From: Jann Horn <jannh@google.com>
To: Andrew Morton <akpm@linux-foundation.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>,
Christoph Hellwig <hch@lst.de>,
linux-kernel@vger.kernel.org, linux-mm@kvack.org,
linux-fsdevel@vger.kernel.org,
Alexander Viro <viro@zeniv.linux.org.uk>,
"Eric W . Biederman" <ebiederm@xmission.com>,
Oleg Nesterov <oleg@redhat.com>
Subject: [PATCH v3 0/5] Fix ELF / FDPIC ELF core dumping, and use mmap_lock properly in there
Date: Tue, 18 Aug 2020 08:12:34 +0200 [thread overview]
Message-ID: <20200818061239.29091-1-jannh@google.com> (raw)
At the moment, we have that rather ugly mmget_still_valid() helper to
work around <https://crbug.com/project-zero/1790>: ELF core dumping
doesn't take the mmap_sem while traversing the task's VMAs, and if
anything (like userfaultfd) then remotely messes with the VMA tree,
fireworks ensue. So at the moment we use mmget_still_valid() to bail
out in any writers that might be operating on a remote mm's VMAs.
With this series, I'm trying to get rid of the need for that as
cleanly as possible. ("cleanly" meaning "avoid holding the mmap_lock
across unbounded sleeps".)
Patches 1, 2 and 3 are relatively unrelated cleanups in the core
dumping code.
Patches 4 and 5 implement the main change: Instead of repeatedly
accessing the VMA list with sleeps in between, we snapshot it at the
start with proper locking, and then later we just use our copy of
the VMA list. This ensures that the kernel won't crash, that VMA
metadata in the coredump is consistent even in the presence of
concurrent modifications, and that any virtual addresses that aren't
being concurrently modified have their contents show up in the core
dump properly.
The disadvantage of this approach is that we need a bit more memory
during core dumping for storing metadata about all VMAs.
After this series has landed, we should be able to rip out
mmget_still_valid().
I have tested:
- Creating a simple core dump on X86-64 still works.
- The created coredump on X86-64 opens in GDB and looks plausible.
- NOMMU 32-bit ARM can still generate plausible-looking core dumps
through the FDPIC implementation. (I can't test this with GDB because
GDB is missing some structure definition for nommu ARM, but I've
poked around in the hexdump and it looked decent.)
Jann Horn (5):
binfmt_elf_fdpic: Stop using dump_emit() on user pointers on !MMU
coredump: Let dump_emit() bail out on short writes
coredump: Refactor page range dumping into common helper
binfmt_elf, binfmt_elf_fdpic: Use a VMA list snapshot
mm/gup: Take mmap_lock in get_dump_page()
fs/binfmt_elf.c | 184 ++++++++++++++-------------------------
fs/binfmt_elf_fdpic.c | 106 +++++++++-------------
fs/coredump.c | 125 +++++++++++++++++++++++---
include/linux/coredump.h | 11 +++
mm/gup.c | 61 +++++++------
5 files changed, 265 insertions(+), 222 deletions(-)
base-commit: 06a4ec1d9dc652e17ee3ac2ceb6c7cf6c2b75cdd
--
2.28.0.220.ged08abb693-goog
next reply other threads:[~2020-08-18 6:12 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-18 6:12 Jann Horn [this message]
2020-08-18 6:12 ` [PATCH v3 1/5] binfmt_elf_fdpic: Stop using dump_emit() on user pointers on !MMU Jann Horn
2020-08-18 6:12 ` [PATCH v3 2/5] coredump: Let dump_emit() bail out on short writes Jann Horn
2020-08-18 13:40 ` Oleg Nesterov
2020-08-18 15:08 ` Jann Horn
2020-08-18 15:17 ` Al Viro
2020-08-18 6:12 ` [PATCH v3 3/5] coredump: Refactor page range dumping into common helper Jann Horn
2020-08-18 6:12 ` [PATCH v3 4/5] binfmt_elf, binfmt_elf_fdpic: Use a VMA list snapshot Jann Horn
2020-08-18 8:18 ` Linus Torvalds
2020-08-18 8:31 ` Jann Horn
2020-08-18 6:12 ` [PATCH v3 5/5] mm/gup: Take mmap_lock in get_dump_page() Jann Horn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200818061239.29091-1-jannh@google.com \
--to=jannh@google.com \
--cc=akpm@linux-foundation.org \
--cc=ebiederm@xmission.com \
--cc=hch@lst.de \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=oleg@redhat.com \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).