lkml.org 
[lkml]   [2023]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v1 2/6] PKEY: Add arch_check_pkey_enforce_api()
    Date
    From: Jeff Xu <jeffxu@google.com>

    This patch adds an architecture-independent function,
    arch_check_pkey_enforce_api(), that checks whether the calling thread
    has write access to the PKRU for a given range of memory. If the
    memory range is protected by PKEY_ENFORCE_API, then the thread must
    have write access to the PKRU in order to make changes to the memory
    mapping (such as mprotect/munmap).

    This function is used by the kernel to enforce the
    PKEY_ENFORCE_API flag.

    Signed-off-by: Jeff Xu<jeffxu@google.com>
    ---
    arch/powerpc/include/asm/pkeys.h | 8 +++++
    arch/x86/include/asm/pkeys.h | 50 ++++++++++++++++++++++++++++++++
    include/linux/pkeys.h | 9 ++++++
    3 files changed, 67 insertions(+)

    diff --git a/arch/powerpc/include/asm/pkeys.h b/arch/powerpc/include/asm/pkeys.h
    index 943333ac0fee..24c481e5e95b 100644
    --- a/arch/powerpc/include/asm/pkeys.h
    +++ b/arch/powerpc/include/asm/pkeys.h
    @@ -177,5 +177,13 @@ static inline bool arch_check_pkey_alloc_flags(unsigned long flags)
    return true;
    }

    +static inline int arch_check_pkey_enforce_api(struct mm_struct *mm,
    + unsigned long start,
    + unsigned long end)
    +{
    + /* Allow by default */
    + return 0;
    +}
    +
    extern void pkey_mm_init(struct mm_struct *mm);
    #endif /*_ASM_POWERPC_KEYS_H */
    diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h
    index ecadf04a8251..8b94ffc4ca32 100644
    --- a/arch/x86/include/asm/pkeys.h
    +++ b/arch/x86/include/asm/pkeys.h
    @@ -161,4 +161,54 @@ static inline bool arch_check_pkey_alloc_flags(unsigned long flags)

    return true;
    }
    +
    +static inline int __arch_check_vma_pkey_for_write(struct vm_area_struct *vma)
    +{
    + int pkey = vma_pkey(vma);
    +
    + if (mm_pkey_enforce_api(vma->vm_mm, pkey)) {
    + if (!__pkru_allows_write(read_pkru(), pkey))
    + return -EACCES;
    + }
    +
    + return 0;
    +}
    +
    +/*
    + * arch_check_pkey_enforce_api is used by the kernel to enforce
    + * PKEY_ENFORCE_API flag.
    + * It checks whether the calling thread has write access to the PKRU
    + * for a given range of memory. If the memory range is protected by
    + * PKEY_ENFORCE_API, then the thread must have write access to the
    + * PKRU in order to make changes to the memory mapping, such as
    + * mprotect/munmap.
    + */
    +static inline int arch_check_pkey_enforce_api(struct mm_struct *mm,
    + unsigned long start,
    + unsigned long end)
    +{
    + int error;
    + struct vm_area_struct *vma;
    +
    + if (!arch_pkeys_enabled())
    + return 0;
    +
    + while (true) {
    + vma = find_vma_intersection(mm, start, end);
    + if (!vma)
    + break;
    +
    + error = __arch_check_vma_pkey_for_write(vma);
    + if (error)
    + return error;
    +
    + if (vma->vm_end >= end)
    + break;
    +
    + start = vma->vm_end;
    + }
    +
    + return 0;
    +}
    +
    #endif /*_ASM_X86_PKEYS_H */
    diff --git a/include/linux/pkeys.h b/include/linux/pkeys.h
    index 81a482c3e051..7b00689e1c24 100644
    --- a/include/linux/pkeys.h
    +++ b/include/linux/pkeys.h
    @@ -53,6 +53,15 @@ static inline bool arch_check_pkey_alloc_flags(unsigned long flags)
    return false;
    return true;
    }
    +
    +static inline int arch_check_pkey_enforce_api(struct mm_struct *mm,
    + unsigned long start,
    + unsigned long end)
    +{
    + // Allow by default.
    + return 0;
    +}
    +
    #endif /* ! CONFIG_ARCH_HAS_PKEYS */

    #endif /* _LINUX_PKEYS_H */
    --
    2.40.1.606.ga4b1b128d6-goog
    \
     
     \ /
      Last update: 2023-05-19 03:19    [W:4.082 / U:0.236 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site