linux-kernel - Re: [PATCH] mm: mmap lock holding assertion on remap_pfn

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20220919135710.d52984bda33620f42d450010@linux-foundation.org>
Date:   Mon, 19 Sep 2022 13:57:10 -0700
From:   Andrew Morton <akpm@...ux-foundation.org>
To:     Dawei Li <set_pte_at@...look.com>
Cc:     hch@....de, linux-mm@...ck.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm: mmap lock holding assertion on remap_pfn_range

On Mon, 19 Sep 2022 23:47:32 +0800 Dawei Li <set_pte_at@...look.com> wrote:

> remap_pfn_range() creates/modifies the mapping between user virtual
> address and physical address, the caller of which must hold mmap
> writer lock to achieve access consistency of mapping.
> 
> The callers fall into categories below:
> 1) fops->mmap() implemented by driver
> For this case, mmap_lock has been taken externally, the rule holds true.
> 
> 2) Some arch codes do mapping on their own(vdso e.g.), rather than via
> fops->mmap().
> 
> 3) Some driver codes do mapping into user address space, for some
> reasons, the mapping is not implemented by fops->mmap().
> 
> For the last two cases, an explicit assertion must be made.

Why "must" it be made?  Are callers known to get this wrong?

> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -2551,6 +2551,11 @@ int remap_pfn_range(struct vm_area_struct *vma, unsigned long addr,
>  {
>  	int err;
>  
> +	if (!vma->vm_mm)
> +		return -EINVAL;

Can this happen?  If so, under what circumstances?

> +	mmap_assert_write_locked(vma->vm_mm);
> +
>  	err = track_pfn_remap(vma, &prot, pfn, addr, PAGE_ALIGN(size));
>  	if (err)
>  		return -EINVAL;
> -- 
> 2.25.1