From nobody Tue Nov 26 15:15:58 2024 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E7623B1AC for ; Thu, 17 Oct 2024 02:26:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729131993; cv=none; b=LDehOI1acQ3tXMQw8wk1/gQ0WwLjfLlvYSQZNS6nAoax1oGdRIrMmY9DW7VaKKqFtFSbGd8M9VHDs+EJvrOzs/Ub2riXWdJTCHgYJ4C1w5OJg15i35nGl3mJ+wxMsFbQP0UBQgnKP5AtVWa+nj5IVBgQ7DjaOX6b4xf3cI1hefk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1729131993; c=relaxed/simple; bh=8I4WqVW9h0oo1wKFnIe5Zs1p9kcN+bU5Oifz/60G8e4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=cE5/IkV9CZ6FUIWhPKUlotmVz80QUGbuHb1r796Gb/m8Iz3Ep7GJpJmabLeBUqshFL0LlH7Wd2b/PVKfYFqqFeQ2H3iya+U/MKpKCSuVAZ1pJd66APVNyauURU0b6yAT9L+vPKNR1+rON+aKUrL8D2KDwU560wCaF2P8Bsx31ag= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org; spf=pass smtp.mailfrom=chromium.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b=QyBabcJl; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=chromium.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=chromium.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="QyBabcJl" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-2e2ab5bbc01so64412a91.2 for ; Wed, 16 Oct 2024 19:26:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1729131991; x=1729736791; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=9RN8JQgiITrQj6lHgprvd2MNM/V86U6nLKZivNfuyP0=; b=QyBabcJlYHLbRFuHyuScXpLH3azyIc4eososVqk75Gl+/BN1AdvmSqny7UD70gBzGn Q9M1DWQsDbig28U+F4qsrq89e9y3FVKH+AKkXF8/kzGayfbsQ1K9gV+kLofLYFtUq6vj mF4OsEXPvGL2Hy/y/KceJ3XQYiXj/0jJ3jDD0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1729131991; x=1729736791; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=9RN8JQgiITrQj6lHgprvd2MNM/V86U6nLKZivNfuyP0=; b=tWRMfp4TOwptrafYjjD9SDYnZsviB1hkVMZPlaZYCR1JG0jqXSFv6wUbHka9fdZewQ L1Stx1mlhq0ZKS+0UolWoxXz4EJnZTk2s2z+fKUu7TowAxnkchDARkLNUezwG3VxRkgs 7+pDtjfl7qhp55yXNqFzJWvCSEG8M30fIH+EePqlo1mxhfm+Kl0kcnS+sHktee0mtCy8 PUzJH8/SDzs5+JZJogmVYP5mhgFgF5Y7rg/z1NDQ6GuJX3Q5qTTrDXGoz7dZlTwqRGTD pF1LWo2hYRhd0Dnx8lgaDjhSAsX1HdFwy9+Au5bitC/qwzUgu5+5/b4qDA/Y8CKY+W2a +UiQ== X-Forwarded-Encrypted: i=1; AJvYcCWIAiHsv8O9ofSi6QRa/mq5NFnUJtgSNzBhmwaNjJXlp8nHDUKR7FdSrmuJOtP+fhkoxp7AcNE0z7+xyFY=@vger.kernel.org X-Gm-Message-State: AOJu0YznEjXQTlkI4N56Y/2MtbpPPsyK2/NyRss06vhOmiG7kYgpKhLZ hYzkzVSHb6LBXKiKieY6fQlmNbRl5y801w9RiFbyXq3ThZ1AKm/y4WZ14mMN6w== X-Google-Smtp-Source: AGHT+IHwzw6bEAHzD80log/xY9cbw81AdrYOnN6MnrGumBq7RqUgylPY4QxMSEBQbIgjN2nq1fXnjw== X-Received: by 2002:a17:902:c454:b0:20d:345a:965b with SMTP id d9443c01a7336-20d345a9a5fmr22565015ad.7.1729131990866; Wed, 16 Oct 2024 19:26:30 -0700 (PDT) Received: from localhost (56.4.82.34.bc.googleusercontent.com. [34.82.4.56]) by smtp.gmail.com with UTF8SMTPSA id d9443c01a7336-20d18036714sm34755975ad.152.2024.10.16.19.26.30 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 16 Oct 2024 19:26:30 -0700 (PDT) From: jeffxu@chromium.org To: akpm@linux-foundation.org, keescook@chromium.org, torvalds@linux-foundation.org, usama.anjum@collabora.com, corbet@lwn.net, Liam.Howlett@oracle.com, lorenzo.stoakes@oracle.com Cc: jeffxu@google.com, jorgelo@chromium.org, groeck@chromium.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-mm@kvack.org, jannh@google.com, sroettger@google.com, pedro.falcato@gmail.com, linux-hardening@vger.kernel.org, willy@infradead.org, gregkh@linuxfoundation.org, deraadt@openbsd.org, surenb@google.com, merimus@google.com, rdunlap@infradead.org Subject: [PATCH] munmap sealed memory cause memory to split (bug) Date: Thu, 17 Oct 2024 02:26:27 +0000 Message-ID: <20241017022627.3112811-1-jeffxu@chromium.org> X-Mailer: git-send-email 2.47.0.rc1.288.g06298d1525-goog Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jeff Xu It appears there is a regression on the latest mm, when munmap sealed memory, it can cause unexpected VMA split. E.g. repro use this test. --- tools/testing/selftests/mm/mseal_test.c | 76 +++++++++++++++++++++++++ 1 file changed, 76 insertions(+) diff --git a/tools/testing/selftests/mm/mseal_test.c b/tools/testing/selfte= sts/mm/mseal_test.c index fa74dbe4a684..0af33e13b606 100644 --- a/tools/testing/selftests/mm/mseal_test.c +++ b/tools/testing/selftests/mm/mseal_test.c @@ -1969,6 +1969,79 @@ static void test_madvise_filebacked_was_writable(boo= l seal) REPORT_TEST_PASS(); } =20 +static void test_munmap_free_multiple_ranges_with_split(bool seal) +{ + void *ptr; + unsigned long page_size =3D getpagesize(); + unsigned long size =3D 12 * page_size; + int ret; + int prot; + + setup_single_address(size, &ptr); + FAIL_TEST_IF_FALSE(ptr !=3D (void *)-1); + + /* seal the middle 4 page */ + if (seal) { + ret =3D sys_mseal(ptr + 4 * page_size, 4 * page_size); + FAIL_TEST_IF_FALSE(!ret); + + size =3D get_vma_size(ptr, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + + size =3D get_vma_size(ptr + 4 * page_size, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + + size =3D get_vma_size(ptr + 8 * page_size, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + } + + /* munmap 4 pages from the third page */ + ret =3D sys_munmap(ptr + 2 * page_size, 4 * page_size); + if (seal) { + FAIL_TEST_IF_FALSE(ret); + FAIL_TEST_IF_FALSE(errno =3D=3D EPERM); + + size =3D get_vma_size(ptr, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + + size =3D get_vma_size(ptr + 4 * page_size, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + + size =3D get_vma_size(ptr + 8 * page_size, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + } else + FAIL_TEST_IF_FALSE(!ret); + + /* munmap 4 pages from the sealed page */ + ret =3D sys_munmap(ptr + 6 * page_size, 4 * page_size); + if (seal) { + FAIL_TEST_IF_FALSE(ret); + FAIL_TEST_IF_FALSE(errno =3D=3D EPERM); + + size =3D get_vma_size(ptr + 4 * page_size, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + + size =3D get_vma_size(ptr + 4 * page_size, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + + size =3D get_vma_size(ptr + 8 * page_size, &prot); + FAIL_TEST_IF_FALSE(size =3D=3D 4 * page_size); + FAIL_TEST_IF_FALSE(prot =3D=3D 4); + } else + FAIL_TEST_IF_FALSE(!ret); + + REPORT_TEST_PASS(); +} + + int main(int argc, char **argv) { bool test_seal =3D seal_support(); @@ -2099,5 +2172,8 @@ int main(int argc, char **argv) test_madvise_filebacked_was_writable(false); test_madvise_filebacked_was_writable(true); =20 + test_munmap_free_multiple_ranges_with_split(false); + test_munmap_free_multiple_ranges_with_split(true); + ksft_finished(); } --=20 2.47.0.rc1.288.g06298d1525-goog