linux-kernel - Re: [PATCH v2] /dev/mem: Revoke mappings when a driver claims the region

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 May 2020 11:27:02 -0700
From:   Dan Williams <dan.j.williams@...el.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     Arnd Bergmann <arnd@...db.de>, Ingo Molnar <mingo@...hat.com>,
        Kees Cook <keescook@...omium.org>,
        Russell King <linux@....linux.org.uk>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux MM <linux-mm@...ck.org>
Subject: Re: [PATCH v2] /dev/mem: Revoke mappings when a driver claims the region

On Tue, May 19, 2020 at 5:11 AM Greg KH <gregkh@...uxfoundation.org> wrote:
>
> On Tue, May 19, 2020 at 12:03:06AM -0700, Dan Williams wrote:
> > Close the hole of holding a mapping over kernel driver takeover event of
> > a given address range.
> >
> > Commit 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
> > introduced CONFIG_IO_STRICT_DEVMEM with the goal of protecting the
> > kernel against scenarios where a /dev/mem user tramples memory that a
> > kernel driver owns. However, this protection only prevents *new* read(),
> > write() and mmap() requests. Established mappings prior to the driver
> > calling request_mem_region() are left alone.
> >
> > Especially with persistent memory, and the core kernel metadata that is
> > stored there, there are plentiful scenarios for a /dev/mem user to
> > violate the expectations of the driver and cause amplified damage.
> >
> > Teach request_mem_region() to find and shoot down active /dev/mem
> > mappings that it believes it has successfully claimed for the exclusive
> > use of the driver. Effectively a driver call to request_mem_region()
> > becomes a hole-punch on the /dev/mem device.
> >
> > The typical usage of unmap_mapping_range() is part of
> > truncate_pagecache() to punch a hole in a file, but in this case the
> > implementation is only doing the "first half" of a hole punch. Namely it
> > is just evacuating current established mappings of the "hole", and it
> > relies on the fact that /dev/mem establishes mappings in terms of
> > absolute physical address offsets. Once existing mmap users are
> > invalidated they can attempt to re-establish the mapping, or attempt to
> > continue issuing read(2) / write(2) to the invalidated extent, but they
> > will then be subject to the CONFIG_IO_STRICT_DEVMEM checking that can
> > block those subsequent accesses.
> >
> > Cc: Arnd Bergmann <arnd@...db.de>
> > Cc: Ingo Molnar <mingo@...hat.com>
> > Cc: Kees Cook <keescook@...omium.org>
> > Cc: Russell King <linux@....linux.org.uk>
> > Cc: Andrew Morton <akpm@...ux-foundation.org>
> > Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> > Fixes: 90a545e98126 ("restrict /dev/mem to idle io memory ranges")
> > Signed-off-by: Dan Williams <dan.j.williams@...el.com>
> > ---
> > Changes since v1 [1]:
> >
> > - updated the changelog to describe the usage of unmap_mapping_range().
> >   No other logic changes:
> >
> > [1]: http://lore.kernel.org/r/158662721802.1893045.12301414116114602646.stgit@dwillia2-desk3.amr.corp.intel.com
> >
> > Greg, Andrew,
> >
> > I have a regression test for this case now. This was found by an
> > intermittent data corruption scenario on pmem from a test tool using
> > /dev/mem.
>
> Ick, why are test tools messing around in /dev/mem :)

Yeah, I'm all for useful tools, just not at the expense of kernel integrity.

> Anyway, this seems sane to me, want me to take it through my tree?

Yes please, seems to belong with the driver core.

Thanks!