lkml.org 
[lkml]   [2024]   [Apr]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v2] mm/page_table_check: Support userfault wr-protect entries
On Wed, Apr 17, 2024 at 02:52:17PM -0400, Peter Xu wrote:
> Allow page_table_check hooks to check over userfaultfd wr-protect criteria
> upon pgtable updates. The rule is no co-existance allowed for any writable
> flag against userfault wr-protect flag.
>
> This should be better than c2da319c2e, where we used to only sanitize such
> issues during a pgtable walk, but when hitting such issue we don't have a
> good chance to know where does that writable bit came from [1], so that
> even the pgtable walk exposes a kernel bug (which is still helpful on
> triaging) but not easy to track and debug.
>
> Now we switch to track the source. It's much easier too with the recent
> introduction of page table check.
>
> There are some limitations with using the page table check here for
> userfaultfd wr-protect purpose:
>
> - It is only enabled with explicit enablement of page table check configs
> and/or boot parameters, but should be good enough to track at least
> syzbot issues, as syzbot should enable PAGE_TABLE_CHECK[_ENFORCED] for
> x86 [1]. We used to have DEBUG_VM but it's now off for most distros,
> while distros also normally not enable PAGE_TABLE_CHECK[_ENFORCED], which
> is similar.
>
> - It conditionally works with the ptep_modify_prot API. It will be
> bypassed when e.g. XEN PV is enabled, however still work for most of the
> rest scenarios, which should be the common cases so should be good
> enough.
>
> - Hugetlb check is a bit hairy, as the page table check cannot identify
> hugetlb pte or normal pte via trapping at set_pte_at(), because of the
> current design where hugetlb maps every layers to pte_t... For example,
> the default set_huge_pte_at() can invoke set_pte_at() directly and lose
> the hugetlb context, treating it the same as a normal pte_t. So far it's
> fine because we have huge_pte_uffd_wp() always equals to pte_uffd_wp() as
> long as supported (x86 only). It'll be a bigger problem when we'll
> define _PAGE_UFFD_WP differently at various pgtable levels, because then
> one huge_pte_uffd_wp() per-arch will stop making sense first.. as of now
> we can leave this for later too.
>
> This patch also removes commit c2da319c2e altogether, as we have something
> better now.
>
> [1] https://lore.kernel.org/all/000000000000dce0530615c89210@google.com/
>
> Cc: Pasha Tatashin <pasha.tatashin@soleen.com>
> Signed-off-by: Peter Xu <peterx@redhat.com>
> ---
> v2:
> - Rename __page_table_check_pxx() to page_table_check_pxx_flags(),
> meanwhile move the pte check out of the loop [Pasha]
> - Fix build issues reported from the bot, also added SWP_DEVICE_WRITE which
> was overlooked before

I forgot to update the docs, sorry. I'll send v3.

--
Peter Xu


\
 
 \ /
  Last update: 2024-04-17 21:12    [W:0.038 / U:0.912 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site