From: Jason Gunthorpe <jgg@ziepe.ca> To: Daniel Vetter <daniel.vetter@ffwll.ch> Cc: "DRI Development" <dri-devel@lists.freedesktop.org>, LKML <linux-kernel@vger.kernel.org>, kvm@vger.kernel.org, linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, linux-samsung-soc@vger.kernel.org, linux-media@vger.kernel.org, linux-s390@vger.kernel.org, "Daniel Vetter" <daniel.vetter@intel.com>, "Kees Cook" <keescook@chromium.org>, "Dan Williams" <dan.j.williams@intel.com>, "Andrew Morton" <akpm@linux-foundation.org>, "John Hubbard" <jhubbard@nvidia.com>, "Jérôme Glisse" <jglisse@redhat.com>, "Jan Kara" <jack@suse.cz> Subject: Re: [PATCH 11/13] mm: add unsafe_follow_pfn Date: Wed, 7 Oct 2020 14:36:47 -0300 [thread overview] Message-ID: <20201007173647.GW5177@ziepe.ca> (raw) In-Reply-To: <20201007164426.1812530-12-daniel.vetter@ffwll.ch> On Wed, Oct 07, 2020 at 06:44:24PM +0200, Daniel Vetter wrote: > Way back it was a reasonable assumptions that iomem mappings never > change the pfn range they point at. But this has changed: > > - gpu drivers dynamically manage their memory nowadays, invalidating > ptes with unmap_mapping_range when buffers get moved > > - contiguous dma allocations have moved from dedicated carvetouts to > cma regions. This means if we miss the unmap the pfn might contain > pagecache or anon memory (well anything allocated with GFP_MOVEABLE) > > - even /dev/mem now invalidates mappings when the kernel requests that > iomem region when CONFIG_IO_STRICT_DEVMEM is set, see 3234ac664a87 > ("/dev/mem: Revoke mappings when a driver claims the region") > > Accessing pfns obtained from ptes without holding all the locks is > therefore no longer a good idea. > > Unfortunately there's some users where this is not fixable (like v4l > userptr of iomem mappings) or involves a pile of work (vfio type1 > iommu). For now annotate these as unsafe and splat appropriately. > > This patch adds an unsafe_follow_pfn, which later patches will then > roll out to all appropriate places. > > Signed-off-by: Daniel Vetter <daniel.vetter@intel.com> > Cc: Jason Gunthorpe <jgg@ziepe.ca> > Cc: Kees Cook <keescook@chromium.org> > Cc: Dan Williams <dan.j.williams@intel.com> > Cc: Andrew Morton <akpm@linux-foundation.org> > Cc: John Hubbard <jhubbard@nvidia.com> > Cc: Jérôme Glisse <jglisse@redhat.com> > Cc: Jan Kara <jack@suse.cz> > Cc: Dan Williams <dan.j.williams@intel.com> > Cc: linux-mm@kvack.org > Cc: linux-arm-kernel@lists.infradead.org > Cc: linux-samsung-soc@vger.kernel.org > Cc: linux-media@vger.kernel.org > Cc: kvm@vger.kernel.org > --- > include/linux/mm.h | 2 ++ > mm/memory.c | 32 +++++++++++++++++++++++++++++++- > mm/nommu.c | 17 +++++++++++++++++ > security/Kconfig | 13 +++++++++++++ > 4 files changed, 63 insertions(+), 1 deletion(-) Makes sense to me. I wonder if we could change the original follow_pfn to require the ptep and then lockdep_assert_held() it against the page table lock? > +int unsafe_follow_pfn(struct vm_area_struct *vma, unsigned long address, > + unsigned long *pfn) > +{ > +#ifdef CONFIG_STRICT_FOLLOW_PFN > + pr_info("unsafe follow_pfn usage rejected, see > CONFIG_STRICT_FOLLOW_PFN\n"); Wonder if we can print something useful here, like the current PID/process name? > diff --git a/security/Kconfig b/security/Kconfig > index 7561f6f99f1d..48945402e103 100644 > --- a/security/Kconfig > +++ b/security/Kconfig > @@ -230,6 +230,19 @@ config STATIC_USERMODEHELPER_PATH > If you wish for all usermode helper programs to be disabled, > specify an empty string here (i.e. ""). > > +config STRICT_FOLLOW_PFN > + bool "Disable unsafe use of follow_pfn" > + depends on MMU I would probably invert this CONFIG_ALLOW_UNSAFE_FOLLOW_PFN default n Jason
next prev parent reply other threads:[~2020-10-07 17:36 UTC|newest] Thread overview: 55+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-10-07 16:44 [PATCH 00/13] follow_pfn and other iomap races Daniel Vetter 2020-10-07 16:44 ` [PATCH 01/13] drm/exynos: Stop using frame_vector helpers Daniel Vetter 2020-10-07 20:32 ` John Hubbard 2020-10-07 21:32 ` Daniel Vetter 2020-10-07 21:36 ` John Hubbard 2020-10-07 21:50 ` Daniel Vetter 2020-10-07 16:44 ` [PATCH 02/13] drm/exynos: Use FOLL_LONGTERM for g2d cmdlists Daniel Vetter 2020-10-07 20:43 ` John Hubbard 2020-10-07 16:44 ` [PATCH 03/13] misc/habana: Stop using frame_vector helpers Daniel Vetter 2020-10-07 20:38 ` John Hubbard 2020-10-07 16:44 ` [PATCH 04/13] misc/habana: Use FOLL_LONGTERM for userptr Daniel Vetter 2020-10-07 20:46 ` John Hubbard 2020-10-07 16:44 ` [PATCH 05/13] mm/frame-vector: Use FOLL_LONGTERM Daniel Vetter 2020-10-07 16:53 ` Jason Gunthorpe 2020-10-07 17:12 ` Daniel Vetter 2020-10-07 17:33 ` Jason Gunthorpe 2020-10-07 21:13 ` John Hubbard 2020-10-07 21:30 ` Daniel Vetter 2020-10-07 16:44 ` [PATCH 06/13] media: videobuf2: Move frame_vector into media subsystem Daniel Vetter 2020-10-07 22:18 ` John Hubbard 2020-10-07 16:44 ` [PATCH 07/13] mm: close race in generic_access_phys Daniel Vetter 2020-10-07 17:27 ` Jason Gunthorpe 2020-10-07 18:01 ` Daniel Vetter 2020-10-07 23:21 ` Jason Gunthorpe 2020-10-08 0:44 ` John Hubbard 2020-10-08 7:23 ` Daniel Vetter 2020-10-07 16:44 ` [PATCH 08/13] s390/pci: Remove races against pte updates Daniel Vetter 2020-10-08 16:44 ` Gerald Schaefer 2020-10-08 17:16 ` Daniel Vetter 2020-10-07 16:44 ` [PATCH 09/13] PCI: obey iomem restrictions for procfs mmap Daniel Vetter 2020-10-07 18:46 ` Bjorn Helgaas 2020-10-07 16:44 ` [PATCH 10/13] PCI: revoke mappings like devmem Daniel Vetter 2020-10-07 18:41 ` Bjorn Helgaas 2020-10-07 19:24 ` Daniel Vetter 2020-10-07 19:33 ` Dan Williams 2020-10-07 19:47 ` Daniel Vetter 2020-10-07 22:23 ` Dan Williams 2020-10-07 22:29 ` Dan Williams 2020-10-08 8:09 ` Daniel Vetter 2020-10-07 23:24 ` Jason Gunthorpe 2020-10-08 7:31 ` Daniel Vetter 2020-10-08 7:49 ` Dan Williams 2020-10-08 8:13 ` Daniel Vetter 2020-10-08 8:35 ` Dan Williams 2020-10-08 12:41 ` Jason Gunthorpe 2020-10-07 16:44 ` [PATCH 11/13] mm: add unsafe_follow_pfn Daniel Vetter 2020-10-07 17:36 ` Jason Gunthorpe [this message] 2020-10-07 18:10 ` Daniel Vetter 2020-10-07 19:00 ` Jason Gunthorpe 2020-10-07 19:38 ` Daniel Vetter 2020-10-07 16:44 ` [PATCH 12/13] media/videbuf1|2: Mark follow_pfn usage as unsafe Daniel Vetter 2020-10-07 16:44 ` [PATCH 13/13] vfio/type1: Mark follow_pfn " Daniel Vetter 2020-10-07 17:39 ` Jason Gunthorpe 2020-10-07 18:14 ` Daniel Vetter 2020-10-07 18:47 ` Jason Gunthorpe
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20201007173647.GW5177@ziepe.ca \ --to=jgg@ziepe.ca \ --cc=akpm@linux-foundation.org \ --cc=dan.j.williams@intel.com \ --cc=daniel.vetter@ffwll.ch \ --cc=daniel.vetter@intel.com \ --cc=dri-devel@lists.freedesktop.org \ --cc=jack@suse.cz \ --cc=jglisse@redhat.com \ --cc=jhubbard@nvidia.com \ --cc=keescook@chromium.org \ --cc=kvm@vger.kernel.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-media@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=linux-s390@vger.kernel.org \ --cc=linux-samsung-soc@vger.kernel.org \ --subject='Re: [PATCH 11/13] mm: add unsafe_follow_pfn' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).