Linux 内核版本：Linux/x86 6.0.0-rc1（commit 37887783b3fef877bf34b8992c9199864da4afcb）
该漏洞允许攻击者通过 UFFDIO_CONTINUE 满足 can_follow_write_pte 函数（该函数检查 FOLL_FORCE、FOLL_COW 和 pte_dirty）的条件，从而向只读共享内存页写入任意内容。
/*
* FOLL_FORCE can write to even unwritable pte's, but only
* after we've gone through a COW cycle and they are dirty.
*/
static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
{
return pte_write(pte) ||
((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
}
上述函数用于判断一个 pte 是否可写。
如果满足以下条件之一，该 pte 即被视为可写：
要满足条件 2，需要设置以下三个标志：
FOLL_FORCE
static ssize_t mem_rw(struct file *file, char __user *buf,
size_t count, loff_t *ppos, int write)
{
...
flags = FOLL_FORCE | (write ? FOLL_WRITE : 0);
while (count > 0) {
size_t this_len = min_t(size_t, count, PAGE_SIZE);
if (write && copy_from_user(page, buf, this_len)) {
copied = -EFAULT;
break;
}
this_len = access_remote_vm(mm, addr, page, this_len, flags); // __get_user_pages with FOLL_FORCE on
if (!this_len) {
if (!copied)
copied = -EIO;
break;
}
...
}
上述函数对 /proc/<pid>/mem 执行读写操作。
通过使用该函数，你可以在 FOLL_FORCE 标志开启的情况下到达 __get_user_pages 函数。
尽管 FOLL_FORCE 本意是用于 ptrace，但其必要性已在以下 commit 中得到证实：https://github.com/torvalds/linux/commit/f511c0b17b081562dca8ac5061dfa86db4c66cc2
FOLL_COW
/*
* mmap_lock must be held on entry. If @locked != NULL and *@flags
* does not include FOLL_NOWAIT, the mmap_lock may be released. If it
* is, *@locked will be set to 0 and -EBUSY returned.
*/
static int faultin_page(struct vm_area_struct *vma,
unsigned long address, unsigned int *flags, bool unshare,
int *locked)
{
...
/*
* The VM_FAULT_WRITE bit tells us that do_wp_page has broken COW when
* necessary, even if maybe_mkwrite decided not to set pte_write. We
* can thus safely do subsequent page lookups as if they were reads.
* But only do so when looping for pte_write is futile: in some cases
* userspace may also be wanting to write to the gotten user page,
* which a read fault here might prevent (a readonly page might get
* reCOWed by userspace write).
*/
if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE))
*flags |= FOLL_COW;
return 0;
}
可以利用 faultin_page 函数中与 FOLL_COW 的 OR 操作，这是 Dirty COW 补丁的一部分。
static long __get_user_pages(struct mm_struct *mm,
unsigned long start, unsigned long nr_pages,
unsigned int gup_flags, struct page **pages,
struct vm_area_struct **vmas, int *locked)
{
...
retry:
/*
* If we have a pending SIGKILL, don't keep faulting pages and
* potentially allocating memory.
*/
if (fatal_signal_pending(current)) {
ret = -EINTR;
goto out;
}
cond_resched();
page = follow_page_mask(vma, start, foll_flags, &ctx); // can_follow_write_pte
if (!page || PTR_ERR(page) == -EMLINK) {
ret = faultin_page(vma, start, &foll_flags,
PTR_ERR(page) == -EMLINK, locked); // flags |= FOLL_COW
switch (ret) {
case 0:
goto retry; // try follow page again
case -EBUSY:
case -EAGAIN:
ret = 0;
fallthrough;
case -EFAULT:
case -ENOMEM:
case -EHWPOISON:
goto out;
}
BUG();
} else if (PTR_ERR(page) == -EEXIST) {
...
}
为了在 FOLL_COW 标志开启的情况下到达 can_follow_write_pte 函数，你需要在 __get_user_pages 函数内调用 faultin_page 函数，跳转到 retry 标签，然后再次调用 faultin_page 函数。
pte_dirty
该条件可通过以下 commit 得到满足：https://github.com/torvalds/linux/commit/9ae0f87d009ca6c4aab2882641ddfc319727e3db
/*
* Install PTEs, to map dst_addr (within dst_vma) to page.
*
* This function handles both MCOPY_ATOMIC_NORMAL and _CONTINUE for both shmem
* and anon, and for both shared and private VMAs.
*/
int mfill_atomic_install_pte(struct mm_struct *dst_mm, pmd_t *dst_pmd,
struct vm_area_struct *dst_vma,
unsigned long dst_addr, struct page *page,
bool newly_allocated, bool wp_copy)
{
...
_dst_pte = mk_pte(page, dst_vma->vm_page_prot);
_dst_pte = pte_mkdirty(_dst_pte); // set pte dirty unconditionally
if (page_in_cache && !vm_shared)
writable = false;
...
}
由于上述补丁，可以无条件地为只读共享内存页安装处于 dirty 状态的 pte。
如果这三个标志均得到满足，can_follow_write_pte 函数将返回 true。
static struct page *follow_page_pte(struct vm_area_struct *vma,
unsigned long address, pmd_t *pmd, unsigned int flags,
struct dev_pagemap **pgmap)
{
...
// true && !true == false
if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) {
pte_unmap_unlock(ptep, ptl);
return NULL;
}
page = vm_normal_page(vma, address, pte); // get read-only shared memory page
...
out:
pte_unmap_unlock(ptep, ptl);
return page;
no_page:
pte_unmap_unlock(ptep, ptl);
if (!pte_none(pte))
return NULL;
return no_page_table(vma, flags);
}
follow_page_pte 函数返回只读共享内存页。
以下是 PoC 所证实的竞争场景，PoC 将在后文介绍。
| madvise 和 read | UFFDIO_CONTINUE ioctl | pwrite |
|---|---|---|
| madvise // 清除页面 | ||
| shmem_fault // 读缺页 | ||
| handle_userfault | ||
| userfaultfd_continue | ||
| mcontinue_atomic_pte | ||
| ret = shmem_getpage(inode, pgoff, &page, SGP_NOALLOC); // 获取页面 | ||
| mfill_atomic_install_pte | ||
| _dst_pte = pte_mkdirty(_dst_pte); // 将 pte 标记为 dirty | ||
| set_pte_at(dst_mm, dst_addr, dst_pte, _dst_pte); // 安装 pte | mem_rw | |
| access_remote_vm // 带有 FOLL_FORCE | ||
| __get_user_pages | ||
| can_follow_write_pte // 无 FOLL_COW，返回 0 | ||
| faultin_page | ||
| flags | ||
| retry: | ||
| follow_page_pte | ||
| madvise // 清除页面 | ||
| shmem_fault // 读缺页 | ||
| handle_userfault | ||
| userfaultfd_continue | ||
| mcontinue_atomic_pte | ||
| ret = shmem_getpage(inode, pgoff, &page, SGP_NOALLOC); // 获取页面 | ||
| mfill_atomic_install_pte | ||
| _dst_pte = pte_mkdirty(_dst_pte); // 将 pte 标记为 dirty | ||
| set_pte_at(dst_mm, dst_addr, dst_pte, _dst_pte); // 安装 pte | ||
| can_follow_write_pte // 返回 1 | ||
| copy_to_user(buf, page, this_len) // 向只读页面写入内容 |
madvise 和 read 例程执行两次；第一次执行触发 __get_user_pages 的 retry，第二次执行引导 follow_page_pte 返回由 mfill_atomic_install_pte 置为 dirty 的 pte 所指向的页面。
你可以通过上面的链接查看 David Hildenbrand 的复现程序。
然而，由于该复现程序难以识别确切的竞争场景，我修改了复现程序，使其更倾向于线性执行，并相应地修改了 Linux 内核源代码。
.config:
...
CONFIG_USERFAULTFD=y
CONFIG_HAVE_ARCH_USERFAULTFD_WP=y
CONFIG_HAVE_ARCH_USERFAULTFD_MINOR=y
...
PoC: (poc.c)
Patch: (poc_deayzl.patch)
测试前必须完成以下预备步骤。（david 的复现程序说明中给出的文件路径是 /tmp/foo，但在当前版本中 tmpfs 不是共享内存，因此 userfaultfd 注册会失败）
sudo -s
echo "asdf" > /dev/shm/foo
chmod 0404 /dev/shm/foo
exit
运行 PoC 后，你将看到以下界面。
lore.kernel patch v1: https://lore.kernel.org/linux-mm/[email protected]/#r
lore.kernel patch v2: https://lore.kernel.org/all/[email protected]/T/#u