mm/page_table_check.c

   1 // SPDX-License-Identifier: GPL-2.0
   2
   3 /*
   4  * Copyright (c) 2021, Google LLC.
   5  * Pasha Tatashin <pasha.tatashin@soleen.com>
   6  */
   7 #include <linux/kstrtox.h>
   8 #include <linux/mm.h>
   9 #include <linux/page_table_check.h>
  10
  11 #undef pr_fmt
  12 #define pr_fmt(fmt)     "page_table_check: " fmt
  13
  14 struct page_table_check {
  15         atomic_t anon_map_count;
  16         atomic_t file_map_count;
  17 };
  18
  19 static bool __page_table_check_enabled __initdata =
  20                                 IS_ENABLED(CONFIG_PAGE_TABLE_CHECK_ENFORCED);
  21
  22 DEFINE_STATIC_KEY_TRUE(page_table_check_disabled);
  23 EXPORT_SYMBOL(page_table_check_disabled);
  24
  25 static int __init early_page_table_check_param(char *buf)
  26 {
  27         return kstrtobool(buf, &__page_table_check_enabled);
  28 }
  29
  30 early_param("page_table_check", early_page_table_check_param);
  31
  32 static bool __init need_page_table_check(void)
  33 {
  34         return __page_table_check_enabled;
  35 }
  36
  37 static void __init init_page_table_check(void)
  38 {
  39         if (!__page_table_check_enabled)
  40                 return;
  41         static_branch_disable(&page_table_check_disabled);
  42 }
  43
  44 struct page_ext_operations page_table_check_ops = {
  45         .size = sizeof(struct page_table_check),
  46         .need = need_page_table_check,
  47         .init = init_page_table_check,
  48         .need_shared_flags = false,
  49 };
  50
  51 static struct page_table_check *get_page_table_check(struct page_ext *page_ext)
  52 {
  53         BUG_ON(!page_ext);
  54         return (void *)(page_ext) + page_table_check_ops.offset;
  55 }
  56
  57 /*
  58  * An entry is removed from the page table, decrement the counters for that page
  59  * verify that it is of correct type and counters do not become negative.
  60  */
  61 static void page_table_check_clear(unsigned long pfn, unsigned long pgcnt)
  62 {
  63         struct page_ext *page_ext;
  64         struct page *page;
  65         unsigned long i;
  66         bool anon;
  67
  68         if (!pfn_valid(pfn))
  69                 return;
  70
  71         page = pfn_to_page(pfn);
  72         page_ext = page_ext_get(page);
  73
  74         BUG_ON(PageSlab(page));
  75         anon = PageAnon(page);
  76
  77         for (i = 0; i < pgcnt; i++) {
  78                 struct page_table_check *ptc = get_page_table_check(page_ext);
  79
  80                 if (anon) {
  81                         BUG_ON(atomic_read(&ptc->file_map_count));
  82                         BUG_ON(atomic_dec_return(&ptc->anon_map_count) < 0);
  83                 } else {
  84                         BUG_ON(atomic_read(&ptc->anon_map_count));
  85                         BUG_ON(atomic_dec_return(&ptc->file_map_count) < 0);
  86                 }
  87                 page_ext = page_ext_next(page_ext);
  88         }
  89         page_ext_put(page_ext);
  90 }
  91
  92 /*
  93  * A new entry is added to the page table, increment the counters for that page
  94  * verify that it is of correct type and is not being mapped with a different
  95  * type to a different process.
  96  */
  97 static void page_table_check_set(struct mm_struct *mm, unsigned long addr,
  98                                  unsigned long pfn, unsigned long pgcnt,
  99                                  bool rw)
 100 {
 101         struct page_ext *page_ext;
 102         struct page *page;
 103         unsigned long i;
 104         bool anon;
 105
 106         if (!pfn_valid(pfn))
 107                 return;
 108
 109         page = pfn_to_page(pfn);
 110         page_ext = page_ext_get(page);
 111
 112         BUG_ON(PageSlab(page));
 113         anon = PageAnon(page);
 114
 115         for (i = 0; i < pgcnt; i++) {
 116                 struct page_table_check *ptc = get_page_table_check(page_ext);
 117
 118                 if (anon) {
 119                         BUG_ON(atomic_read(&ptc->file_map_count));
 120                         BUG_ON(atomic_inc_return(&ptc->anon_map_count) > 1 && rw);
 121                 } else {
 122                         BUG_ON(atomic_read(&ptc->anon_map_count));
 123                         BUG_ON(atomic_inc_return(&ptc->file_map_count) < 0);
 124                 }
 125                 page_ext = page_ext_next(page_ext);
 126         }
 127         page_ext_put(page_ext);
 128 }
 129
 130 /*
 131  * page is on free list, or is being allocated, verify that counters are zeroes
 132  * crash if they are not.
 133  */
 134 void __page_table_check_zero(struct page *page, unsigned int order)
 135 {
 136         struct page_ext *page_ext;
 137         unsigned long i;
 138
 139         BUG_ON(PageSlab(page));
 140
 141         page_ext = page_ext_get(page);
 142         BUG_ON(!page_ext);
 143         for (i = 0; i < (1ul << order); i++) {
 144                 struct page_table_check *ptc = get_page_table_check(page_ext);
 145
 146                 BUG_ON(atomic_read(&ptc->anon_map_count));
 147                 BUG_ON(atomic_read(&ptc->file_map_count));
 148                 page_ext = page_ext_next(page_ext);
 149         }
 150         page_ext_put(page_ext);
 151 }
 152
 153 void __page_table_check_pte_clear(struct mm_struct *mm, unsigned long addr,
 154                                   pte_t pte)
 155 {
 156         if (&init_mm == mm)
 157                 return;
 158
 159         if (pte_user_accessible_page(pte)) {
 160                 page_table_check_clear(pte_pfn(pte), PAGE_SIZE >> PAGE_SHIFT);
 161         }
 162 }
 163 EXPORT_SYMBOL(__page_table_check_pte_clear);
 164
 165 void __page_table_check_pmd_clear(struct mm_struct *mm, unsigned long addr,
 166                                   pmd_t pmd)
 167 {
 168         if (&init_mm == mm)
 169                 return;
 170
 171         if (pmd_user_accessible_page(pmd)) {
 172                 page_table_check_clear(pmd_pfn(pmd), PMD_SIZE >> PAGE_SHIFT);
 173         }
 174 }
 175 EXPORT_SYMBOL(__page_table_check_pmd_clear);
 176
 177 void __page_table_check_pud_clear(struct mm_struct *mm, unsigned long addr,
 178                                   pud_t pud)
 179 {
 180         if (&init_mm == mm)
 181                 return;
 182
 183         if (pud_user_accessible_page(pud)) {
 184                 page_table_check_clear(pud_pfn(pud), PUD_SIZE >> PAGE_SHIFT);
 185         }
 186 }
 187 EXPORT_SYMBOL(__page_table_check_pud_clear);
 188
 189 void __page_table_check_pte_set(struct mm_struct *mm, unsigned long addr,
 190                                 pte_t *ptep, pte_t pte)
 191 {
 192         if (&init_mm == mm)
 193                 return;
 194
 195         __page_table_check_pte_clear(mm, addr, ptep_get(ptep));
 196         if (pte_user_accessible_page(pte)) {
 197                 page_table_check_set(mm, addr, pte_pfn(pte),
 198                                      PAGE_SIZE >> PAGE_SHIFT,
 199                                      pte_write(pte));
 200         }
 201 }
 202 EXPORT_SYMBOL(__page_table_check_pte_set);
 203
 204 void __page_table_check_pmd_set(struct mm_struct *mm, unsigned long addr,
 205                                 pmd_t *pmdp, pmd_t pmd)
 206 {
 207         if (&init_mm == mm)
 208                 return;
 209
 210         __page_table_check_pmd_clear(mm, addr, *pmdp);
 211         if (pmd_user_accessible_page(pmd)) {
 212                 page_table_check_set(mm, addr, pmd_pfn(pmd),
 213                                      PMD_SIZE >> PAGE_SHIFT,
 214                                      pmd_write(pmd));
 215         }
 216 }
 217 EXPORT_SYMBOL(__page_table_check_pmd_set);
 218
 219 void __page_table_check_pud_set(struct mm_struct *mm, unsigned long addr,
 220                                 pud_t *pudp, pud_t pud)
 221 {
 222         if (&init_mm == mm)
 223                 return;
 224
 225         __page_table_check_pud_clear(mm, addr, *pudp);
 226         if (pud_user_accessible_page(pud)) {
 227                 page_table_check_set(mm, addr, pud_pfn(pud),
 228                                      PUD_SIZE >> PAGE_SHIFT,
 229                                      pud_write(pud));
 230         }
 231 }
 232 EXPORT_SYMBOL(__page_table_check_pud_set);
 233
 234 void __page_table_check_pte_clear_range(struct mm_struct *mm,
 235                                         unsigned long addr,
 236                                         pmd_t pmd)
 237 {
 238         if (&init_mm == mm)
 239                 return;
 240
 241         if (!pmd_bad(pmd) && !pmd_leaf(pmd)) {
 242                 pte_t *ptep = pte_offset_map(&pmd, addr);
 243                 unsigned long i;
 244
 245                 if (WARN_ON(!ptep))
 246                         return;
 247                 for (i = 0; i < PTRS_PER_PTE; i++) {
 248                         __page_table_check_pte_clear(mm, addr, ptep_get(ptep));
 249                         addr += PAGE_SIZE;
 250                         ptep++;
 251                 }
 252                 pte_unmap(ptep - PTRS_PER_PTE);
 253         }
 254 }