1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * Test handling of code that might set PTE/PMD dirty in read-only VMAs. 4 * Setting a PTE/PMD dirty must not accidentally set the PTE/PMD writable. 5 * 6 * Copyright 2023, Red Hat, Inc. 7 * 8 * Author(s): David Hildenbrand <david@redhat.com> 9 */ 10 #include <fcntl.h> 11 #include <signal.h> 12 #include <unistd.h> 13 #include <string.h> 14 #include <errno.h> 15 #include <stdlib.h> 16 #include <stdbool.h> 17 #include <stdint.h> 18 #include <sys/mman.h> 19 #include <setjmp.h> 20 #include <sys/syscall.h> 21 #include <sys/ioctl.h> 22 #include <linux/userfaultfd.h> 23 #include <linux/mempolicy.h> 24 25 #include "../kselftest.h" 26 #include "vm_util.h" 27 28 static size_t pagesize; 29 static size_t thpsize; 30 static int mem_fd; 31 static int pagemap_fd; 32 static sigjmp_buf env; 33 34 static void signal_handler(int sig) 35 { 36 if (sig == SIGSEGV) 37 siglongjmp(env, 1); 38 siglongjmp(env, 2); 39 } 40 41 static void do_test_write_sigsegv(char *mem) 42 { 43 char orig = *mem; 44 int ret; 45 46 if (signal(SIGSEGV, signal_handler) == SIG_ERR) { 47 ksft_test_result_fail("signal() failed\n"); 48 return; 49 } 50 51 ret = sigsetjmp(env, 1); 52 if (!ret) 53 *mem = orig + 1; 54 55 if (signal(SIGSEGV, SIG_DFL) == SIG_ERR) 56 ksft_test_result_fail("signal() failed\n"); 57 58 ksft_test_result(ret == 1 && *mem == orig, 59 "SIGSEGV generated, page not modified\n"); 60 } 61 62 static char *mmap_thp_range(int prot, char **_mmap_mem, size_t *_mmap_size) 63 { 64 const size_t mmap_size = 2 * thpsize; 65 char *mem, *mmap_mem; 66 67 mmap_mem = mmap(NULL, mmap_size, prot, MAP_PRIVATE|MAP_ANON, 68 -1, 0); 69 if (mmap_mem == MAP_FAILED) { 70 ksft_test_result_fail("mmap() failed\n"); 71 return MAP_FAILED; 72 } 73 mem = (char *)(((uintptr_t)mmap_mem + thpsize) & ~(thpsize - 1)); 74 75 if (madvise(mem, thpsize, MADV_HUGEPAGE)) { 76 ksft_test_result_skip("MADV_HUGEPAGE failed\n"); 77 munmap(mmap_mem, mmap_size); 78 return MAP_FAILED; 79 } 80 81 *_mmap_mem = mmap_mem; 82 *_mmap_size = mmap_size; 83 return mem; 84 } 85 86 static void test_ptrace_write(void) 87 { 88 char data = 1; 89 char *mem; 90 int ret; 91 92 ksft_print_msg("[INFO] PTRACE write access\n"); 93 94 mem = mmap(NULL, pagesize, PROT_READ, MAP_PRIVATE|MAP_ANON, -1, 0); 95 if (mem == MAP_FAILED) { 96 ksft_test_result_fail("mmap() failed\n"); 97 return; 98 } 99 100 /* Fault in the shared zeropage. */ 101 if (*mem != 0) { 102 ksft_test_result_fail("Memory not zero\n"); 103 goto munmap; 104 } 105 106 /* 107 * Unshare the page (populating a fresh anon page that might be set 108 * dirty in the PTE) in the read-only VMA using ptrace (FOLL_FORCE). 109 */ 110 lseek(mem_fd, (uintptr_t) mem, SEEK_SET); 111 ret = write(mem_fd, &data, 1); 112 if (ret != 1 || *mem != data) { 113 ksft_test_result_fail("write() failed\n"); 114 goto munmap; 115 } 116 117 do_test_write_sigsegv(mem); 118 munmap: 119 munmap(mem, pagesize); 120 } 121 122 static void test_ptrace_write_thp(void) 123 { 124 char *mem, *mmap_mem; 125 size_t mmap_size; 126 char data = 1; 127 int ret; 128 129 ksft_print_msg("[INFO] PTRACE write access to THP\n"); 130 131 mem = mmap_thp_range(PROT_READ, &mmap_mem, &mmap_size); 132 if (mem == MAP_FAILED) 133 return; 134 135 /* 136 * Write to the first subpage in the read-only VMA using 137 * ptrace(FOLL_FORCE), eventually placing a fresh THP that is marked 138 * dirty in the PMD. 139 */ 140 lseek(mem_fd, (uintptr_t) mem, SEEK_SET); 141 ret = write(mem_fd, &data, 1); 142 if (ret != 1 || *mem != data) { 143 ksft_test_result_fail("write() failed\n"); 144 goto munmap; 145 } 146 147 /* MM populated a THP if we got the last subpage populated as well. */ 148 if (!pagemap_is_populated(pagemap_fd, mem + thpsize - pagesize)) { 149 ksft_test_result_skip("Did not get a THP populated\n"); 150 goto munmap; 151 } 152 153 do_test_write_sigsegv(mem); 154 munmap: 155 munmap(mmap_mem, mmap_size); 156 } 157 158 static void test_page_migration(void) 159 { 160 char *mem; 161 162 ksft_print_msg("[INFO] Page migration\n"); 163 164 mem = mmap(NULL, pagesize, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, 165 -1, 0); 166 if (mem == MAP_FAILED) { 167 ksft_test_result_fail("mmap() failed\n"); 168 return; 169 } 170 171 /* Populate a fresh page and dirty it. */ 172 memset(mem, 1, pagesize); 173 if (mprotect(mem, pagesize, PROT_READ)) { 174 ksft_test_result_fail("mprotect() failed\n"); 175 goto munmap; 176 } 177 178 /* Trigger page migration. Might not be available or fail. */ 179 if (syscall(__NR_mbind, mem, pagesize, MPOL_LOCAL, NULL, 0x7fful, 180 MPOL_MF_MOVE)) { 181 ksft_test_result_skip("mbind() failed\n"); 182 goto munmap; 183 } 184 185 do_test_write_sigsegv(mem); 186 munmap: 187 munmap(mem, pagesize); 188 } 189 190 static void test_page_migration_thp(void) 191 { 192 char *mem, *mmap_mem; 193 size_t mmap_size; 194 195 ksft_print_msg("[INFO] Page migration of THP\n"); 196 197 mem = mmap_thp_range(PROT_READ|PROT_WRITE, &mmap_mem, &mmap_size); 198 if (mem == MAP_FAILED) 199 return; 200 201 /* 202 * Write to the first page, which might populate a fresh anon THP 203 * and dirty it. 204 */ 205 memset(mem, 1, pagesize); 206 if (mprotect(mem, thpsize, PROT_READ)) { 207 ksft_test_result_fail("mprotect() failed\n"); 208 goto munmap; 209 } 210 211 /* MM populated a THP if we got the last subpage populated as well. */ 212 if (!pagemap_is_populated(pagemap_fd, mem + thpsize - pagesize)) { 213 ksft_test_result_skip("Did not get a THP populated\n"); 214 goto munmap; 215 } 216 217 /* Trigger page migration. Might not be available or fail. */ 218 if (syscall(__NR_mbind, mem, thpsize, MPOL_LOCAL, NULL, 0x7fful, 219 MPOL_MF_MOVE)) { 220 ksft_test_result_skip("mbind() failed\n"); 221 goto munmap; 222 } 223 224 do_test_write_sigsegv(mem); 225 munmap: 226 munmap(mmap_mem, mmap_size); 227 } 228 229 static void test_pte_mapped_thp(void) 230 { 231 char *mem, *mmap_mem; 232 size_t mmap_size; 233 234 ksft_print_msg("[INFO] PTE-mapping a THP\n"); 235 236 mem = mmap_thp_range(PROT_READ|PROT_WRITE, &mmap_mem, &mmap_size); 237 if (mem == MAP_FAILED) 238 return; 239 240 /* 241 * Write to the first page, which might populate a fresh anon THP 242 * and dirty it. 243 */ 244 memset(mem, 1, pagesize); 245 if (mprotect(mem, thpsize, PROT_READ)) { 246 ksft_test_result_fail("mprotect() failed\n"); 247 goto munmap; 248 } 249 250 /* MM populated a THP if we got the last subpage populated as well. */ 251 if (!pagemap_is_populated(pagemap_fd, mem + thpsize - pagesize)) { 252 ksft_test_result_skip("Did not get a THP populated\n"); 253 goto munmap; 254 } 255 256 /* Trigger PTE-mapping the THP by mprotect'ing the last subpage. */ 257 if (mprotect(mem + thpsize - pagesize, pagesize, 258 PROT_READ|PROT_WRITE)) { 259 ksft_test_result_fail("mprotect() failed\n"); 260 goto munmap; 261 } 262 263 do_test_write_sigsegv(mem); 264 munmap: 265 munmap(mmap_mem, mmap_size); 266 } 267 268 #ifdef __NR_userfaultfd 269 static void test_uffdio_copy(void) 270 { 271 struct uffdio_register uffdio_register; 272 struct uffdio_copy uffdio_copy; 273 struct uffdio_api uffdio_api; 274 char *dst, *src; 275 int uffd; 276 277 ksft_print_msg("[INFO] UFFDIO_COPY\n"); 278 279 src = malloc(pagesize); 280 memset(src, 1, pagesize); 281 dst = mmap(NULL, pagesize, PROT_READ, MAP_PRIVATE|MAP_ANON, -1, 0); 282 if (dst == MAP_FAILED) { 283 ksft_test_result_fail("mmap() failed\n"); 284 return; 285 } 286 287 uffd = syscall(__NR_userfaultfd, O_CLOEXEC | O_NONBLOCK); 288 if (uffd < 0) { 289 ksft_test_result_skip("__NR_userfaultfd failed\n"); 290 goto munmap; 291 } 292 293 uffdio_api.api = UFFD_API; 294 uffdio_api.features = 0; 295 if (ioctl(uffd, UFFDIO_API, &uffdio_api) < 0) { 296 ksft_test_result_fail("UFFDIO_API failed\n"); 297 goto close_uffd; 298 } 299 300 uffdio_register.range.start = (unsigned long) dst; 301 uffdio_register.range.len = pagesize; 302 uffdio_register.mode = UFFDIO_REGISTER_MODE_MISSING; 303 if (ioctl(uffd, UFFDIO_REGISTER, &uffdio_register)) { 304 ksft_test_result_fail("UFFDIO_REGISTER failed\n"); 305 goto close_uffd; 306 } 307 308 /* Place a page in a read-only VMA, which might set the PTE dirty. */ 309 uffdio_copy.dst = (unsigned long) dst; 310 uffdio_copy.src = (unsigned long) src; 311 uffdio_copy.len = pagesize; 312 uffdio_copy.mode = 0; 313 if (ioctl(uffd, UFFDIO_COPY, &uffdio_copy)) { 314 ksft_test_result_fail("UFFDIO_COPY failed\n"); 315 goto close_uffd; 316 } 317 318 do_test_write_sigsegv(dst); 319 close_uffd: 320 close(uffd); 321 munmap: 322 munmap(dst, pagesize); 323 free(src); 324 } 325 #endif /* __NR_userfaultfd */ 326 327 int main(void) 328 { 329 int err, tests = 2; 330 331 pagesize = getpagesize(); 332 thpsize = read_pmd_pagesize(); 333 if (thpsize) { 334 ksft_print_msg("[INFO] detected THP size: %zu KiB\n", 335 thpsize / 1024); 336 tests += 3; 337 } 338 #ifdef __NR_userfaultfd 339 tests += 1; 340 #endif /* __NR_userfaultfd */ 341 342 ksft_print_header(); 343 ksft_set_plan(tests); 344 345 mem_fd = open("/proc/self/mem", O_RDWR); 346 if (mem_fd < 0) 347 ksft_exit_fail_msg("opening /proc/self/mem failed\n"); 348 pagemap_fd = open("/proc/self/pagemap", O_RDONLY); 349 if (pagemap_fd < 0) 350 ksft_exit_fail_msg("opening /proc/self/pagemap failed\n"); 351 352 /* 353 * On some ptrace(FOLL_FORCE) write access via /proc/self/mem in 354 * read-only VMAs, the kernel may set the PTE/PMD dirty. 355 */ 356 test_ptrace_write(); 357 if (thpsize) 358 test_ptrace_write_thp(); 359 /* 360 * On page migration, the kernel may set the PTE/PMD dirty when 361 * remapping the page. 362 */ 363 test_page_migration(); 364 if (thpsize) 365 test_page_migration_thp(); 366 /* PTE-mapping a THP might propagate the dirty PMD bit to the PTEs. */ 367 if (thpsize) 368 test_pte_mapped_thp(); 369 /* Placing a fresh page via userfaultfd may set the PTE dirty. */ 370 #ifdef __NR_userfaultfd 371 test_uffdio_copy(); 372 #endif /* __NR_userfaultfd */ 373 374 err = ksft_get_fail_cnt(); 375 if (err) 376 ksft_exit_fail_msg("%d out of %d tests failed\n", 377 err, ksft_test_num()); 378 return ksft_exit_pass(); 379 } 380