linux-kernel - Re: [PATCHv3 3/6] x86/arch_prctl/vdso: add ARCH_MAP_VDSO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 31 Aug 2016 18:46:24 +0300
From:   Dmitry Safonov <dsafonov@...tuozzo.com>
To:     Andy Lutomirski <luto@...capital.net>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "Dmitry Safonov" <0x7f454c46@...il.com>,
        Andrew Lutomirski <luto@...nel.org>,
        "Oleg Nesterov" <oleg@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        "H. Peter Anvin" <hpa@...or.com>, Ingo Molnar <mingo@...hat.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>, X86 ML <x86@...nel.org>,
        Cyrill Gorcunov <gorcunov@...nvz.org>,
        Pavel Emelyanov <xemul@...tuozzo.com>
Subject: Re: [PATCHv3 3/6] x86/arch_prctl/vdso: add ARCH_MAP_VDSO_*

On 08/31/2016 06:42 PM, Andy Lutomirski wrote:
> On Wed, Aug 31, 2016 at 8:30 AM, Dmitry Safonov <dsafonov@...tuozzo.com> wrote:
>> On 08/31/2016 06:00 PM, Andy Lutomirski wrote:
>>>
>>> On Fri, Aug 26, 2016 at 10:13 AM, Dmitry Safonov <dsafonov@...tuozzo.com>
>>> wrote:
>>>>
>>>> Add API to change vdso blob type with arch_prctl.
>>>> As this is usefull only by needs of CRIU, expose
>>>> this interface under CONFIG_CHECKPOINT_RESTORE.
>>>>
>>>> Cc: Andy Lutomirski <luto@...nel.org>
>>>> Cc: Oleg Nesterov <oleg@...hat.com>
>>>> Cc: Thomas Gleixner <tglx@...utronix.de>
>>>> Cc: "H. Peter Anvin" <hpa@...or.com>
>>>> Cc: Ingo Molnar <mingo@...hat.com>
>>>> Cc: linux-mm@...ck.org
>>>> Cc: x86@...nel.org
>>>> Cc: Cyrill Gorcunov <gorcunov@...nvz.org>
>>>> Cc: Pavel Emelyanov <xemul@...tuozzo.com>
>>>> Signed-off-by: Dmitry Safonov <dsafonov@...tuozzo.com>
>>>> ---
>>>>  arch/x86/entry/vdso/vma.c         | 45
>>>> ++++++++++++++++++++++++++++++---------
>>>>  arch/x86/include/asm/vdso.h       |  2 ++
>>>>  arch/x86/include/uapi/asm/prctl.h |  6 ++++++
>>>>  arch/x86/kernel/process_64.c      | 25 ++++++++++++++++++++++
>>>>  4 files changed, 68 insertions(+), 10 deletions(-)
>>>>
>>>> diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c
>>>> index 5bcb25a9e573..dad2b2d8ff03 100644
>>>> --- a/arch/x86/entry/vdso/vma.c
>>>> +++ b/arch/x86/entry/vdso/vma.c
>>>> @@ -176,6 +176,16 @@ static int vvar_fault(const struct
>>>> vm_special_mapping *sm,
>>>>         return VM_FAULT_SIGBUS;
>>>>  }
>>>>
>>>> +static const struct vm_special_mapping vdso_mapping = {
>>>> +       .name = "[vdso]",
>>>> +       .fault = vdso_fault,
>>>> +       .mremap = vdso_mremap,
>>>> +};
>>>> +static const struct vm_special_mapping vvar_mapping = {
>>>> +       .name = "[vvar]",
>>>> +       .fault = vvar_fault,
>>>> +};
>>>> +
>>>>  /*
>>>>   * Add vdso and vvar mappings to current process.
>>>>   * @image          - blob to map
>>>> @@ -188,16 +198,6 @@ static int map_vdso(const struct vdso_image *image,
>>>> unsigned long addr)
>>>>         unsigned long text_start;
>>>>         int ret = 0;
>>>>
>>>> -       static const struct vm_special_mapping vdso_mapping = {
>>>> -               .name = "[vdso]",
>>>> -               .fault = vdso_fault,
>>>> -               .mremap = vdso_mremap,
>>>> -       };
>>>> -       static const struct vm_special_mapping vvar_mapping = {
>>>> -               .name = "[vvar]",
>>>> -               .fault = vvar_fault,
>>>> -       };
>>>> -
>>>>         if (down_write_killable(&mm->mmap_sem))
>>>>                 return -EINTR;
>>>>
>>>> @@ -256,6 +256,31 @@ static int map_vdso_randomized(const struct
>>>> vdso_image *image)
>>>>         return map_vdso(image, addr);
>>>>  }
>>>>
>>>> +int map_vdso_once(const struct vdso_image *image, unsigned long addr)
>>>> +{
>>>> +       struct mm_struct *mm = current->mm;
>>>> +       struct vm_area_struct *vma;
>>>> +
>>>> +       down_write(&mm->mmap_sem);
>>>> +       /*
>>>> +        * Check if we have already mapped vdso blob - fail to prevent
>>>> +        * abusing from userspace install_speciall_mapping, which may
>>>> +        * not do accounting and rlimit right.
>>>> +        * We could search vma near context.vdso, but it's a slowpath,
>>>> +        * so let's explicitely check all VMAs to be completely sure.
>>>> +        */
>>>> +       for (vma = mm->mmap; vma; vma = vma->vm_next) {
>>>> +               if (vma->vm_private_data == &vdso_mapping ||
>>>> +                               vma->vm_private_data == &vvar_mapping) {
>>>
>>>
>>> Should probably also check that vm_ops == &special_mapping_vmops,
>>> which means that maybe there should be a:
>>>
>>> static inline bool vma_is_special_mapping(const struct vm_area_struct
>>> *vma, const struct vm_special_mapping &sm);
>>
>>
>> Oh, I remember why I didn't do it also (except header changes):
>> uprobes uses &special_mapping_vmops in inserted XOL area.
>>
>
> That's fine.  I think you should check *both* vm_ops and
> vm_private_data to avoid (unlikely) confusion with some other VMA.

Oh, I thought you suggest to check either of them.
*Both* makes sence, since AFAIU, vm_private_data may be uninitialized on
other VMAs, will do.

-- 
              Dmitry