1 // SPDX-License-Identifier: GPL-2.0
3 * Implement mseal() syscall.
5 * Copyright (c) 2023,2024 Google, Inc.
7 * Author: Jeff Xu <jeffxu@chromium.org>
10 #include <linux/mempolicy.h>
11 #include <linux/mman.h>
13 #include <linux/mm_inline.h>
14 #include <linux/mmu_context.h>
15 #include <linux/syscalls.h>
16 #include <linux/sched.h>
19 static inline bool vma_is_sealed(struct vm_area_struct
*vma
)
21 return (vma
->vm_flags
& VM_SEALED
);
24 static inline void set_vma_sealed(struct vm_area_struct
*vma
)
26 vm_flags_set(vma
, VM_SEALED
);
30 * check if a vma is sealed for modification.
31 * return true, if modification is allowed.
33 static bool can_modify_vma(struct vm_area_struct
*vma
)
35 if (unlikely(vma_is_sealed(vma
)))
41 static bool is_madv_discard(int behavior
)
44 (MADV_FREE
| MADV_DONTNEED
| MADV_DONTNEED_LOCKED
|
45 MADV_REMOVE
| MADV_DONTFORK
| MADV_WIPEONFORK
);
48 static bool is_ro_anon(struct vm_area_struct
*vma
)
50 /* check anonymous mapping. */
51 if (vma
->vm_file
|| vma
->vm_flags
& VM_SHARED
)
55 * check for non-writable:
56 * PROT=RO or PKRU is not writeable.
58 if (!(vma
->vm_flags
& VM_WRITE
) ||
59 !arch_vma_access_permitted(vma
, true, false, false))
66 * Check if the vmas of a memory range are allowed to be modified.
67 * the memory ranger can have a gap (unallocated memory).
68 * return true, if it is allowed.
70 bool can_modify_mm(struct mm_struct
*mm
, unsigned long start
, unsigned long end
)
72 struct vm_area_struct
*vma
;
74 VMA_ITERATOR(vmi
, mm
, start
);
76 /* going through each vma to check. */
77 for_each_vma_range(vmi
, vma
, end
) {
78 if (unlikely(!can_modify_vma(vma
)))
82 /* Allow by default. */
87 * Check if the vmas of a memory range are allowed to be modified by madvise.
88 * the memory ranger can have a gap (unallocated memory).
89 * return true, if it is allowed.
91 bool can_modify_mm_madv(struct mm_struct
*mm
, unsigned long start
, unsigned long end
,
94 struct vm_area_struct
*vma
;
96 VMA_ITERATOR(vmi
, mm
, start
);
98 if (!is_madv_discard(behavior
))
101 /* going through each vma to check. */
102 for_each_vma_range(vmi
, vma
, end
)
103 if (unlikely(is_ro_anon(vma
) && !can_modify_vma(vma
)))
106 /* Allow by default. */
110 static int mseal_fixup(struct vma_iterator
*vmi
, struct vm_area_struct
*vma
,
111 struct vm_area_struct
**prev
, unsigned long start
,
112 unsigned long end
, vm_flags_t newflags
)
115 vm_flags_t oldflags
= vma
->vm_flags
;
117 if (newflags
== oldflags
)
120 vma
= vma_modify_flags(vmi
, *prev
, vma
, start
, end
, newflags
);
133 * Check for do_mseal:
134 * 1> start is part of a valid vma.
135 * 2> end is part of a valid vma.
136 * 3> No gap (unallocated address) between start and end.
137 * 4> map is sealable.
139 static int check_mm_seal(unsigned long start
, unsigned long end
)
141 struct vm_area_struct
*vma
;
142 unsigned long nstart
= start
;
144 VMA_ITERATOR(vmi
, current
->mm
, start
);
146 /* going through each vma to check. */
147 for_each_vma_range(vmi
, vma
, end
) {
148 if (vma
->vm_start
> nstart
)
149 /* unallocated memory found. */
152 if (vma
->vm_end
>= end
)
155 nstart
= vma
->vm_end
;
164 static int apply_mm_seal(unsigned long start
, unsigned long end
)
166 unsigned long nstart
;
167 struct vm_area_struct
*vma
, *prev
;
169 VMA_ITERATOR(vmi
, current
->mm
, start
);
171 vma
= vma_iter_load(&vmi
);
173 * Note: check_mm_seal should already checked ENOMEM case.
174 * so vma should not be null, same for the other ENOMEM cases.
176 prev
= vma_prev(&vmi
);
177 if (start
> vma
->vm_start
)
181 for_each_vma_range(vmi
, vma
, end
) {
186 newflags
= vma
->vm_flags
| VM_SEALED
;
190 error
= mseal_fixup(&vmi
, vma
, &prev
, nstart
, tmp
, newflags
);
193 nstart
= vma_iter_end(&vmi
);
200 * mseal(2) seals the VM's meta data from
203 * addr/len: VM address range.
205 * The address range by addr/len must meet:
206 * start (addr) must be in a valid VMA.
207 * end (addr + len) must be in a valid VMA.
208 * no gap (unallocated memory) between start and end.
209 * start (addr) must be page aligned.
211 * len: len will be page aligned implicitly.
213 * Below VMA operations are blocked after sealing.
214 * 1> Unmapping, moving to another location, and shrinking
215 * the size, via munmap() and mremap(), can leave an empty
216 * space, therefore can be replaced with a VMA with a new
218 * 2> Moving or expanding a different vma into the current location,
220 * 3> Modifying a VMA via mmap(MAP_FIXED).
221 * 4> Size expansion, via mremap(), does not appear to pose any
222 * specific risks to sealed VMAs. It is included anyway because
223 * the use case is unclear. In any case, users can rely on
224 * merging to expand a sealed VMA.
225 * 5> mprotect and pkey_mprotect.
226 * 6> Some destructive madvice() behavior (e.g. MADV_DONTNEED)
227 * for anonymous memory, when users don't have write permission to the
228 * memory. Those behaviors can alter region contents by discarding pages,
229 * effectively a memset(0) for anonymous memory.
236 * invalid input flags.
237 * start address is not page aligned.
238 * Address arange (start + len) overflow.
240 * addr is not a valid address (not allocated).
241 * end (start + len) is not a valid address.
242 * a gap (unallocated memory) between start and end.
244 * - In 32 bit architecture, sealing is not supported.
246 * user can call mseal(2) multiple times, adding a seal on an
247 * already sealed memory is a no-action (no error).
249 * unseal() is not supported.
251 static int do_mseal(unsigned long start
, size_t len_in
, unsigned long flags
)
256 struct mm_struct
*mm
= current
->mm
;
258 ret
= can_do_mseal(flags
);
262 start
= untagged_addr(start
);
263 if (!PAGE_ALIGNED(start
))
266 len
= PAGE_ALIGN(len_in
);
267 /* Check to see whether len was rounded up from small -ve to zero. */
278 if (mmap_write_lock_killable(mm
))
282 * First pass, this helps to avoid
283 * partial sealing in case of error in input address range,
286 ret
= check_mm_seal(start
, end
);
291 * Second pass, this should success, unless there are errors
292 * from vma_modify_flags, e.g. merge/split error, or process
293 * reaching the max supported VMAs, however, those cases shall
296 ret
= apply_mm_seal(start
, end
);
299 mmap_write_unlock(current
->mm
);
303 SYSCALL_DEFINE3(mseal
, unsigned long, start
, size_t, len
, unsigned long,
306 return do_mseal(start
, len
, flags
);