| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CALCETrXYrphfSZN9sWbqaksi=fHgZ5P8gptvv-soeFekSeqZ_w@mail.gmail.com>
Date: Thu, 21 Apr 2016 12:52:01 -0700
From: Andy Lutomirski <luto@...capital.net>
To: Dmitry Safonov <dsafonov@...tuozzo.com>
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>,
"H. Peter Anvin" <hpa@...or.com>, X86 ML <x86@...nel.org>,
Andrew Morton <akpm@...ux-foundation.org>,
"linux-mm@...ck.org" <linux-mm@...ck.org>,
Dmitry Safonov <0x7f454c46@...il.com>
Subject: Re: [PATCHv7 2/3] x86/vdso: add mremap hook to vm_special_mapping
On Mon, Apr 18, 2016 at 7:23 AM, Dmitry Safonov <dsafonov@...tuozzo.com> wrote:
> Add possibility for userspace 32-bit applications to move
> vdso mapping. Previously, when userspace app called
> mremap for vdso, in return path it would land on previous
> address of vdso page, resulting in segmentation violation.
> Now it lands fine and returns to userspace with remapped vdso.
> This will also fix context.vdso pointer for 64-bit, which does not
> affect the user of vdso after mremap by now, but this may change.
>
> As suggested by Andy, return EINVAL for mremap that splits vdso image.
>
> Renamed and moved text_mapping structure declaration inside
> map_vdso, as it used only there and now it complement
> vvar_mapping variable.
>
> There is still problem for remapping vdso in glibc applications:
> linker relocates addresses for syscalls on vdso page, so
> you need to relink with the new addresses. Or the next syscall
> through glibc may fail:
> Program received signal SIGSEGV, Segmentation fault.
> #0 0xf7fd9b80 in __kernel_vsyscall ()
> #1 0xf7ec8238 in _exit () from /usr/lib32/libc.so.6
>
> Signed-off-by: Dmitry Safonov <dsafonov@...tuozzo.com>
> ---
> v7: that's just not my day: add new_vma parameter to vdso_fix_landing
> sorry for the noise
> v6: moved vdso_image_32 check and fixup code into vdso_fix_landing function
> with ifdefs around
> v5: as Andy suggested, add a check that new_vma->vm_mm and current->mm are
> the same, also check not only in_ia32_syscall() but image == &vdso_image_32
> v4: drop __maybe_unused & use image from mm->context instead vdso_image_32
> v3: as Andy suggested, return EINVAL in case of splitting vdso blob on mremap;
> used is_ia32_task instead of ifdefs
> v2: added __maybe_unused for pt_regs in vdso_mremap
>
> arch/x86/entry/vdso/vma.c | 50 ++++++++++++++++++++++++++++++++++++++++++-----
> include/linux/mm_types.h | 3 +++
> mm/mmap.c | 10 ++++++++++
> 3 files changed, 58 insertions(+), 5 deletions(-)
>
> diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
> index 10f704584922..d94291a19b6e 100644
> --- a/arch/x86/entry/vdso/vma.c
> +++ b/arch/x86/entry/vdso/vma.c
> @@ -12,6 +12,7 @@
> #include <linux/random.h>
> #include <linux/elf.h>
> #include <linux/cpu.h>
> +#include <linux/ptrace.h>
> #include <asm/pvclock.h>
> #include <asm/vgtod.h>
> #include <asm/proto.h>
> @@ -98,10 +99,43 @@ static int vdso_fault(const struct vm_special_mapping *sm,
> return 0;
> }
>
> -static const struct vm_special_mapping text_mapping = {
> - .name = "[vdso]",
> - .fault = vdso_fault,
> -};
> +#if defined CONFIG_X86_32 || defined CONFIG_COMPAT
I think you mean defined(CONFIG_IA32_EMULATION). IIRC CONFIG_COMPAT
is set for X32, !IA32 kernels, too.
> +static void vdso_fix_landing(const struct vdso_image *image,
> + struct vm_area_struct *new_vma)
> +{
> + if (in_ia32_syscall() && image == &vdso_image_32) {
> + struct pt_regs *regs = current_pt_regs();
> + unsigned long vdso_land = image->sym_int80_landing_pad;
> + unsigned long old_land_addr = vdso_land +
> + (unsigned long)current->mm->context.vdso;
> +
> + /* Fixing userspace landing - look at do_fast_syscall_32 */
> + if (regs->ip == old_land_addr)
> + regs->ip = new_vma->vm_start + vdso_land;
> + }
> +}
> +#else
> +static void vdso_fix_landing(const struct vdso_image *image,
> + struct vm_area_struct *new_vma) {}
> +#endif
You could also define the function regardless and simply ifdef out the
body, thus saving a few lines of code.
> +
> +static int vdso_mremap(const struct vm_special_mapping *sm,
> + struct vm_area_struct *new_vma)
> +{
> + unsigned long new_size = new_vma->vm_end - new_vma->vm_start;
> + const struct vdso_image *image = current->mm->context.vdso_image;
> +
> + if (image->size != new_size)
> + return -EINVAL;
> +
> + if (current->mm != new_vma->vm_mm)
> + return -EFAULT;
Can you make that if (WARN_ON_ONCE(current->mm != new_vma->vm_mm))?
It should be impossible.
> +
> + vdso_fix_landing(image, new_vma);
> + current->mm->context.vdso = (void __user *)new_vma->vm_start;
> +
> + return 0;
> +}
>
> static int vvar_fault(const struct vm_special_mapping *sm,
> struct vm_area_struct *vma, struct vm_fault *vmf)
> @@ -162,6 +196,12 @@ static int map_vdso(const struct vdso_image *image, bool calculate_addr)
> struct vm_area_struct *vma;
> unsigned long addr, text_start;
> int ret = 0;
> +
> + static const struct vm_special_mapping vdso_mapping = {
> + .name = "[vdso]",
> + .fault = vdso_fault,
> + .mremap = vdso_mremap,
> + };
> static const struct vm_special_mapping vvar_mapping = {
> .name = "[vvar]",
> .fault = vvar_fault,
> @@ -195,7 +235,7 @@ static int map_vdso(const struct vdso_image *image, bool calculate_addr)
> image->size,
> VM_READ|VM_EXEC|
> VM_MAYREAD|VM_MAYWRITE|VM_MAYEXEC,
> - &text_mapping);
> + &vdso_mapping);
>
> if (IS_ERR(vma)) {
> ret = PTR_ERR(vma);
> diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
> index c2d75b4fa86c..4d16ab9287af 100644
> --- a/include/linux/mm_types.h
> +++ b/include/linux/mm_types.h
> @@ -586,6 +586,9 @@ struct vm_special_mapping {
> int (*fault)(const struct vm_special_mapping *sm,
> struct vm_area_struct *vma,
> struct vm_fault *vmf);
> +
> + int (*mremap)(const struct vm_special_mapping *sm,
> + struct vm_area_struct *new_vma);
> };
>
> enum tlb_flush_reason {
> diff --git a/mm/mmap.c b/mm/mmap.c
> index bd2e1a533bc1..ba71658dd1a1 100644
> --- a/mm/mmap.c
> +++ b/mm/mmap.c
> @@ -2930,9 +2930,19 @@ static const char *special_mapping_name(struct vm_area_struct *vma)
> return ((struct vm_special_mapping *)vma->vm_private_data)->name;
> }
>
> +static int special_mapping_mremap(struct vm_area_struct *new_vma)
> +{
> + struct vm_special_mapping *sm = new_vma->vm_private_data;
> +
> + if (sm->mremap)
> + return sm->mremap(sm, new_vma);
> + return 0;
> +}
> +
> static const struct vm_operations_struct special_mapping_vmops = {
> .close = special_mapping_close,
> .fault = special_mapping_fault,
> + .mremap = special_mapping_mremap,
> .name = special_mapping_name,
> };
>
> --
> 2.8.0
>
--
Andy Lutomirski
AMA Capital Management, LLC
Powered by blists - more mailing lists