| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20240123231014.3801041-1-surenb@google.com>
Date: Tue, 23 Jan 2024 15:10:12 -0800
From: Suren Baghdasaryan <surenb@...gle.com>
To: akpm@...ux-foundation.org
Cc: viro@...iv.linux.org.uk, brauner@...nel.org, jack@...e.cz,
dchinner@...hat.com, casey@...aufler-ca.com, ben.wolsieffer@...ring.com,
paulmck@...nel.org, david@...hat.com, avagin@...gle.com,
usama.anjum@...labora.com, peterx@...hat.com, hughd@...gle.com,
ryan.roberts@....com, wangkefeng.wang@...wei.com, Liam.Howlett@...cle.com,
yuzhao@...gle.com, axelrasmussen@...gle.com, lstoakes@...il.com,
talumbau@...gle.com, willy@...radead.org, vbabka@...e.cz,
mgorman@...hsingularity.net, jhubbard@...dia.com, vishal.moola@...il.com,
mathieu.desnoyers@...icios.com, dhowells@...hat.com, jgg@...pe.ca,
sidhartha.kumar@...cle.com, andriy.shevchenko@...ux.intel.com,
yangxingui@...wei.com, keescook@...omium.org, sj@...nel.org,
linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
linux-mm@...ck.org, kernel-team@...roid.com, surenb@...gle.com
Subject: [PATCH v2 1/3] mm: make vm_area_struct anon_name field RCU-safe
For lockless /proc/pid/maps reading we have to ensure all the fields
used when generating the output are RCU-safe. The only pointer fields
in vm_area_struct which are used to generate that file's output are
vm_file and anon_name. vm_file is RCU-safe but anon_name is not. Make
anon_name RCU-safe as well.
Signed-off-by: Suren Baghdasaryan <surenb@...gle.com>
---
include/linux/mm_inline.h | 10 +++++++++-
include/linux/mm_types.h | 3 ++-
mm/madvise.c | 30 ++++++++++++++++++++++++++----
3 files changed, 37 insertions(+), 6 deletions(-)
diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h
index f4fe593c1400..bbdb0ca857f1 100644
--- a/include/linux/mm_inline.h
+++ b/include/linux/mm_inline.h
@@ -389,7 +389,7 @@ static inline void dup_anon_vma_name(struct vm_area_struct *orig_vma,
struct anon_vma_name *anon_name = anon_vma_name(orig_vma);
if (anon_name)
- new_vma->anon_name = anon_vma_name_reuse(anon_name);
+ rcu_assign_pointer(new_vma->anon_name, anon_vma_name_reuse(anon_name));
}
static inline void free_anon_vma_name(struct vm_area_struct *vma)
@@ -411,6 +411,8 @@ static inline bool anon_vma_name_eq(struct anon_vma_name *anon_name1,
!strcmp(anon_name1->name, anon_name2->name);
}
+struct anon_vma_name *anon_vma_name_get_rcu(struct vm_area_struct *vma);
+
#else /* CONFIG_ANON_VMA_NAME */
static inline void anon_vma_name_get(struct anon_vma_name *anon_name) {}
static inline void anon_vma_name_put(struct anon_vma_name *anon_name) {}
@@ -424,6 +426,12 @@ static inline bool anon_vma_name_eq(struct anon_vma_name *anon_name1,
return true;
}
+static inline
+struct anon_vma_name *anon_vma_name_get_rcu(struct vm_area_struct *vma)
+{
+ return NULL;
+}
+
#endif /* CONFIG_ANON_VMA_NAME */
static inline void init_tlb_flush_pending(struct mm_struct *mm)
diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
index 8b611e13153e..bbe1223cd992 100644
--- a/include/linux/mm_types.h
+++ b/include/linux/mm_types.h
@@ -545,6 +545,7 @@ struct vm_userfaultfd_ctx {};
struct anon_vma_name {
struct kref kref;
+ struct rcu_head rcu;
/* The name needs to be at the end because it is dynamically sized. */
char name[];
};
@@ -699,7 +700,7 @@ struct vm_area_struct {
* terminated string containing the name given to the vma, or NULL if
* unnamed. Serialized by mmap_lock. Use anon_vma_name to access.
*/
- struct anon_vma_name *anon_name;
+ struct anon_vma_name __rcu *anon_name;
#endif
#ifdef CONFIG_SWAP
atomic_long_t swap_readahead_info;
diff --git a/mm/madvise.c b/mm/madvise.c
index 912155a94ed5..0f222d464254 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -88,14 +88,15 @@ void anon_vma_name_free(struct kref *kref)
{
struct anon_vma_name *anon_name =
container_of(kref, struct anon_vma_name, kref);
- kfree(anon_name);
+ kfree_rcu(anon_name, rcu);
}
struct anon_vma_name *anon_vma_name(struct vm_area_struct *vma)
{
mmap_assert_locked(vma->vm_mm);
- return vma->anon_name;
+ return rcu_dereference_protected(vma->anon_name,
+ rwsem_is_locked(&vma->vm_mm->mmap_lock));
}
/* mmap_lock should be write-locked */
@@ -105,7 +106,7 @@ static int replace_anon_vma_name(struct vm_area_struct *vma,
struct anon_vma_name *orig_name = anon_vma_name(vma);
if (!anon_name) {
- vma->anon_name = NULL;
+ rcu_assign_pointer(vma->anon_name, NULL);
anon_vma_name_put(orig_name);
return 0;
}
@@ -113,11 +114,32 @@ static int replace_anon_vma_name(struct vm_area_struct *vma,
if (anon_vma_name_eq(orig_name, anon_name))
return 0;
- vma->anon_name = anon_vma_name_reuse(anon_name);
+ rcu_assign_pointer(vma->anon_name, anon_vma_name_reuse(anon_name));
anon_vma_name_put(orig_name);
return 0;
}
+
+/*
+ * Returned anon_vma_name is stable due to elevated refcount but not guaranteed
+ * to be assigned to the original VMA after the call.
+ */
+struct anon_vma_name *anon_vma_name_get_rcu(struct vm_area_struct *vma)
+{
+ struct anon_vma_name __rcu *anon_name;
+
+ WARN_ON_ONCE(!rcu_read_lock_held());
+
+ anon_name = rcu_dereference(vma->anon_name);
+ if (!anon_name)
+ return NULL;
+
+ if (unlikely(!kref_get_unless_zero(&anon_name->kref)))
+ return NULL;
+
+ return anon_name;
+}
+
#else /* CONFIG_ANON_VMA_NAME */
static int replace_anon_vma_name(struct vm_area_struct *vma,
struct anon_vma_name *anon_name)
--
2.43.0.429.g432eaa2c6b-goog
Powered by blists - more mailing lists