From: Andrea Arcangeli Date: Fri, 30 Nov 2018 22:09:32 +0000 (-0800) Subject: userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas X-Git-Tag: v4.1.12-124.31.3~301 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=fd9c0d9cb219eb2485d2084a5b8359c5120ab85f;p=users%2Fjedix%2Flinux-maple.git userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas After the VMA to register the uffd onto is found, check that it has VM_MAYWRITE set before allowing registration. This way we inherit all common code checks before allowing to fill file holes in shmem and hugetlbfs with UFFDIO_COPY. The userfaultfd memory model is not applicable for readonly files unless it's a MAP_PRIVATE. Link: http://lkml.kernel.org/r/20181126173452.26955-4-aarcange@redhat.com Fixes: ff62a3421044 ("hugetlb: implement memfd sealing") Signed-off-by: Andrea Arcangeli Reviewed-by: Mike Rapoport Reviewed-by: Hugh Dickins Reported-by: Jann Horn Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support") Cc: Cc: "Dr. David Alan Gilbert" Cc: Mike Kravetz Cc: Peter Xu Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Orabug: 29163750 CVE: CVE-2018-18397 commit 29ec90660d68bbdd69507c1c8b4e33aa299278b1 upstream Signed-off-by: Brian Maly Conflicts: fs/userfaultfd.c mm/userfaultfd.c Signed-off-by: Shan Hai Reviewed-by: Jack Vogel Signed-off-by: Brian Maly --- diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index d3d6eaad4b4e..4d6ccc347e07 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -895,6 +895,19 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, ret = -EINVAL; if (cur->vm_ops && !is_vm_hugetlb_page(cur)) goto out_unlock; + + /* + * UFFDIO_COPY will fill file holes even without + * PROT_WRITE. This check enforces that if this is a + * MAP_SHARED, the process has write permission to the backing + * file. If VM_MAYWRITE is set it also enforces that on a + * MAP_SHARED vma: there is no F_WRITE_SEAL and no further + * F_WRITE_SEAL can be taken until the vma is destroyed. + */ + ret = -EPERM; + if (unlikely(!(cur->vm_flags & VM_MAYWRITE))) + goto out_unlock; + /* * If this vma contains ending address, and huge pages * check alignment. @@ -940,6 +953,7 @@ static int userfaultfd_register(struct userfaultfd_ctx *ctx, BUG_ON(vma->vm_ops && !is_vm_hugetlb_page(vma)); BUG_ON(vma->vm_userfaultfd_ctx.ctx && vma->vm_userfaultfd_ctx.ctx != ctx); + WARN_ON(!(vma->vm_flags & VM_MAYWRITE)); /* * Nothing to do: this vma is already registered into this @@ -1090,6 +1104,7 @@ static int userfaultfd_unregister(struct userfaultfd_ctx *ctx, cond_resched(); BUG_ON(vma->vm_ops && !is_vm_hugetlb_page(vma)); + WARN_ON(!(vma->vm_flags & VM_MAYWRITE)); /* * Nothing to do: this vma is already registered into this diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c index 9c3e50f69ea6..a262ef6edf82 100644 --- a/mm/userfaultfd.c +++ b/mm/userfaultfd.c @@ -222,7 +222,8 @@ retry: goto out_unlock; /* - * Only allow __mcopy_atomic_hugetlb on userfaultfd registered ranges. + * Check the vma is registered in uffd, this is required to enforce the + * VM_MAYWRITE check done at uffd registration time. */ if (!dst_vma->vm_userfaultfd_ctx.ctx) goto out_unlock; @@ -392,13 +393,9 @@ retry: src_start, len, zeropage); /* - * Be strict and only allow __mcopy_atomic on userfaultfd - * registered ranges to prevent userland errors going - * unnoticed. As far as the VM consistency is concerned, it - * would be perfectly safe to remove this check, but there's - * no useful usage for __mcopy_atomic ouside of userfaultfd - * registered ranges. This is after all why these are ioctls - * belonging to the userfaultfd and not syscalls. + * Check the vma is registered in uffd, this is required to + * enforce the VM_MAYWRITE check done at uffd registration + * time. */ if (!dst_vma->vm_userfaultfd_ctx.ctx) goto out_unlock;