From: Dmitry Safonov <dima@arista.com>
To: linux-kernel@vger.kernel.org
Cc: Dmitry Safonov <0x7f454c46@gmail.com>,
Dmitry Safonov <dima@arista.com>, Adrian Reber <adrian@lisas.de>,
Andrei Vagin <avagin@openvz.org>,
Andy Lutomirski <luto@kernel.org>, Arnd Bergmann <arnd@arndb.de>,
Christian Brauner <christian.brauner@ubuntu.com>,
Cyrill Gorcunov <gorcunov@openvz.org>,
"Eric W. Biederman" <ebiederm@xmission.com>,
"H. Peter Anvin" <hpa@zytor.com>, Ingo Molnar <mingo@redhat.com>,
Jann Horn <jannh@google.com>, Jeff Dike <jdike@addtoit.com>,
Oleg Nesterov <oleg@redhat.com>,
Pavel Emelyanov <xemul@virtuozzo.com>,
Shuah Khan <shuah@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Vincenzo Frascino <vincenzo.frascino@arm.com>,
containers@lists.linux-foundation.org, criu@openvz.org,
linux-api@vger.kernel.org, x86@kernel.org,
Andrei Vagin <avagin@gmail.com>
Subject: [PATCHv7 23/33] x86/vdso: Handle faults on timens page
Date: Fri, 11 Oct 2019 02:23:31 +0100 [thread overview]
Message-ID: <20191011012341.846266-24-dima@arista.com> (raw)
In-Reply-To: <20191011012341.846266-1-dima@arista.com>
If a task belongs to a time namespace then the VVAR page which contains
the system wide VDSO data is replaced with a namespace specific page
which has the same layout as the VVAR page.
Co-developed-by: Andrei Vagin <avagin@gmail.com>
Signed-off-by: Andrei Vagin <avagin@gmail.com>
Signed-off-by: Dmitry Safonov <dima@arista.com>
---
arch/x86/entry/vdso/vma.c | 53 +++++++++++++++++++++++++++++++++++++--
mm/mmap.c | 2 ++
2 files changed, 53 insertions(+), 2 deletions(-)
diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
index 5dab706aca2e..f6e13ab29d94 100644
--- a/arch/x86/entry/vdso/vma.c
+++ b/arch/x86/entry/vdso/vma.c
@@ -14,11 +14,13 @@
#include <linux/elf.h>
#include <linux/cpu.h>
#include <linux/ptrace.h>
+#include <linux/time_namespace.h>
#include <asm/pvclock.h>
#include <asm/vgtod.h>
#include <asm/proto.h>
#include <asm/vdso.h>
#include <asm/vvar.h>
+#include <asm/tlb.h>
#include <asm/page.h>
#include <asm/desc.h>
#include <asm/cpufeature.h>
@@ -107,10 +109,36 @@ static int vvar_mremap(const struct vm_special_mapping *sm,
return 0;
}
+#ifdef CONFIG_TIME_NS
+static struct page *find_timens_vvar_page(struct vm_area_struct *vma)
+{
+ if (likely(vma->vm_mm == current->mm))
+ return current->nsproxy->time_ns->vvar_page;
+
+ /*
+ * VM_PFNMAP | VM_IO protect .fault() handler from being called
+ * through interfaces like /proc/$pid/mem or
+ * process_vm_{readv,writev}() as long as there's no .access()
+ * in special_mapping_vmops().
+ * For more details check_vma_flags() and __access_remote_vm()
+ */
+
+ WARN(1, "vvar_page accessed remotely");
+
+ return NULL;
+}
+#else
+static inline struct page *find_timens_vvar_page(struct vm_area_struct *vma)
+{
+ return NULL;
+}
+#endif
+
static vm_fault_t vvar_fault(const struct vm_special_mapping *sm,
struct vm_area_struct *vma, struct vm_fault *vmf)
{
const struct vdso_image *image = vma->vm_mm->context.vdso_image;
+ unsigned long pfn;
long sym_offset;
if (!image)
@@ -130,8 +158,21 @@ static vm_fault_t vvar_fault(const struct vm_special_mapping *sm,
return VM_FAULT_SIGBUS;
if (sym_offset == image->sym_vvar_page) {
- return vmf_insert_pfn(vma, vmf->address,
- __pa_symbol(&__vvar_page) >> PAGE_SHIFT);
+ struct page *timens_page = find_timens_vvar_page(vma);
+
+ pfn = __pa_symbol(&__vvar_page) >> PAGE_SHIFT;
+
+ /*
+ * If a task belongs to a time namespace then a namespace
+ * specific VVAR is mapped with the sym_vvar_page offset and
+ * the real VVAR page is mapped with the sym_timens_page
+ * offset.
+ * See also the comment near timens_setup_vdso_data().
+ */
+ if (timens_page)
+ pfn = page_to_pfn(timens_page);
+
+ return vmf_insert_pfn(vma, vmf->address, pfn);
} else if (sym_offset == image->sym_pvclock_page) {
struct pvclock_vsyscall_time_info *pvti =
pvclock_get_pvti_cpu0_va();
@@ -146,6 +187,14 @@ static vm_fault_t vvar_fault(const struct vm_special_mapping *sm,
if (tsc_pg && vclock_was_used(VCLOCK_HVCLOCK))
return vmf_insert_pfn(vma, vmf->address,
virt_to_phys(tsc_pg) >> PAGE_SHIFT);
+ } else if (sym_offset == image->sym_timens_page) {
+ struct page *timens_page = find_timens_vvar_page(vma);
+
+ if (!timens_page)
+ return VM_FAULT_SIGBUS;
+
+ pfn = __pa_symbol(&__vvar_page) >> PAGE_SHIFT;
+ return vmf_insert_pfn(vma, vmf->address, pfn);
}
return VM_FAULT_SIGBUS;
diff --git a/mm/mmap.c b/mm/mmap.c
index a7d8c84d19b7..af722a47db3c 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -3363,6 +3363,8 @@ static const struct vm_operations_struct special_mapping_vmops = {
.fault = special_mapping_fault,
.mremap = special_mapping_mremap,
.name = special_mapping_name,
+ /* vDSO code relies that VVAR can't be accessed remotely */
+ .access = NULL,
};
static const struct vm_operations_struct legacy_special_mapping_vmops = {
--
2.23.0
next prev parent reply other threads:[~2019-10-11 1:24 UTC|newest]
Thread overview: 60+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-10-11 1:23 [PATCHv7 00/33] kernel: Introduce Time Namespace Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 01/33] ns: " Dmitry Safonov
2019-10-16 10:27 ` Vincenzo Frascino
2019-10-16 10:39 ` Thomas Gleixner
2019-10-16 10:44 ` Vincenzo Frascino
2019-10-16 13:57 ` Dmitry Safonov
2019-10-16 23:33 ` Andrei Vagin
2019-10-17 9:20 ` Thomas Gleixner
2019-10-17 9:47 ` Vincenzo Frascino
2019-10-17 9:23 ` Vincenzo Frascino
2019-10-11 1:23 ` [PATCHv7 02/33] time: Add timens_offsets to be used for tasks in timens Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 03/33] posix-clocks: Rename the clock_get() callback to clock_get_timespec() Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 04/33] posix-clocks: Rename .clock_get_timespec() callbacks accordingly Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 05/33] alarmtimer: Rename gettime() callback to get_ktime() Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 06/33] alarmtimer: Provide get_timespec() callback Dmitry Safonov
2019-10-14 0:36 ` kbuild test robot
2019-10-11 1:23 ` [PATCHv7 07/33] posix-clocks: Introduce clock_get_ktime() callback Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 08/33] posix-timers: Use clock_get_ktime() in common_timer_get() Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 09/33] posix-clocks: Wire up clock_gettime() with timens offsets Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 10/33] kernel: Add do_timens_ktime_to_host() helper Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 11/33] timerfd: Make timerfd_settime() time namespace aware Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 12/33] posix-timers: Make timer_settime() " Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 13/33] alarmtimer: Make nanosleep " Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 14/33] hrtimers: Prepare hrtimer_nanosleep() for time namespaces Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 15/33] posix-timers: Make clock_nanosleep() time namespace aware Dmitry Safonov
2019-10-14 0:50 ` kbuild test robot
2019-10-14 4:10 ` kbuild test robot
2019-10-14 19:58 ` Andrey Vagin
2019-10-11 1:23 ` [PATCHv7 16/33] fs/proc: Respect boottime inside time namespace for /proc/uptime Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 17/33] x86/vdso: Restrict splitting VVAR VMA Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 18/33] lib/vdso: Add unlikely() hint into vdso_read_begin() Dmitry Safonov
2019-10-16 11:24 ` Vincenzo Frascino
2019-10-24 6:13 ` Andrei Vagin
2019-10-24 9:30 ` Vincenzo Frascino
2019-10-24 13:14 ` Vincenzo Frascino
2019-10-11 1:23 ` [PATCHv7 19/33] lib/vdso: Prepare for time namespace support Dmitry Safonov
2019-10-16 14:37 ` Vincenzo Frascino
2019-10-16 15:07 ` Thomas Gleixner
2019-10-16 16:36 ` Vincenzo Frascino
2019-10-11 1:23 ` [PATCHv7 20/33] x86/vdso: Provide vdso_data offset on vvar_page Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 21/33] x86/vdso: Add timens page Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 22/33] time: Allocate per-timens vvar page Dmitry Safonov
2019-10-14 2:22 ` kbuild test robot
2019-10-14 2:34 ` kbuild test robot
2019-10-11 1:23 ` Dmitry Safonov [this message]
2019-10-11 1:23 ` [PATCHv7 24/33] x86/vdso: On timens page fault prefault also VVAR page Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 25/33] x86/vdso: Zap vvar pages on switch a time namspace Dmitry Safonov
2019-10-14 2:47 ` kbuild test robot
2019-10-14 3:11 ` kbuild test robot
2019-10-11 1:23 ` [PATCHv7 26/33] fs/proc: Introduce /proc/pid/timens_offsets Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 27/33] selftests/timens: Add Time Namespace test for supported clocks Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 28/33] selftests/timens: Add a test for timerfd Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 29/33] selftests/timens: Add a test for clock_nanosleep() Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 30/33] selftests/timens: Add procfs selftest Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 31/33] selftests/timens: Add timer offsets test Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 32/33] selftests/timens: Add a simple perf test for clock_gettime() Dmitry Safonov
2019-10-11 1:23 ` [PATCHv7 33/33] selftests/timens: Check for right timens offsets after fork and exec Dmitry Safonov
2019-10-17 9:24 ` [PATCHv7 00/33] kernel: Introduce Time Namespace Thomas Gleixner
2019-10-17 23:47 ` Andrei Vagin
2019-10-22 8:45 ` Andrei Vagin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191011012341.846266-24-dima@arista.com \
--to=dima@arista.com \
--cc=0x7f454c46@gmail.com \
--cc=adrian@lisas.de \
--cc=arnd@arndb.de \
--cc=avagin@gmail.com \
--cc=avagin@openvz.org \
--cc=christian.brauner@ubuntu.com \
--cc=containers@lists.linux-foundation.org \
--cc=criu@openvz.org \
--cc=ebiederm@xmission.com \
--cc=gorcunov@openvz.org \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=jdike@addtoit.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=oleg@redhat.com \
--cc=shuah@kernel.org \
--cc=tglx@linutronix.de \
--cc=vincenzo.frascino@arm.com \
--cc=x86@kernel.org \
--cc=xemul@virtuozzo.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).