mm: allow drivers to prevent new writable mappings

This patch (of 6):

The i_mmap_writable field counts existing writable mappings of an
address_space.  To allow drivers to prevent new writable mappings, make
this counter signed and prevent new writable mappings if it is negative.
This is modelled after i_writecount and DENYWRITE.

This will be required by the shmem-sealing infrastructure to prevent any
new writable mappings after the WRITE seal has been set.  In case there
exists a writable mapping, this operation will fail with EBUSY.

Note that we rely on the fact that iff you already own a writable mapping,
you can increase the counter without using the helpers.  This is the same
that we do for i_writecount.

Signed-off-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Michael Kerrisk <mtk.manpages@gmail.com>
Cc: Ryan Lortie <desrt@desrt.ca>
Cc: Lennart Poettering <lennart@poettering.net>
Cc: Daniel Mack <zonque@gmail.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 24 insertions, 6 deletions

diff --git a/mm/mmap.c b/mm/mmap.c
index 64c9d736155c..c1f2ea4a0b99 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -221,7 +221,7 @@ static void __remove_shared_vm_struct(struct vm_area_struct *vma,
         if (vma->vm_flags & VM_DENYWRITE)
                 atomic_inc(&file_inode(file)->i_writecount);
         if (vma->vm_flags & VM_SHARED)
-                mapping->i_mmap_writable--;
+                mapping_unmap_writable(mapping);
 
         flush_dcache_mmap_lock(mapping);
         if (unlikely(vma->vm_flags & VM_NONLINEAR))
@@ -622,7 +622,7 @@ static void __vma_link_file(struct vm_area_struct *vma)
                 if (vma->vm_flags & VM_DENYWRITE)
                         atomic_dec(&file_inode(file)->i_writecount);
                 if (vma->vm_flags & VM_SHARED)
-                        mapping->i_mmap_writable++;
+                        atomic_inc(&mapping->i_mmap_writable);
 
                 flush_dcache_mmap_lock(mapping);
                 if (unlikely(vma->vm_flags & VM_NONLINEAR))
@@ -1577,6 +1577,17 @@ munmap_back:
                         if (error)
                                 goto free_vma;
                 }
+                if (vm_flags & VM_SHARED) {
+                        error = mapping_map_writable(file->f_mapping);
+                        if (error)
+                                goto allow_write_and_free_vma;
+                }
+
+                /* ->mmap() can change vma->vm_file, but must guarantee that
+                 * vma_link() below can deny write-access if VM_DENYWRITE is set
+                 * and map writably if VM_SHARED is set. This usually means the
+                 * new file must not have been exposed to user-space, yet.
+                 */
                 vma->vm_file = get_file(file);
                 error = file->f_op->mmap(file, vma);
                 if (error)
@@ -1616,8 +1627,12 @@ munmap_back:
 
         vma_link(mm, vma, prev, rb_link, rb_parent);
         /* Once vma denies write, undo our temporary denial count */
-        if (vm_flags & VM_DENYWRITE)
-                allow_write_access(file);
+        if (file) {
+                if (vm_flags & VM_SHARED)
+                        mapping_unmap_writable(file->f_mapping);
+                if (vm_flags & VM_DENYWRITE)
+                        allow_write_access(file);
+        }
         file = vma->vm_file;
 out:
         perf_event_mmap(vma);
@@ -1646,14 +1661,17 @@ out:
         return addr;
 
 unmap_and_free_vma:
-        if (vm_flags & VM_DENYWRITE)
-                allow_write_access(file);
         vma->vm_file = NULL;
         fput(file);
 
         /* Undo any partial mapping done by a device driver. */
         unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
         charged = 0;
+        if (vm_flags & VM_SHARED)
+                mapping_unmap_writable(file->f_mapping);
+allow_write_and_free_vma:
+        if (vm_flags & VM_DENYWRITE)
+                allow_write_access(file);
 free_vma:
         kmem_cache_free(vm_area_cachep, vma);
 unacct_error: