Re: [PATCH] x86/mm: Do not allow non-MAP_FIXED mapping across DEFAULT_MAP_WINDOW border

From: Thomas Gleixner <tglx@linutronix.de>
To: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
	Ingo Molnar <mingo@redhat.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	x86@kernel.org, "H. Peter Anvin" <hpa@zytor.com>,
	Andy Lutomirski <luto@amacapital.net>,
	Cyrill Gorcunov <gorcunov@openvz.org>,
	Nicholas Piggin <npiggin@gmail.com>,
	linux-mm@kvack.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] x86/mm: Do not allow non-MAP_FIXED mapping across DEFAULT_MAP_WINDOW border
Date: Mon, 13 Nov 2017 20:14:54 +0100 (CET)	[thread overview]
Message-ID: <alpine.DEB.2.20.1711132010470.2097@nanos> (raw)
In-Reply-To: <alpine.DEB.2.20.1711131754590.1851@nanos>

On Mon, 13 Nov 2017, Thomas Gleixner wrote:
> On Mon, 13 Nov 2017, Kirill A. Shutemov wrote:
> 
> > On Mon, Nov 13, 2017 at 04:43:26PM +0100, Thomas Gleixner wrote:
> > > On Tue, 7 Nov 2017, Kirill A. Shutemov wrote:
> > > 
> > > > In case of 5-level paging, we don't put any mapping above 47-bit, unless
> > > > userspace explicitly asked for it.
> > > > 
> > > > Userspace can ask for allocation from full address space by specifying
> > > > hint address above 47-bit.
> > > > 
> > > > Nicholas noticed that current implementation violates this interface:
> > > > we can get vma partly in high addresses if we ask for a mapping at very
> > > > end of 47-bit address space.
> > > > 
> > > > Let's make sure that, when consider hint address for non-MAP_FIXED
> > > > mapping, start and end of resulting vma are on the same side of 47-bit
> > > > border.
> > > 
> > > What happens for mappings with MAP_FIXED which cross the border?
> > 
> > It will succeed with 5-level paging.
> 
> And why is this allowed?
> 
> > It should be safe as with 4-level paging such request would fail and it's
> > reasonable to expect that userspace is not relying on the failure to
> > function properly.
> 
> Huch?
> 
> The first rule when looking at user space is that is broken or
> hostile. Reasonable and user space are mutually exclusive.

Aside of that in case of get_unmapped_area:

If va_unmapped_area() fails, then the address and the len which caused the
overlap check to trigger are handed in to arch_get_unmapped_area(), which
again can create an invalid mapping if I'm not missing something.

If mappings which overlap the boundary are invalid then we have to make
sure at all ends that they wont happen.

Thanks,

	tglx

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>