Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3de7f845 authored by Joel Fernandes's avatar Joel Fernandes
Browse files

BACKPORT: userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas 

commit 29ec90660d68bbdd69507c1c8b4e33aa299278b1 upstream.

After the VMA to register the uffd onto is found, check that it has
VM_MAYWRITE set before allowing registration.  This way we inherit all
common code checks before allowing to fill file holes in shmem and
hugetlbfs with UFFDIO_COPY.

The userfaultfd memory model is not applicable for readonly files unless
it's a MAP_PRIVATE.

Change-Id: I55976c6eda20d68bdb8708d3b244731e3e4ce55c
Link: http://lkml.kernel.org/r/20181126173452.26955-4-aarcange@redhat.com


Fixes: ff62a3421044 ("hugetlb: implement memfd sealing")
Signed-off-by: default avatarAndrea Arcangeli <aarcange@redhat.com>
Reviewed-by: default avatarMike Rapoport <rppt@linux.ibm.com>
Reviewed-by: default avatarHugh Dickins <hughd@google.com>
Reported-by: default avatarJann Horn <jannh@google.com>
Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support")
Cc: <stable@vger.kernel.org>
Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarJoel Fernandes <joelaf@google.com>
parent 66e78b3a

fs/userfaultfd.c

+14 −0
Original line number Diff line number Diff line
@@ -831,6 +831,18 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, 
		if (cur->vm_ops)

			goto out_unlock;



		/*

		 * UFFDIO_COPY will fill file holes even without

		 * PROT_WRITE. This check enforces that if this is a

		 * MAP_SHARED, the process has write permission to the backing

		 * file. If VM_MAYWRITE is set it also enforces that on a

		 * MAP_SHARED vma: there is no F_WRITE_SEAL and no further

		 * F_WRITE_SEAL can be taken until the vma is destroyed.

		 */

		ret = -EPERM;

		if (unlikely(!(cur->vm_flags & VM_MAYWRITE)))

			goto out_unlock;



		/*

		 * Check that this vma isn't already owned by a

		 * different userfaultfd. We can't allow more than one
@@ -856,6 +868,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, 
		BUG_ON(vma->vm_ops);

		BUG_ON(vma->vm_userfaultfd_ctx.ctx &&

		       vma->vm_userfaultfd_ctx.ctx != ctx);

		WARN_ON(!(vma->vm_flags & VM_MAYWRITE));



		/*

		 * Nothing to do: this vma is already registered into this
@@ -995,6 +1008,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, 
		cond_resched();



		BUG_ON(vma->vm_ops);

		WARN_ON(!(vma->vm_flags & VM_MAYWRITE));



		/*

		 * Nothing to do: this vma is already registered into this

mm/userfaultfd.c

+3 −7
Original line number Diff line number Diff line
@@ -182,13 +182,9 @@ static __always_inline ssize_t __mcopy_atomic(struct mm_struct *dst_mm, 
		goto out_unlock;



	/*

	 * Be strict and only allow __mcopy_atomic on userfaultfd

	 * registered ranges to prevent userland errors going

	 * unnoticed. As far as the VM consistency is concerned, it

	 * would be perfectly safe to remove this check, but there's

	 * no useful usage for __mcopy_atomic ouside of userfaultfd

	 * registered ranges. This is after all why these are ioctls

	 * belonging to the userfaultfd and not syscalls.

	 * Check the vma is registered in uffd, this is required to

	 * enforce the VM_MAYWRITE check done at uffd registration

	 * time.

	 */

	if (!dst_vma->vm_userfaultfd_ctx.ctx)

		goto out_unlock;