Use the recently introduced PCuABI reservation interfaces for mremap syscall. The mremap PCuABI specification does not allow expanding the existing mappings so they are moved if MREMAP_MAYMOVE flag is present. Use the relevant capability constraint checks in the input user memory addresses.
Here we use do_munmap_use_reserv() version of unmap function to remove/shrink the mapping of the memory.
Signed-off-by: Amit Daniel Kachhap amit.kachhap@arm.com --- mm/mremap.c | 110 ++++++++++++++++++++++++++++++++++++++++++++-------- 1 file changed, 93 insertions(+), 17 deletions(-)
diff --git a/mm/mremap.c b/mm/mremap.c index 305e7bcf06f9..2ed627c4c25d 100644 --- a/mm/mremap.c +++ b/mm/mremap.c @@ -25,6 +25,7 @@ #include <linux/uaccess.h> #include <linux/userfaultfd_k.h> #include <linux/mempolicy.h> +#include <linux/cap_addr_mgmt.h>
#include <asm/cacheflush.h> #include <asm/tlb.h> @@ -785,16 +786,21 @@ static struct vm_area_struct *vma_to_resize(unsigned long addr, return vma; }
-static unsigned long mremap_to(unsigned long addr, unsigned long old_len, - unsigned long new_addr, unsigned long new_len, bool *locked, +static user_uintptr_t mremap_to(user_uintptr_t user_addr, unsigned long old_len, + user_uintptr_t user_new_addr, unsigned long new_len, bool *locked, unsigned long flags, struct vm_userfaultfd_ctx *uf, struct list_head *uf_unmap_early, struct list_head *uf_unmap) { struct mm_struct *mm = current->mm; struct vm_area_struct *vma; - unsigned long ret = -EINVAL; + user_uintptr_t ret = -EINVAL; unsigned long map_flags = 0; + unsigned long addr = (ptraddr_t)user_addr; + unsigned long new_addr = (ptraddr_t)user_new_addr; +#ifdef CONFIG_CHERI_PURECAP_UABI + unsigned long old_perm; +#endif
if (offset_in_page(new_addr)) goto out; @@ -824,13 +830,13 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len, return -ENOMEM;
if (flags & MREMAP_FIXED) { - ret = do_munmap(mm, new_addr, new_len, uf_unmap_early); + ret = do_munmap_use_reserv(mm, user_new_addr, new_len, uf_unmap_early); if (ret) goto out; }
if (old_len > new_len) { - ret = do_munmap(mm, addr+new_len, old_len - new_len, uf_unmap); + ret = do_munmap_use_reserv(mm, user_addr + new_len, old_len - new_len, uf_unmap); if (ret) goto out; old_len = new_len; @@ -865,9 +871,27 @@ static unsigned long mremap_to(unsigned long addr, unsigned long old_len, if (!(flags & MREMAP_FIXED)) new_addr = ret;
+#ifdef CONFIG_CHERI_PURECAP_UABI + /* + * Remove the old length reservation and create a new length + * reservation. If move_vma() fails then restore the old reservation. + * Reservation is moved before move_vma() as any failure in moving + * reservation will return and will not proceed to move_vma(). + */ + ret = reserv_mt_move_entry(&mm->reserv_mt, addr, old_len, new_addr, new_len, &old_perm); + if (ret) + goto out; +#endif ret = move_vma(vma, addr, old_len, new_len, new_addr, locked, flags, uf, uf_unmap);
+#ifdef CONFIG_CHERI_PURECAP_UABI + /* If any error in move_vma() then revert the reservations. */ + if (IS_ERR_VALUE(ret)) + reserv_mt_move_entry(&mm->reserv_mt, new_addr, new_len, addr, old_len, &old_perm); + else + ret = build_owning_capability(new_addr, new_len, old_perm); +#endif out: return ret; } @@ -893,9 +917,9 @@ static int vma_expandable(struct vm_area_struct *vma, unsigned long delta) * MREMAP_FIXED option added 5-Dec-1999 by Benjamin LaHaise * This option implies MREMAP_MAYMOVE. */ -SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len, +SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, user_addr, unsigned long, old_len, unsigned long, new_len, unsigned long, flags, - user_uintptr_t, new_addr) + user_uintptr_t, user_new_addr) { struct mm_struct *mm = current->mm; struct vm_area_struct *vma; @@ -903,10 +927,14 @@ SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len bool locked = false; bool downgraded = false; struct vm_userfaultfd_ctx uf = NULL_VM_UFFD_CTX; + unsigned long addr = (ptraddr_t)user_addr; + unsigned long new_addr = (ptraddr_t)user_new_addr; +#ifdef CONFIG_CHERI_PURECAP_UABI + unsigned long old_perm; +#endif LIST_HEAD(uf_unmap_early); LIST_HEAD(uf_unmap);
- /* @TODO [PCuABI] - capability validation */ /* * There is a deliberate asymmetry here: we strip the pointer tag * from the old address but leave the new address alone. This is @@ -918,6 +946,9 @@ SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len * See Documentation/arm64/tagged-address-abi.rst for more information. */ addr = untagged_addr(addr); +#ifdef CONFIG_CHERI_PURECAP_UABI + user_addr = cheri_address_set(user_addr, addr); +#endif
if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE | MREMAP_DONTUNMAP)) return ret; @@ -948,6 +979,29 @@ SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len if (!new_len) return ret;
+#ifdef CONFIG_CHERI_PURECAP_UABI + if (!capability_owns_range(user_addr, addr, old_len ? old_len : new_len)) + return ret; + if (!reserv_mt_capability_bound_valid(&mm->reserv_mt, user_addr)) + return -ERESERVATION; + if (flags & MREMAP_FIXED) { + if (cheri_tag_get(user_new_addr)) { + if (!capability_owns_range(user_new_addr, new_addr, new_len)) + return ret; + } else { + if (!cheri_is_null_derived(user_new_addr)) + return ret; + } + } + /* + * If new_len > old_len and flags does not contain MREMAP_MAYMOVE + * then this fails as PCuABI does not allow increasing reservation. + */ + if (new_len > old_len && !(flags & MREMAP_MAYMOVE)) + return -ERESERVATION; + +#endif + if (mmap_write_lock_killable(current->mm)) return -EINTR; vma = vma_lookup(mm, addr); @@ -993,8 +1047,9 @@ SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len int retval; VMA_ITERATOR(vmi, mm, addr + new_len);
- retval = do_vmi_munmap(&vmi, mm, addr + new_len, - old_len - new_len, &uf_unmap, true, true); + /* Call the unmap considering reservation here */ + retval = do_vmi_munmap(&vmi, mm, user_addr + new_len, + old_len - new_len, &uf_unmap, true, false); /* Returning 1 indicates mmap_lock is downgraded to read. */ if (retval == 1) { downgraded = true; @@ -1003,7 +1058,7 @@ SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len goto out; }
- ret = addr; + ret = user_addr; goto out; }
@@ -1019,8 +1074,13 @@ SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len /* old_len exactly to the end of the area.. */ if (old_len == vma->vm_end - addr) { - /* can we just expand the current mapping? */ - if (vma_expandable(vma, new_len - old_len)) { + /* + * can we just expand the current mapping? + * PCuABI specification does not allow increasing reservation + * size so just skip this path. + */ + if (!IS_ENABLED(CONFIG_CHERI_PURECAP_UABI) && + vma_expandable(vma, new_len - old_len)) { long pages = (new_len - old_len) >> PAGE_SHIFT; unsigned long extension_start = addr + old_len; unsigned long extension_end = addr + new_len; @@ -1083,8 +1143,27 @@ SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len goto out; }
+#ifdef CONFIG_CHERI_PURECAP_UABI + /* + * Remove old length reservation and create new length reservation. + * If move_vma() fails then restore back the old reservation. + * Reservation is moved before move_vma() as any failure in moving + * reservation will return and will not proceed to move_vma(). + */ + ret = reserv_mt_move_entry(&mm->reserv_mt, addr, old_len, + new_addr, new_len, &old_perm); + if (ret) + goto out; +#endif ret = move_vma(vma, addr, old_len, new_len, new_addr, &locked, flags, &uf, &uf_unmap); +#ifdef CONFIG_CHERI_PURECAP_UABI + if (IS_ERR_VALUE(ret)) + reserv_mt_move_entry(&mm->reserv_mt, new_addr, new_len, + addr, old_len, &old_perm); + else + ret = build_owning_capability(new_addr, new_len, old_perm); +#endif } out: if (offset_in_page(ret)) @@ -1098,8 +1177,5 @@ SYSCALL_DEFINE5(__retptr__(mremap), user_uintptr_t, addr, unsigned long, old_len userfaultfd_unmap_complete(mm, &uf_unmap_early); mremap_userfaultfd_complete(&uf, addr, ret, old_len); userfaultfd_unmap_complete(mm, &uf_unmap); - /* TODO [PCuABI] - derive proper capability */ - return IS_ERR_VALUE(ret) ? - ret : - (user_intptr_t)uaddr_to_user_ptr_safe((ptraddr_t)ret); + return ret; }