On 4/14/20 8:28 PM, Andrii Nakryiko wrote:
On Tue, Apr 14, 2020 at 9:58 AM Jann Horn <jannh@xxxxxxxxxx> wrote:
On Fri, Apr 10, 2020 at 10:26 PM Andrii Nakryiko <andriin@xxxxxx> wrote:
VM_MAYWRITE flag during initial memory mapping determines if already mmap()'ed
pages can be later remapped as writable ones through mprotect() call. To
prevent user application to rewrite contents of memory-mapped as read-only and
subsequently frozen BPF map, remove VM_MAYWRITE flag completely on initially
read-only mapping.
Alternatively, we could treat any memory-mapping on unfrozen map as writable
and bump writecnt instead. But there is little legitimate reason to map
BPF map as read-only and then re-mmap() it as writable through mprotect(),
instead of just mmap()'ing it as read/write from the very beginning.
Also, at the suggestion of Jann Horn, drop unnecessary refcounting in mmap
operations. We can just rely on VMA holding reference to BPF map's file
properly.
Fixes: fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY")
Reported-by: Jann Horn <jannh@xxxxxxxxxx>
Signed-off-by: Andrii Nakryiko <andriin@xxxxxx>
Reviewed-by: Jann Horn <jannh@xxxxxxxxxx>
(in the sense that I think this patch is good and correct, but does
not fix the entire problem in the bigger picture)
I agree, we'll continue discussion on the other thread, but this
should be applied as a bug fix anyways.
Applied, thanks!
