18:35 ` Linus Torvalds 2017-12-14 4:53 ` Aneesh Kumar K.V 2017-12-14 4:53 ` Aneesh Kumar K.V 2017-12-13 21:50 ` Matthew Wilcox 2017-12-13 21:50 ` Matthew Wilcox 2017-12-13 22:12 ` Peter Zijlstra 2017-12-13 22:12 ` Peter Zijlstra 2017-12-14 0:10 ` Matthew Wilcox 2017-12-14 0:10 ` Matthew Wilcox 2017-12-14 0:16 ` Andy Lutomirski 2017-12-14 0:16 ` Andy Lutomirski 2017-12-12 17:32 ` [patch 06/16] mm: Provide vm_special_mapping::close Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 07/16] selftest/x86: Implement additional LDT selftests Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 08/16] selftests/x86/ldt_gdt: Prepare for access bit forced Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 09/16] mm: Make populate_vma_page_range() available Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 10/16] x86/ldt: Do not install LDT for kernel threads Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:57 ` Andy Lutomirski 2017-12-12 17:57 ` Andy Lutomirski 2017-12-12 17:32 ` [patch 11/16] x86/ldt: Force access bit for CS/SS Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 18:03 ` Andy Lutomirski 2017-12-12 18:03 ` Andy Lutomirski 2017-12-12 18:09 ` Peter Zijlstra 2017-12-12 18:09 ` Peter Zijlstra 2017-12-12 18:10 ` Andy Lutomirski 2017-12-12 18:10 ` Andy Lutomirski 2017-12-12 18:22 ` Andy Lutomirski 2017-12-12 18:22 ` Andy Lutomirski 2017-12-12 18:29 ` Peter Zijlstra 2017-12-12 18:29 ` Peter Zijlstra 2017-12-12 18:41 ` Thomas Gleixner 2017-12-12 18:41 ` Thomas Gleixner 2017-12-12 19:04 ` Peter Zijlstra 2017-12-12 19:04 ` Peter Zijlstra 2017-12-12 19:05 ` Linus Torvalds 2017-12-12 19:05 ` Linus Torvalds 2017-12-12 19:26 ` Andy Lutomirski 2017-12-12 19:26 ` Andy Lutomirski 2017-12-19 12:10 ` David Laight 2017-12-19 12:10 ` David Laight 2017-12-12 17:32 ` [patch 12/16] x86/ldt: Reshuffle code Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 13/16] x86/ldt: Introduce LDT write fault handler Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:58 ` Andy Lutomirski 2017-12-12 17:58 ` Andy Lutomirski 2017-12-12 18:19 ` Peter Zijlstra 2017-12-12 18:19 ` Peter Zijlstra 2017-12-12 18:43 ` Thomas Gleixner 2017-12-12 18:43 ` Thomas Gleixner 2017-12-12 19:01 ` Linus Torvalds 2017-12-12 19:01 ` Linus Torvalds 2017-12-12 19:21 ` Thomas Gleixner 2017-12-12 19:21 ` Thomas Gleixner 2017-12-12 19:51 ` Linus Torvalds 2017-12-12 19:51 ` Linus Torvalds 2017-12-12 20:21 ` Dave Hansen 2017-12-12 20:21 ` Dave Hansen 2017-12-12 20:37 ` Thomas Gleixner 2017-12-12 20:37 ` Thomas Gleixner 2017-12-12 21:35 ` Andy Lutomirski 2017-12-12 21:35 ` Andy Lutomirski 2017-12-12 21:42 ` Thomas Gleixner 2017-12-12 21:42 ` Thomas Gleixner 2017-12-12 21:41 ` Thomas Gleixner 2017-12-12 21:41 ` Thomas Gleixner 2017-12-12 21:46 ` Thomas Gleixner 2017-12-12 21:46 ` Thomas Gleixner 2017-12-12 22:25 ` Peter Zijlstra 2017-12-12 22:25 ` Peter Zijlstra 2017-12-12 17:32 ` [patch 14/16] x86/ldt: Prepare for VMA mapping Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 15/16] x86/ldt: Add VMA management code Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 17:32 ` [patch 16/16] x86/ldt: Make it read only VMA mapped Thomas Gleixner 2017-12-12 17:32 ` Thomas Gleixner 2017-12-12 18:03 ` [patch 00/16] x86/ldt: Use a VMA based read only mapping Andy Lutomirski 2017-12-12 18:03 ` Andy Lutomirski
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20171213122211.bxcb7xjdwla2bqol@hirez.programming.kicks-ass.net \ --to=peterz@infradead.org \ --cc=David.Laight@aculab.com \ --cc=aliguori@amazon.com \ --cc=aneesh.kumar@linux.vnet.ibm.com \ --cc=boris.ostrovsky@oracle.com \ --cc=bpetkov@suse.de \ --cc=brgerst@gmail.com \ --cc=dave.hansen@intel.com \ --cc=dvlasenk@redhat.com \ --cc=eduval@amazon.com \ --cc=gregkh@linuxfoundation.org \ --cc=hughd@google.com \ --cc=jgross@suse.com \ --cc=jpoimboe@redhat.com \ --cc=keescook@google.com \ --cc=kirill.shutemov@linux.intel.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=luto@kernel.org \ --cc=tglx@linutronix.de \ --cc=torvalds@linux-foundation.org \ --cc=will.deacon@arm.com \ --cc=x86@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.