2020-11-20 03:06:59

by Lokesh Gidra

[permalink] [raw]
Subject: [PATCH v6 1/2] Add UFFD_USER_MODE_ONLY

userfaultfd handles page faults from both user and kernel code.
Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes
the resulting userfaultfd object refuse to handle faults from kernel
mode, treating these faults as if SIGBUS were always raised, causing
the kernel code to fail with EFAULT.

A future patch adds a knob allowing administrators to give some
processes the ability to create userfaultfd file objects only if they
pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes
will exploit userfaultfd's ability to delay kernel page faults to open
timing windows for future exploits.

Signed-off-by: Daniel Colascione <[email protected]>
Signed-off-by: Lokesh Gidra <[email protected]>
Reviewed-by: Andrea Arcangeli <[email protected]>
---
fs/userfaultfd.c | 10 +++++++++-
include/uapi/linux/userfaultfd.h | 9 +++++++++
2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 000b457ad087..605599fde015 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)

if (ctx->features & UFFD_FEATURE_SIGBUS)
goto out;
+ if ((vmf->flags & FAULT_FLAG_USER) == 0 &&
+ ctx->flags & UFFD_USER_MODE_ONLY) {
+ printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd "
+ "sysctl knob to 1 if kernel faults must be handled "
+ "without obtaining CAP_SYS_PTRACE capability\n");
+ goto out;
+ }

/*
* If it's already released don't get it. This avoids to loop
@@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
BUG_ON(!current->mm);

/* Check the UFFD_* constants for consistency. */
+ BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS);
BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC);
BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK);

- if (flags & ~UFFD_SHARED_FCNTL_FLAGS)
+ if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY))
return -EINVAL;

ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL);
diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h
index e7e98bde221f..5f2d88212f7c 100644
--- a/include/uapi/linux/userfaultfd.h
+++ b/include/uapi/linux/userfaultfd.h
@@ -257,4 +257,13 @@ struct uffdio_writeprotect {
__u64 mode;
};

+/*
+ * Flags for the userfaultfd(2) system call itself.
+ */
+
+/*
+ * Create a userfaultfd that can handle page faults only in user mode.
+ */
+#define UFFD_USER_MODE_ONLY 1
+
#endif /* _LINUX_USERFAULTFD_H */
--
2.29.0.rc1.297.gfa9743e501-goog


2020-11-20 03:12:54

by Lokesh Gidra

[permalink] [raw]
Subject: Re: [PATCH v6 1/2] Add UFFD_USER_MODE_ONLY

On Thu, Nov 19, 2020 at 7:04 PM Lokesh Gidra <[email protected]> wrote:
>
> userfaultfd handles page faults from both user and kernel code.
> Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes
> the resulting userfaultfd object refuse to handle faults from kernel
> mode, treating these faults as if SIGBUS were always raised, causing
> the kernel code to fail with EFAULT.
>
> A future patch adds a knob allowing administrators to give some
> processes the ability to create userfaultfd file objects only if they
> pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes
> will exploit userfaultfd's ability to delay kernel page faults to open
> timing windows for future exploits.
>
> Signed-off-by: Daniel Colascione <[email protected]>
> Signed-off-by: Lokesh Gidra <[email protected]>
> Reviewed-by: Andrea Arcangeli <[email protected]>
> ---
> fs/userfaultfd.c | 10 +++++++++-
> include/uapi/linux/userfaultfd.h | 9 +++++++++
> 2 files changed, 18 insertions(+), 1 deletion(-)
>
> diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
> index 000b457ad087..605599fde015 100644
> --- a/fs/userfaultfd.c
> +++ b/fs/userfaultfd.c
> @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
>
> if (ctx->features & UFFD_FEATURE_SIGBUS)
> goto out;
> + if ((vmf->flags & FAULT_FLAG_USER) == 0 &&
> + ctx->flags & UFFD_USER_MODE_ONLY) {
> + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd "
> + "sysctl knob to 1 if kernel faults must be handled "
> + "without obtaining CAP_SYS_PTRACE capability\n");
> + goto out;
> + }
>
> /*
> * If it's already released don't get it. This avoids to loop
> @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
> BUG_ON(!current->mm);
>
> /* Check the UFFD_* constants for consistency. */
> + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS);
> BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC);
> BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK);
>
> - if (flags & ~UFFD_SHARED_FCNTL_FLAGS)
> + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY))
> return -EINVAL;
>
> ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL);
> diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h
> index e7e98bde221f..5f2d88212f7c 100644
> --- a/include/uapi/linux/userfaultfd.h
> +++ b/include/uapi/linux/userfaultfd.h
> @@ -257,4 +257,13 @@ struct uffdio_writeprotect {
> __u64 mode;
> };
>
> +/*
> + * Flags for the userfaultfd(2) system call itself.
> + */
> +
> +/*
> + * Create a userfaultfd that can handle page faults only in user mode.
> + */
> +#define UFFD_USER_MODE_ONLY 1
> +
> #endif /* _LINUX_USERFAULTFD_H */
> --
> 2.29.0.rc1.297.gfa9743e501-goog
>
Adding [email protected] mailing list

2020-11-20 23:35:23

by Andrew Morton

[permalink] [raw]
Subject: Re: [PATCH v6 1/2] Add UFFD_USER_MODE_ONLY

On Thu, 19 Nov 2020 19:04:10 -0800 Lokesh Gidra <[email protected]> wrote:

> userfaultfd handles page faults from both user and kernel code.
> Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes
> the resulting userfaultfd object refuse to handle faults from kernel
> mode, treating these faults as if SIGBUS were always raised, causing
> the kernel code to fail with EFAULT.
>
> A future patch adds a knob allowing administrators to give some
> processes the ability to create userfaultfd file objects only if they
> pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes
> will exploit userfaultfd's ability to delay kernel page faults to open
> timing windows for future exploits.

Can we assume that an update to the userfaultfd(2) manpage is in the
works?

> --- a/fs/userfaultfd.c
> +++ b/fs/userfaultfd.c
> @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
>
> if (ctx->features & UFFD_FEATURE_SIGBUS)
> goto out;
> + if ((vmf->flags & FAULT_FLAG_USER) == 0 &&
> + ctx->flags & UFFD_USER_MODE_ONLY) {
> + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd "
> + "sysctl knob to 1 if kernel faults must be handled "
> + "without obtaining CAP_SYS_PTRACE capability\n");
> + goto out;
> + }
>
> /*
> * If it's already released don't get it. This avoids to loop
> @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
> BUG_ON(!current->mm);
>
> /* Check the UFFD_* constants for consistency. */
> + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS);

Are we sure this is true for all architectures?

> BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC);
> BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK);
>
> - if (flags & ~UFFD_SHARED_FCNTL_FLAGS)
> + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY))
> return -EINVAL;
>
> ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL);
> diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h
> index e7e98bde221f..5f2d88212f7c 100644
> --- a/include/uapi/linux/userfaultfd.h
> +++ b/include/uapi/linux/userfaultfd.h
> @@ -257,4 +257,13 @@ struct uffdio_writeprotect {
> __u64 mode;
> };
>
> +/*
> + * Flags for the userfaultfd(2) system call itself.
> + */
> +
> +/*
> + * Create a userfaultfd that can handle page faults only in user mode.
> + */
> +#define UFFD_USER_MODE_ONLY 1
> +
> #endif /* _LINUX_USERFAULTFD_H */

It would be nice to define this in include/linux/userfaultfd_k.h,
alongside the other flags. But I guess it has to be here because it's
part of the userspace API.

2020-11-23 19:22:05

by Lokesh Gidra

[permalink] [raw]
Subject: Re: [PATCH v6 1/2] Add UFFD_USER_MODE_ONLY

On Fri, Nov 20, 2020 at 3:33 PM Andrew Morton <[email protected]> wrote:
>
> On Thu, 19 Nov 2020 19:04:10 -0800 Lokesh Gidra <[email protected]> wrote:
>
> > userfaultfd handles page faults from both user and kernel code.
> > Add a new UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes
> > the resulting userfaultfd object refuse to handle faults from kernel
> > mode, treating these faults as if SIGBUS were always raised, causing
> > the kernel code to fail with EFAULT.
> >
> > A future patch adds a knob allowing administrators to give some
> > processes the ability to create userfaultfd file objects only if they
> > pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes
> > will exploit userfaultfd's ability to delay kernel page faults to open
> > timing windows for future exploits.
>
> Can we assume that an update to the userfaultfd(2) manpage is in the
> works?
>
Yes, I'm working on it. Can the kernel version which will have these
patches be known now so that I can mention it in the manpage?

> > --- a/fs/userfaultfd.c
> > +++ b/fs/userfaultfd.c
> > @@ -405,6 +405,13 @@ vm_fault_t handle_userfault(struct vm_fault *vmf, unsigned long reason)
> >
> > if (ctx->features & UFFD_FEATURE_SIGBUS)
> > goto out;
> > + if ((vmf->flags & FAULT_FLAG_USER) == 0 &&
> > + ctx->flags & UFFD_USER_MODE_ONLY) {
> > + printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd "
> > + "sysctl knob to 1 if kernel faults must be handled "
> > + "without obtaining CAP_SYS_PTRACE capability\n");
> > + goto out;
> > + }
> >
> > /*
> > * If it's already released don't get it. This avoids to loop
> > @@ -1965,10 +1972,11 @@ SYSCALL_DEFINE1(userfaultfd, int, flags)
> > BUG_ON(!current->mm);
> >
> > /* Check the UFFD_* constants for consistency. */
> > + BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS);
>
> Are we sure this is true for all architectures?

Yes, none of the architectures are using the least-significant bit for
O_CLOEXEC or O_NONBLOCK.
>
> > BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC);
> > BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK);
> >
> > - if (flags & ~UFFD_SHARED_FCNTL_FLAGS)
> > + if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY))
> > return -EINVAL;
> >
> > ctx = kmem_cache_alloc(userfaultfd_ctx_cachep, GFP_KERNEL);
> > diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h
> > index e7e98bde221f..5f2d88212f7c 100644
> > --- a/include/uapi/linux/userfaultfd.h
> > +++ b/include/uapi/linux/userfaultfd.h
> > @@ -257,4 +257,13 @@ struct uffdio_writeprotect {
> > __u64 mode;
> > };
> >
> > +/*
> > + * Flags for the userfaultfd(2) system call itself.
> > + */
> > +
> > +/*
> > + * Create a userfaultfd that can handle page faults only in user mode.
> > + */
> > +#define UFFD_USER_MODE_ONLY 1
> > +
> > #endif /* _LINUX_USERFAULTFD_H */
>
> It would be nice to define this in include/linux/userfaultfd_k.h,
> alongside the other flags. But I guess it has to be here because it's
> part of the userspace API.

2020-11-23 20:14:24

by Andrew Morton

[permalink] [raw]
Subject: Re: [PATCH v6 1/2] Add UFFD_USER_MODE_ONLY

On Mon, 23 Nov 2020 11:17:43 -0800 Lokesh Gidra <[email protected]> wrote:

> > > A future patch adds a knob allowing administrators to give some
> > > processes the ability to create userfaultfd file objects only if they
> > > pass UFFD_USER_MODE_ONLY, reducing the likelihood that these processes
> > > will exploit userfaultfd's ability to delay kernel page faults to open
> > > timing windows for future exploits.
> >
> > Can we assume that an update to the userfaultfd(2) manpage is in the
> > works?
> >
> Yes, I'm working on it. Can the kernel version which will have these
> patches be known now so that I can mention it in the manpage?

5.11, if all proceeds smoothly.