tree f4f010edc163ee0b485f7cee726ae96637a1bd65
parent 4f8714f7f891845e6b9d9d4378d11279f9c973cf
author Lokesh Gidra <lokeshgidra@google.com> 1608002029 -0800
committer Tim Zimmermann <tim@linux4.de> 1721966658 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEuwYxAyE4TRnuhLgPbcIaY/gZxe8FAmajIEIACgkQbcIaY/gZ
 xe/TThAAkQVLji4wGMjCJtP1rQruosuSU86BACcGWRu26q79IYJoBKQ7ftYpLT5H
 JJYwDO86nAZhydEahhJNXlYjwNY5OOG6Xr7kUPCAa2tVNh57s4gPsldjZMV3TJRB
 HBTctBygWIpykYaM0K0CYnjZZwkxxNEOFr0Icagy1oy5Oq1P6/kSyZbp8+YqdZQs
 cTdFTsvujIrIJC/EFJWiB7ITlmECEUa1+FfAEvXkmc9SgVS/M5qGNKdA28ujzKZg
 emR8y43Il1DpXps/jIy0G3cvLBYEFXCVNPGEqVtqlKA4VODWuWU+vH0PKdCYcNu/
 Q6Q8cJVOlI2AsmY/PvEAwjsCr+EAUnWot6hPbmKOcYbn2irqv99w+JexBxfaZXup
 FLqqD9N9++gfauACDq+tH4zoeA53k1d0KNBNNpOKbfd/fbXFQd1tqa+p+slCpoeZ
 gRfnbsxsnOnZJiGtK/uGO9XaystVS4v8wp6bZgxr7kMfRw3zI5tKxtHLYx6g6kHn
 l5c9y/AeCwaJJvtzudFvqES689mStmUeySt0n/YN6GmDT1acdbbBAibsznxNSCle
 CG5mOzxoI2ZfT3S2njbCzhohQFgotU1rFWl8iCGbuybPvrkotPVWzeDR/IEQDOBJ
 9+ql7MYxhOlvFfnP5V72zRKZ9UZU71qX9ezZhTZP/rtgJzzoVII=
 =rlwr
 -----END PGP SIGNATURE-----

BACKPORT: userfaultfd: add UFFD_USER_MODE_ONLY

Patch series "Control over userfaultfd kernel-fault handling", v6.

This patch series is split from [1].  The other series enables SELinux
support for userfaultfd file descriptors so that its creation and movement
can be controlled.

It has been demonstrated on various occasions that suspending kernel code
execution for an arbitrary amount of time at any access to userspace
memory (copy_from_user()/copy_to_user()/...) can be exploited to change
the intended behavior of the kernel.  For instance, handling page faults
in kernel-mode using userfaultfd has been exploited in [2, 3].  Likewise,
FUSE, which is similar to userfaultfd in this respect, has been exploited
in [4, 5] for similar outcome.

This small patch series adds a new flag to userfaultfd(2) that allows
callers to give up the ability to handle kernel-mode faults with the
resulting UFFD file object.  It then adds a 'user-mode only' option to the
unprivileged_userfaultfd sysctl knob to require unprivileged callers to
use this new flag.

The purpose of this new interface is to decrease the chance of an
unprivileged userfaultfd user taking advantage of userfaultfd to enhance
security vulnerabilities by lengthening the race window in kernel code.

[1] https://lore.kernel.org/lkml/20200211225547.235083-1-dancol@google.com/
[2] https://duasynt.com/blog/linux-kernel-heap-spray
[3] https://duasynt.com/blog/cve-2016-6187-heap-off-by-one-exploit
[4] https://googleprojectzero.blogspot.com/2016/06/exploiting-recursion-in-linux-kernel_20.html
[5] https://bugs.chromium.org/p/project-zero/issues/detail?id=808

This patch (of 2):

userfaultfd handles page faults from both user and kernel code.  Add a new
UFFD_USER_MODE_ONLY flag for userfaultfd(2) that makes the resulting
userfaultfd object refuse to handle faults from kernel mode, treating
these faults as if SIGBUS were always raised, causing the kernel code to
fail with EFAULT.

A future patch adds a knob allowing administrators to give some processes
the ability to create userfaultfd file objects only if they pass
UFFD_USER_MODE_ONLY, reducing the likelihood that these processes will
exploit userfaultfd's ability to delay kernel page faults to open timing
windows for future exploits.

Link: https://lkml.kernel.org/r/20201120030411.2690816-1-lokeshgidra@google.com
Link: https://lkml.kernel.org/r/20201120030411.2690816-2-lokeshgidra@google.com
Change-Id: I5c50a96f56c862cbbdb001acbe958c9f4c48023a
Signed-off-by: Daniel Colascione <dancol@google.com>
Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Reviewed-by: Andrea Arcangeli <aarcange@redhat.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: <calin@google.com>
Cc: Daniel Colascione <dancol@dancol.org>
Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Iurii Zaikin <yzaikin@google.com>
Cc: Jeff Vander Stoep <jeffv@google.com>
Cc: Jerome Glisse <jglisse@redhat.com>
Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Kalesh Singh <kaleshsingh@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Mike Rapoport <rppt@linux.vnet.ibm.com>
Cc: Nitin Gupta <nigupta@nvidia.com>
Cc: Peter Xu <peterx@redhat.com>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Shaohua Li <shli@fb.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>