lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 19 Nov 2020 19:09:34 -0800 From: Lokesh Gidra <lokeshgidra@...gle.com> To: Kees Cook <keescook@...omium.org>, Jonathan Corbet <corbet@....net>, Peter Xu <peterx@...hat.com>, Andrea Arcangeli <aarcange@...hat.com>, Sebastian Andrzej Siewior <bigeasy@...utronix.de>, Andrew Morton <akpm@...ux-foundation.org> Cc: Alexander Viro <viro@...iv.linux.org.uk>, Stephen Smalley <stephen.smalley.work@...il.com>, Eric Biggers <ebiggers@...nel.org>, Daniel Colascione <dancol@...col.org>, "Joel Fernandes (Google)" <joel@...lfernandes.org>, Linux FS Devel <linux-fsdevel@...r.kernel.org>, linux-kernel <linux-kernel@...r.kernel.org>, linux-doc@...r.kernel.org, Kalesh Singh <kaleshsingh@...gle.com>, Calin Juravle <calin@...gle.com>, Suren Baghdasaryan <surenb@...gle.com>, Jeffrey Vander Stoep <jeffv@...gle.com>, "Cc: Android Kernel" <kernel-team@...roid.com>, Mike Rapoport <rppt@...ux.vnet.ibm.com>, Shaohua Li <shli@...com>, Jerome Glisse <jglisse@...hat.com>, Mauro Carvalho Chehab <mchehab+huawei@...nel.org>, Johannes Weiner <hannes@...xchg.org>, Mel Gorman <mgorman@...hsingularity.net>, Nitin Gupta <nigupta@...dia.com>, Vlastimil Babka <vbabka@...e.cz>, Iurii Zaikin <yzaikin@...gle.com>, Luis Chamberlain <mcgrof@...nel.org>, "open list:MEMORY MANAGEMENT" <linux-mm@...ck.org> Subject: Re: [PATCH v6 1/2] Add UFFD_USER_MODE_ONLY On Thu, Nov 19, 2020 at 7:04 PM Lokesh Gidra <lokeshgidra@...gle.com> wrote: > > userfaultfd handles page faults from both user and kernel code. > Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes > the resulting userfaultfd object refuse to handle faults from kernel > mode, treating these faults as if SIGBUS were always raised, causing > the kernel code to fail with EFAULT. > > A future patch adds a knob allowing administrators to give some > processes the ability to create userfaultfd file objects only if they > pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes > will exploit userfaultfd's ability to delay kernel page faults to open > timing windows for future exploits. > > Signed-off-by: Daniel Colascione <dancol@...gle.com> > Signed-off-by: Lokesh Gidra <lokeshgidra@...gle.com> > Reviewed-by: Andrea Arcangeli <aarcange@...hat.com> > --- > fs/userfaultfd.c | 10 +++++++++- > include/uapi/linux/userfaultfd.h | 9 +++++++++ > 2 files changed, 18 insertions(+), 1 deletion(-) > > diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c > index 000b457ad087..605599fde015 100644 > --- a/fs/userfaultfd.c > +++ b/fs/userfaultfd.c > @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason) > > if (ctx->features & UFFD_FEATURE_SIGBUS) > goto out; > + if ((vmf->flags & FAULT_FLAG_USER) == 0 && > + ctx->flags & UFFD_USER_MODE_ONLY) { > + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd " > + "sysctl knob to 1 if kernel faults must be handled " > + "without obtaining CAP_SYS_PTRACE capability\n"); > + goto out; > + } > > /* > * If it's already released don't get it. This avoids to loop > @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags) > BUG_ON(!current->mm); > > /* Check the UFFD_* constants for consistency. */ > + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS); > BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC); > BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK); > > - if (flags & ~UFFD_SHARED_FCNTL_FLAGS) > + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY)) > return -EINVAL; > > ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL); > diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h > index e7e98bde221f..5f2d88212f7c 100644 > --- a/include/uapi/linux/userfaultfd.h > +++ b/include/uapi/linux/userfaultfd.h > @@ -257,4 +257,13 @@ struct uffdio_writeprotect { > __u64 mode; > }; > > +/* > + * Flags for the userfaultfd(2) system call itself. > + */ > + > +/* > + * Create a userfaultfd that can handle page faults only in user mode. > + */ > +#define UFFD_USER_MODE_ONLY 1 > + > #endif /* _LINUX_USERFAULTFD_H */ > -- > 2.29.0.rc1.297.gfa9743e501-goog > Adding linux-mm@...ck.org mailing list
Powered by blists - more mailing lists