From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-9.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C01C4C4727F for ; Wed, 7 Oct 2020 17:36:51 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 3FABC2173E for ; Wed, 7 Oct 2020 17:36:51 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=ziepe.ca header.i=@ziepe.ca header.b="cJyTco0o" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 3FABC2173E Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=ziepe.ca Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 9D09B6B006E; Wed, 7 Oct 2020 13:36:50 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 95B736B0070; Wed, 7 Oct 2020 13:36:50 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 849C26B0071; Wed, 7 Oct 2020 13:36:50 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0086.hostedemail.com [216.40.44.86]) by kanga.kvack.org (Postfix) with ESMTP id 49E3D6B006E for ; Wed, 7 Oct 2020 13:36:50 -0400 (EDT) Received: from smtpin07.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id DE725180AD811 for ; Wed, 7 Oct 2020 17:36:49 +0000 (UTC) X-FDA: 77345834538.07.twist49_020ce44271d1 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin07.hostedemail.com (Postfix) with ESMTP id C34601803F9A4 for ; Wed, 7 Oct 2020 17:36:49 +0000 (UTC) X-HE-Tag: twist49_020ce44271d1 X-Filterd-Recvd-Size: 6661 Received: from mail-qt1-f193.google.com (mail-qt1-f193.google.com [209.85.160.193]) by imf41.hostedemail.com (Postfix) with ESMTP for ; Wed, 7 Oct 2020 17:36:49 +0000 (UTC) Received: by mail-qt1-f193.google.com with SMTP id h12so1089459qtu.1 for ; Wed, 07 Oct 2020 10:36:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ziepe.ca; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:content-transfer-encoding:in-reply-to; bh=Ey3YmoFgPTHM+T5ZPwxICgQJ5vkBQ0KmdtsXuWxeC1c=; b=cJyTco0o/X8Gh9Q8b6BPp6IdcS7VSLvnWTh3xcYJUFHbyiLWErf+iW1RZDOm9F9oY9 /RwR5IXcdjrLUU0OXhaPFgLG8k7+Ef0dgsBndQomBoI20I5BBA+wnVg9YgfgY6tlExhJ GPN2ezDwTEsFX7Xe+3JJt1NoTy3V47hbuQQqb7ZxOE7Qs0x6JByqIFVEOs9dTvPQsYQc +nn+8vC8beQAGn1ifDdDcXjK9JilYqUSZdSn09CEzYb0FcsMaf0UaNceKgfHSfMJtgrO 99pbN8eZQwww8IKq9rj7gOuxBmgO7TGhqfnOfXjY30NDWc4Ox8v1+I3IrM8kLatmbFcA 5EaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:content-transfer-encoding :in-reply-to; bh=Ey3YmoFgPTHM+T5ZPwxICgQJ5vkBQ0KmdtsXuWxeC1c=; b=LP+8rojazjUkhlLfRfucEBKvYg+joG7E0+QO7Q806MkdhqGGho4j0tu5Gk3hqEtCCv 7gXeAW+zBi7ScbCYz/NIl2VuPfjMFifTsUYRktMQ4WbZbwyTvzRE7te21M1Pe9ArRYwz yPuo4/ymsodOzoRVslzBzSrN6C5eNeD8lDx7gHy3ZaK5yF01/BgGcTsOF2jDoJ3i27Zz +RUqtxC2LK6Wd6/VHfx9Q7a1ebld01jh1wzdquVfqhuy1MXJE1WJ7jDof9nNxoVeiBeT AbKbnq+tiqnHCiliOVeYTsJHIN7ZAL+2xBsClDKk3+hshezabXMrHtGWbMSeUo/TJepm VHvg== X-Gm-Message-State: AOAM530prYsUdNyh5vZbI25OTm6zhi25lyTsz01Sw9QytnybdY+ESNO8 gnBMoiT3afaNcxDV35uIHrNe4g== X-Google-Smtp-Source: ABdhPJzIdI5AjZ18wbqTXo1CaYgRr7q4X6KZ4wyL31oqNFbKIHXkxY8LKkchscJ9sXfgT8LuTH1iOw== X-Received: by 2002:ac8:33e8:: with SMTP id d37mr4225519qtb.310.1602092208628; Wed, 07 Oct 2020 10:36:48 -0700 (PDT) Received: from ziepe.ca (hlfxns017vw-156-34-48-30.dhcp-dynamic.fibreop.ns.bellaliant.net. [156.34.48.30]) by smtp.gmail.com with ESMTPSA id o4sm2006223qko.120.2020.10.07.10.36.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Oct 2020 10:36:47 -0700 (PDT) Received: from jgg by mlx with local (Exim 4.94) (envelope-from ) id 1kQDMt-00110d-DV; Wed, 07 Oct 2020 14:36:47 -0300 Date: Wed, 7 Oct 2020 14:36:47 -0300 From: Jason Gunthorpe To: Daniel Vetter Cc: DRI Development , LKML , kvm@vger.kernel.org, linux-mm@kvack.org, linux-arm-kernel@lists.infradead.org, linux-samsung-soc@vger.kernel.org, linux-media@vger.kernel.org, linux-s390@vger.kernel.org, Daniel Vetter , Kees Cook , Dan Williams , Andrew Morton , John Hubbard , =?utf-8?B?SsOpcsO0bWU=?= Glisse , Jan Kara Subject: Re: [PATCH 11/13] mm: add unsafe_follow_pfn Message-ID: <20201007173647.GW5177@ziepe.ca> References: <20201007164426.1812530-1-daniel.vetter@ffwll.ch> <20201007164426.1812530-12-daniel.vetter@ffwll.ch> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <20201007164426.1812530-12-daniel.vetter@ffwll.ch> Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Oct 07, 2020 at 06:44:24PM +0200, Daniel Vetter wrote: > Way back it was a reasonable assumptions that iomem mappings never > change the pfn range they point at. But this has changed: >=20 > - gpu drivers dynamically manage their memory nowadays, invalidating > ptes with unmap_mapping_range when buffers get moved >=20 > - contiguous dma allocations have moved from dedicated carvetouts to > cma regions. This means if we miss the unmap the pfn might contain > pagecache or anon memory (well anything allocated with GFP_MOVEABLE) >=20 > - even /dev/mem now invalidates mappings when the kernel requests that > iomem region when CONFIG_IO_STRICT_DEVMEM is set, see 3234ac664a87 > ("/dev/mem: Revoke mappings when a driver claims the region") >=20 > Accessing pfns obtained from ptes without holding all the locks is > therefore no longer a good idea. >=20 > Unfortunately there's some users where this is not fixable (like v4l > userptr of iomem mappings) or involves a pile of work (vfio type1 > iommu). For now annotate these as unsafe and splat appropriately. >=20 > This patch adds an unsafe_follow_pfn, which later patches will then > roll out to all appropriate places. >=20 > Signed-off-by: Daniel Vetter > Cc: Jason Gunthorpe > Cc: Kees Cook > Cc: Dan Williams > Cc: Andrew Morton > Cc: John Hubbard > Cc: J=C3=A9r=C3=B4me Glisse > Cc: Jan Kara > Cc: Dan Williams > Cc: linux-mm@kvack.org > Cc: linux-arm-kernel@lists.infradead.org > Cc: linux-samsung-soc@vger.kernel.org > Cc: linux-media@vger.kernel.org > Cc: kvm@vger.kernel.org > --- > include/linux/mm.h | 2 ++ > mm/memory.c | 32 +++++++++++++++++++++++++++++++- > mm/nommu.c | 17 +++++++++++++++++ > security/Kconfig | 13 +++++++++++++ > 4 files changed, 63 insertions(+), 1 deletion(-) Makes sense to me. I wonder if we could change the original follow_pfn to require the ptep and then lockdep_assert_held() it against the page table lock? > +int unsafe_follow_pfn(struct vm_area_struct *vma, unsigned long addres= s, > + unsigned long *pfn) > +{ > +#ifdef CONFIG_STRICT_FOLLOW_PFN > + pr_info("unsafe follow_pfn usage rejected, see > CONFIG_STRICT_FOLLOW_PFN\n"); Wonder if we can print something useful here, like the current PID/process name? > diff --git a/security/Kconfig b/security/Kconfig > index 7561f6f99f1d..48945402e103 100644 > --- a/security/Kconfig > +++ b/security/Kconfig > @@ -230,6 +230,19 @@ config STATIC_USERMODEHELPER_PATH > If you wish for all usermode helper programs to be disabled, > specify an empty string here (i.e. ""). > =20 > +config STRICT_FOLLOW_PFN > + bool "Disable unsafe use of follow_pfn" > + depends on MMU I would probably invert this CONFIG_ALLOW_UNSAFE_FOLLOW_PFN default n Jason