linux-kernel - Re: [PATCH 11/13] mm: add unsafe_follow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201007190023.GA5177@ziepe.ca>
Date:   Wed, 7 Oct 2020 16:00:23 -0300
From:   Jason Gunthorpe <jgg@...pe.ca>
To:     Daniel Vetter <daniel.vetter@...ll.ch>
Cc:     DRI Development <dri-devel@...ts.freedesktop.org>,
        LKML <linux-kernel@...r.kernel.org>, kvm@...r.kernel.org,
        Linux MM <linux-mm@...ck.org>,
        Linux ARM <linux-arm-kernel@...ts.infradead.org>,
        linux-samsung-soc <linux-samsung-soc@...r.kernel.org>,
        "open list:DMA BUFFER SHARING FRAMEWORK" 
        <linux-media@...r.kernel.org>, linux-s390@...r.kernel.org,
        Daniel Vetter <daniel.vetter@...el.com>,
        Kees Cook <keescook@...omium.org>,
        Dan Williams <dan.j.williams@...el.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        John Hubbard <jhubbard@...dia.com>,
        Jérôme Glisse <jglisse@...hat.com>,
        Jan Kara <jack@...e.cz>
Subject: Re: [PATCH 11/13] mm: add unsafe_follow_pfn

On Wed, Oct 07, 2020 at 08:10:34PM +0200, Daniel Vetter wrote:
> On Wed, Oct 7, 2020 at 7:36 PM Jason Gunthorpe <jgg@...pe.ca> wrote:
> >
> > On Wed, Oct 07, 2020 at 06:44:24PM +0200, Daniel Vetter wrote:
> > > Way back it was a reasonable assumptions that iomem mappings never
> > > change the pfn range they point at. But this has changed:
> > >
> > > - gpu drivers dynamically manage their memory nowadays, invalidating
> > > ptes with unmap_mapping_range when buffers get moved
> > >
> > > - contiguous dma allocations have moved from dedicated carvetouts to
> > > cma regions. This means if we miss the unmap the pfn might contain
> > > pagecache or anon memory (well anything allocated with GFP_MOVEABLE)
> > >
> > > - even /dev/mem now invalidates mappings when the kernel requests that
> > > iomem region when CONFIG_IO_STRICT_DEVMEM is set, see 3234ac664a87
> > > ("/dev/mem: Revoke mappings when a driver claims the region")
> > >
> > > Accessing pfns obtained from ptes without holding all the locks is
> > > therefore no longer a good idea.
> > >
> > > Unfortunately there's some users where this is not fixable (like v4l
> > > userptr of iomem mappings) or involves a pile of work (vfio type1
> > > iommu). For now annotate these as unsafe and splat appropriately.
> > >
> > > This patch adds an unsafe_follow_pfn, which later patches will then
> > > roll out to all appropriate places.
> > >
> > > Signed-off-by: Daniel Vetter <daniel.vetter@...el.com>
> > > Cc: Jason Gunthorpe <jgg@...pe.ca>
> > > Cc: Kees Cook <keescook@...omium.org>
> > > Cc: Dan Williams <dan.j.williams@...el.com>
> > > Cc: Andrew Morton <akpm@...ux-foundation.org>
> > > Cc: John Hubbard <jhubbard@...dia.com>
> > > Cc: Jérôme Glisse <jglisse@...hat.com>
> > > Cc: Jan Kara <jack@...e.cz>
> > > Cc: Dan Williams <dan.j.williams@...el.com>
> > > Cc: linux-mm@...ck.org
> > > Cc: linux-arm-kernel@...ts.infradead.org
> > > Cc: linux-samsung-soc@...r.kernel.org
> > > Cc: linux-media@...r.kernel.org
> > > Cc: kvm@...r.kernel.org
> > >  include/linux/mm.h |  2 ++
> > >  mm/memory.c        | 32 +++++++++++++++++++++++++++++++-
> > >  mm/nommu.c         | 17 +++++++++++++++++
> > >  security/Kconfig   | 13 +++++++++++++
> > >  4 files changed, 63 insertions(+), 1 deletion(-)
> >
> > Makes sense to me.
> >
> > I wonder if we could change the original follow_pfn to require the
> > ptep and then lockdep_assert_held() it against the page table lock?
> 
> The safe variant with the pagetable lock is follow_pte_pmd. The only
> way to make follow_pfn safe is if you have an mmu notifier and
> corresponding retry logic. That is not covered by lockdep (it would
> splat if we annotate the retry side), so I'm not sure how you'd check
> for that?

Right OK.

> Checking for ptep lock doesn't work here, since the one leftover safe
> user of this (kvm) doesn't need that at all, because it has the mmu
> notifier.

Ah, so a better name and/or function kdoc for follow_pfn is probably a
good iead in this patch as well.

> So I think we're as good as it gets, since I really have no idea how
> to make sure follow_pfn callers do have an mmu notifier registered.

Yah, can't be done. Most mmu notifier users should be using
hmm_range_fault anyhow, kvm is really very special here.
 
> I've followed the few other CONFIG_STRICT_FOO I've seen, which are all
> explicit enables and default to "do not break uapi, damn the
> (security) bugs". Which is I think how this should be done. It is in
> the security section though, so hopefully competent distros will
> enable this all.

I thought the strict ones were more general and less clear security
worries, not bugs like this.

This is "allow a user triggerable use after free bug to exist in the
kernel"

Jason