mm: introduce VM_POPULATE flag to better deal with racy userspace programs

The vm_populate() code populates user mappings without constantly
holding the mmap_sem.  This makes it susceptible to racy userspace
programs: the user mappings may change while vm_populate() is running,
and in this case vm_populate() may end up populating the new mapping
instead of the old one.

In order to reduce the possibility of userspace getting surprised by
this behavior, this change introduces the VM_POPULATE vma flag which
gets set on vmas we want vm_populate() to work on.  This way
vm_populate() may still end up populating the new mapping after such a
race, but only if the new mapping is also one that the user has
requested (using MAP_SHARED, MAP_LOCKED or mlock) to be populated.

Signed-off-by: Michel Lespinasse <walken@google.com>
Acked-by: Rik van Riel <riel@redhat.com>
Tested-by: Andy Lutomirski <luto@amacapital.net>
Cc: Greg Ungerer <gregungerer@westnet.com.au>
Cc: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 10 insertions, 2 deletions

diff --git a/mm/fremap.c b/mm/fremap.c
index 503a72387087..0cd4c11488ed 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -204,8 +204,10 @@ get_write_lock:
                         unsigned long addr;
                         struct file *file = get_file(vma->vm_file);
 
-                        addr = mmap_region(file, start, size,
-                                        vma->vm_flags, pgoff);
+                        vm_flags = vma->vm_flags;
+                        if (!(flags & MAP_NONBLOCK))
+                                vm_flags |= VM_POPULATE;
+                        addr = mmap_region(file, start, size, vm_flags, pgoff);
                         fput(file);
                         if (IS_ERR_VALUE(addr)) {
                                 err = addr;
@@ -224,6 +226,12 @@ get_write_lock:
                 mutex_unlock(&mapping->i_mmap_mutex);
         }
 
+        if (!(flags & MAP_NONBLOCK) && !(vma->vm_flags & VM_POPULATE)) {
+                if (!has_write_lock)
+                        goto get_write_lock;
+                vma->vm_flags |= VM_POPULATE;
+        }
+
         if (vma->vm_flags & VM_LOCKED) {
                 /*
                  * drop PG_Mlocked flag for over-mapped range