* [PATCH v2] mm/mprotect.c: don't imply PROT_EXEC on non-exec fs
[not found] <CALYGNiMKK4B_z+=CiMxoDmkYUZkayAhbg2dOOTi9-Bic+FEK2w@mail.gmail.com>
@ 2016-01-27 16:29 ` Piotr Kwapulinski
2016-02-26 20:20 ` Andrew Morton
0 siblings, 1 reply; 3+ messages in thread
From: Piotr Kwapulinski @ 2016-01-27 16:29 UTC (permalink / raw)
To: akpm
Cc: mgorman, kirill.shutemov, aneesh.kumar, gorcunov, aarcange,
koct9i, benh, linux-mm, linux-kernel, Piotr Kwapulinski
The mprotect(PROT_READ) fails when called by the READ_IMPLIES_EXEC binary
on a memory mapped file located on non-exec fs. The mprotect does not
check whether fs is _executable_ or not. The PROT_EXEC flag is set
automatically even if a memory mapped file is located on non-exec fs.
Fix it by checking whether a memory mapped file is located on a non-exec
fs. If so the PROT_EXEC is not implied by the PROT_READ.
The implementation uses the VM_MAYEXEC flag set properly in mmap.
Now it is consistent with mmap.
I did the isolated tests (PT_GNU_STACK X/NX, multiple VMAs, X/NX fs).
I also patched the official 3.19.0-47-generic Ubuntu 14.04 kernel
and it seems to work.
Signed-off-by: Piotr Kwapulinski <kwapulinski.piotr@gmail.com>
---
The difference between v1 is that the prot variable is reset to
reqprot for each loop iteration (thanks to Konstantin Khlebnikov for
pointing this out).
rier means "(current->personality & [R]EAD_[I]MPLIES_[E]XEC) &&
(prot & PROT_[R]EAD)".
mm/mprotect.c | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 8eb7bb4..1b9597f 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -352,10 +352,12 @@ fail:
SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
unsigned long, prot)
{
- unsigned long vm_flags, nstart, end, tmp, reqprot;
+ unsigned long nstart, end, tmp, reqprot;
struct vm_area_struct *vma, *prev;
int error = -EINVAL;
const int grows = prot & (PROT_GROWSDOWN|PROT_GROWSUP);
+ const bool rier = (current->personality & READ_IMPLIES_EXEC) &&
+ (prot & PROT_READ);
prot &= ~(PROT_GROWSDOWN|PROT_GROWSUP);
if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
return -EINVAL;
@@ -372,13 +374,6 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
return -EINVAL;
reqprot = prot;
- /*
- * Does the application expect PROT_READ to imply PROT_EXEC:
- */
- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
- prot |= PROT_EXEC;
-
- vm_flags = calc_vm_prot_bits(prot);
down_write(¤t->mm->mmap_sem);
@@ -412,7 +407,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
/* Here we know that vma->vm_start <= nstart < vma->vm_end. */
- newflags = vm_flags;
+ /* Does the application expect PROT_READ to imply PROT_EXEC */
+ if (rier && (vma->vm_flags & VM_MAYEXEC))
+ prot |= PROT_EXEC;
+
+ newflags = calc_vm_prot_bits(prot);
newflags |= (vma->vm_flags & ~(VM_READ | VM_WRITE | VM_EXEC));
/* newflags >> 4 shift VM_MAY% in place of VM_% */
@@ -443,6 +442,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
error = -ENOMEM;
goto out;
}
+ prot = reqprot;
}
out:
up_write(¤t->mm->mmap_sem);
--
2.7.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v2] mm/mprotect.c: don't imply PROT_EXEC on non-exec fs
2016-01-27 16:29 ` [PATCH v2] mm/mprotect.c: don't imply PROT_EXEC on non-exec fs Piotr Kwapulinski
@ 2016-02-26 20:20 ` Andrew Morton
2016-02-28 21:58 ` Piotr Kwapulinski
0 siblings, 1 reply; 3+ messages in thread
From: Andrew Morton @ 2016-02-26 20:20 UTC (permalink / raw)
To: Piotr Kwapulinski
Cc: mgorman, kirill.shutemov, aneesh.kumar, gorcunov, aarcange,
koct9i, benh, linux-mm, linux-kernel, Dave Hansen
On Wed, 27 Jan 2016 17:29:37 +0100 Piotr Kwapulinski <kwapulinski.piotr@gmail.com> wrote:
> The mprotect(PROT_READ) fails when called by the READ_IMPLIES_EXEC binary
> on a memory mapped file located on non-exec fs. The mprotect does not
> check whether fs is _executable_ or not. The PROT_EXEC flag is set
> automatically even if a memory mapped file is located on non-exec fs.
> Fix it by checking whether a memory mapped file is located on a non-exec
> fs. If so the PROT_EXEC is not implied by the PROT_READ.
> The implementation uses the VM_MAYEXEC flag set properly in mmap.
> Now it is consistent with mmap.
>
> I did the isolated tests (PT_GNU_STACK X/NX, multiple VMAs, X/NX fs).
> I also patched the official 3.19.0-47-generic Ubuntu 14.04 kernel
> and it seems to work.
sys_mprotect() just took a mangling in linux-next due to
commit 62b5f7d013fc455b8db26cf01e421f4c0d264b92
Author: Dave Hansen <dave.hansen@linux.intel.com>
AuthorDate: Fri Feb 12 13:02:40 2016 -0800
Commit: Ingo Molnar <mingo@kernel.org>
CommitDate: Thu Feb 18 19:46:33 2016 +0100
mm/core, x86/mm/pkeys: Add execute-only protection keys support
Here is my rework of your "mm/mprotect.c: don't imply PROT_EXEC on
non-exec fs" to handle this. Please check very carefully.
From: Piotr Kwapulinski <kwapulinski.piotr@gmail.com>
Subject: mm/mprotect.c: don't imply PROT_EXEC on non-exec fs
The mprotect(PROT_READ) fails when called by the READ_IMPLIES_EXEC binary
on a memory mapped file located on non-exec fs. The mprotect does not
check whether fs is _executable_ or not. The PROT_EXEC flag is set
automatically even if a memory mapped file is located on non-exec fs. Fix
it by checking whether a memory mapped file is located on a non-exec fs.
If so the PROT_EXEC is not implied by the PROT_READ. The implementation
uses the VM_MAYEXEC flag set properly in mmap. Now it is consistent with
mmap.
I did the isolated tests (PT_GNU_STACK X/NX, multiple VMAs, X/NX fs). I
also patched the official 3.19.0-47-generic Ubuntu 14.04 kernel and it
seems to work.
Signed-off-by: Piotr Kwapulinski <kwapulinski.piotr@gmail.com>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
mm/mprotect.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff -puN mm/mprotect.c~mm-mprotectc-dont-imply-prot_exec-on-non-exec-fs mm/mprotect.c
--- a/mm/mprotect.c~mm-mprotectc-dont-imply-prot_exec-on-non-exec-fs
+++ a/mm/mprotect.c
@@ -359,6 +359,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
struct vm_area_struct *vma, *prev;
int error = -EINVAL;
const int grows = prot & (PROT_GROWSDOWN|PROT_GROWSUP);
+ const bool rier = (current->personality & READ_IMPLIES_EXEC) &&
+ (prot & PROT_READ);
+
prot &= ~(PROT_GROWSDOWN|PROT_GROWSUP);
if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
return -EINVAL;
@@ -375,11 +378,6 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
return -EINVAL;
reqprot = prot;
- /*
- * Does the application expect PROT_READ to imply PROT_EXEC:
- */
- if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
- prot |= PROT_EXEC;
down_write(¤t->mm->mmap_sem);
@@ -414,6 +412,10 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
/* Here we know that vma->vm_start <= nstart < vma->vm_end. */
+ /* Does the application expect PROT_READ to imply PROT_EXEC */
+ if (rier && (vma->vm_flags & VM_MAYEXEC))
+ prot |= PROT_EXEC;
+
newflags = calc_vm_prot_bits(prot, pkey);
newflags |= (vma->vm_flags & ~(VM_READ | VM_WRITE | VM_EXEC));
@@ -445,6 +447,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
error = -ENOMEM;
goto out;
}
+ prot = reqprot;
}
out:
up_write(¤t->mm->mmap_sem);
_
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] mm/mprotect.c: don't imply PROT_EXEC on non-exec fs
2016-02-26 20:20 ` Andrew Morton
@ 2016-02-28 21:58 ` Piotr Kwapulinski
0 siblings, 0 replies; 3+ messages in thread
From: Piotr Kwapulinski @ 2016-02-28 21:58 UTC (permalink / raw)
To: Andrew Morton
Cc: mgorman, kirill.shutemov, aneesh.kumar, gorcunov, aarcange,
koct9i, benh, linux-mm, linux-kernel, Dave Hansen
On Fri, Feb 26, 2016 at 12:20:32PM -0800, Andrew Morton wrote:
> On Wed, 27 Jan 2016 17:29:37 +0100 Piotr Kwapulinski <kwapulinski.piotr@gmail.com> wrote:
>
> > The mprotect(PROT_READ) fails when called by the READ_IMPLIES_EXEC binary
> > on a memory mapped file located on non-exec fs. The mprotect does not
> > check whether fs is _executable_ or not. The PROT_EXEC flag is set
> > automatically even if a memory mapped file is located on non-exec fs.
> > Fix it by checking whether a memory mapped file is located on a non-exec
> > fs. If so the PROT_EXEC is not implied by the PROT_READ.
> > The implementation uses the VM_MAYEXEC flag set properly in mmap.
> > Now it is consistent with mmap.
> >
> > I did the isolated tests (PT_GNU_STACK X/NX, multiple VMAs, X/NX fs).
> > I also patched the official 3.19.0-47-generic Ubuntu 14.04 kernel
> > and it seems to work.
>
> sys_mprotect() just took a mangling in linux-next due to
>
> commit 62b5f7d013fc455b8db26cf01e421f4c0d264b92
> Author: Dave Hansen <dave.hansen@linux.intel.com>
> AuthorDate: Fri Feb 12 13:02:40 2016 -0800
> Commit: Ingo Molnar <mingo@kernel.org>
> CommitDate: Thu Feb 18 19:46:33 2016 +0100
>
> mm/core, x86/mm/pkeys: Add execute-only protection keys support
>
>
> Here is my rework of your "mm/mprotect.c: don't imply PROT_EXEC on
> non-exec fs" to handle this. Please check very carefully.
>
>
> From: Piotr Kwapulinski <kwapulinski.piotr@gmail.com>
> Subject: mm/mprotect.c: don't imply PROT_EXEC on non-exec fs
>
> The mprotect(PROT_READ) fails when called by the READ_IMPLIES_EXEC binary
> on a memory mapped file located on non-exec fs. The mprotect does not
> check whether fs is _executable_ or not. The PROT_EXEC flag is set
> automatically even if a memory mapped file is located on non-exec fs. Fix
> it by checking whether a memory mapped file is located on a non-exec fs.
> If so the PROT_EXEC is not implied by the PROT_READ. The implementation
> uses the VM_MAYEXEC flag set properly in mmap. Now it is consistent with
> mmap.
>
> I did the isolated tests (PT_GNU_STACK X/NX, multiple VMAs, X/NX fs). I
> also patched the official 3.19.0-47-generic Ubuntu 14.04 kernel and it
> seems to work.
>
> Signed-off-by: Piotr Kwapulinski <kwapulinski.piotr@gmail.com>
> Cc: Mel Gorman <mgorman@suse.de>
> Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
> Cc: Konstantin Khlebnikov <koct9i@gmail.com>
> Cc: Dan Williams <dan.j.williams@intel.com>
> Cc: Dave Hansen <dave.hansen@linux.intel.com>
> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
> ---
>
> mm/mprotect.c | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff -puN mm/mprotect.c~mm-mprotectc-dont-imply-prot_exec-on-non-exec-fs mm/mprotect.c
> --- a/mm/mprotect.c~mm-mprotectc-dont-imply-prot_exec-on-non-exec-fs
> +++ a/mm/mprotect.c
> @@ -359,6 +359,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
> struct vm_area_struct *vma, *prev;
> int error = -EINVAL;
> const int grows = prot & (PROT_GROWSDOWN|PROT_GROWSUP);
> + const bool rier = (current->personality & READ_IMPLIES_EXEC) &&
> + (prot & PROT_READ);
> +
> prot &= ~(PROT_GROWSDOWN|PROT_GROWSUP);
> if (grows == (PROT_GROWSDOWN|PROT_GROWSUP)) /* can't be both */
> return -EINVAL;
> @@ -375,11 +378,6 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
> return -EINVAL;
>
> reqprot = prot;
> - /*
> - * Does the application expect PROT_READ to imply PROT_EXEC:
> - */
> - if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
> - prot |= PROT_EXEC;
>
> down_write(¤t->mm->mmap_sem);
>
> @@ -414,6 +412,10 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
>
> /* Here we know that vma->vm_start <= nstart < vma->vm_end. */
>
> + /* Does the application expect PROT_READ to imply PROT_EXEC */
> + if (rier && (vma->vm_flags & VM_MAYEXEC))
> + prot |= PROT_EXEC;
> +
> newflags = calc_vm_prot_bits(prot, pkey);
> newflags |= (vma->vm_flags & ~(VM_READ | VM_WRITE | VM_EXEC));
>
> @@ -445,6 +447,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
> error = -ENOMEM;
> goto out;
> }
> + prot = reqprot;
> }
> out:
> up_write(¤t->mm->mmap_sem);
> _
>
It looks good. I also did some tests (non-MPK CPU) - passed.
Thank you.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-02-28 21:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <CALYGNiMKK4B_z+=CiMxoDmkYUZkayAhbg2dOOTi9-Bic+FEK2w@mail.gmail.com>
2016-01-27 16:29 ` [PATCH v2] mm/mprotect.c: don't imply PROT_EXEC on non-exec fs Piotr Kwapulinski
2016-02-26 20:20 ` Andrew Morton
2016-02-28 21:58 ` Piotr Kwapulinski
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).