2 * mpx.c - Memory Protection eXtensions
4 * Copyright (c) 2014, Intel Corporation.
5 * Qiaowei Ren <qiaowei.ren@intel.com>
6 * Dave Hansen <dave.hansen@intel.com>
8 #include <linux/kernel.h>
9 #include <linux/slab.h>
10 #include <linux/syscalls.h>
11 #include <linux/sched/sysctl.h>
15 #include <asm/mmu_context.h>
17 #include <asm/processor.h>
18 #include <asm/fpu/internal.h>
20 static const char *mpx_mapping_name(struct vm_area_struct
*vma
)
25 static struct vm_operations_struct mpx_vma_ops
= {
26 .name
= mpx_mapping_name
,
29 static int is_mpx_vma(struct vm_area_struct
*vma
)
31 return (vma
->vm_ops
== &mpx_vma_ops
);
35 * This is really a simplified "vm_mmap". it only handles MPX
36 * bounds tables (the bounds directory is user-allocated).
38 * Later on, we use the vma->vm_ops to uniquely identify these
41 static unsigned long mpx_mmap(unsigned long len
)
44 unsigned long addr
, pgoff
;
45 struct mm_struct
*mm
= current
->mm
;
47 struct vm_area_struct
*vma
;
49 /* Only bounds table and bounds directory can be allocated here */
50 if (len
!= MPX_BD_SIZE_BYTES
&& len
!= MPX_BT_SIZE_BYTES
)
53 down_write(&mm
->mmap_sem
);
55 /* Too many mappings? */
56 if (mm
->map_count
> sysctl_max_map_count
) {
61 /* Obtain the address to map to. we verify (or select) it and ensure
62 * that it represents a valid section of the address space.
64 addr
= get_unmapped_area(NULL
, 0, len
, 0, MAP_ANONYMOUS
| MAP_PRIVATE
);
65 if (addr
& ~PAGE_MASK
) {
70 vm_flags
= VM_READ
| VM_WRITE
| VM_MPX
|
71 mm
->def_flags
| VM_MAYREAD
| VM_MAYWRITE
| VM_MAYEXEC
;
73 /* Set pgoff according to addr for anon_vma */
74 pgoff
= addr
>> PAGE_SHIFT
;
76 ret
= mmap_region(NULL
, addr
, len
, vm_flags
, pgoff
);
77 if (IS_ERR_VALUE(ret
))
80 vma
= find_vma(mm
, ret
);
85 vma
->vm_ops
= &mpx_vma_ops
;
87 if (vm_flags
& VM_LOCKED
) {
88 up_write(&mm
->mmap_sem
);
89 mm_populate(ret
, len
);
94 up_write(&mm
->mmap_sem
);
104 static int get_reg_offset(struct insn
*insn
, struct pt_regs
*regs
,
109 static const int regoff
[] = {
110 offsetof(struct pt_regs
, ax
),
111 offsetof(struct pt_regs
, cx
),
112 offsetof(struct pt_regs
, dx
),
113 offsetof(struct pt_regs
, bx
),
114 offsetof(struct pt_regs
, sp
),
115 offsetof(struct pt_regs
, bp
),
116 offsetof(struct pt_regs
, si
),
117 offsetof(struct pt_regs
, di
),
119 offsetof(struct pt_regs
, r8
),
120 offsetof(struct pt_regs
, r9
),
121 offsetof(struct pt_regs
, r10
),
122 offsetof(struct pt_regs
, r11
),
123 offsetof(struct pt_regs
, r12
),
124 offsetof(struct pt_regs
, r13
),
125 offsetof(struct pt_regs
, r14
),
126 offsetof(struct pt_regs
, r15
),
129 int nr_registers
= ARRAY_SIZE(regoff
);
131 * Don't possibly decode a 32-bit instructions as
132 * reading a 64-bit-only register.
134 if (IS_ENABLED(CONFIG_X86_64
) && !insn
->x86_64
)
139 regno
= X86_MODRM_RM(insn
->modrm
.value
);
140 if (X86_REX_B(insn
->rex_prefix
.value
) == 1)
145 regno
= X86_SIB_INDEX(insn
->sib
.value
);
146 if (X86_REX_X(insn
->rex_prefix
.value
) == 1)
151 regno
= X86_SIB_BASE(insn
->sib
.value
);
152 if (X86_REX_B(insn
->rex_prefix
.value
) == 1)
157 pr_err("invalid register type");
162 if (regno
> nr_registers
) {
163 WARN_ONCE(1, "decoded an instruction with an invalid register");
166 return regoff
[regno
];
170 * return the address being referenced be instruction
171 * for rm=3 returning the content of the rm reg
172 * for rm!=3 calculates the address using SIB and Disp
174 static void __user
*mpx_get_addr_ref(struct insn
*insn
, struct pt_regs
*regs
)
176 unsigned long addr
, base
, indx
;
177 int addr_offset
, base_offset
, indx_offset
;
180 insn_get_modrm(insn
);
182 sib
= insn
->sib
.value
;
184 if (X86_MODRM_MOD(insn
->modrm
.value
) == 3) {
185 addr_offset
= get_reg_offset(insn
, regs
, REG_TYPE_RM
);
188 addr
= regs_get_register(regs
, addr_offset
);
190 if (insn
->sib
.nbytes
) {
191 base_offset
= get_reg_offset(insn
, regs
, REG_TYPE_BASE
);
195 indx_offset
= get_reg_offset(insn
, regs
, REG_TYPE_INDEX
);
199 base
= regs_get_register(regs
, base_offset
);
200 indx
= regs_get_register(regs
, indx_offset
);
201 addr
= base
+ indx
* (1 << X86_SIB_SCALE(sib
));
203 addr_offset
= get_reg_offset(insn
, regs
, REG_TYPE_RM
);
206 addr
= regs_get_register(regs
, addr_offset
);
208 addr
+= insn
->displacement
.value
;
210 return (void __user
*)addr
;
212 return (void __user
*)-1;
215 static int mpx_insn_decode(struct insn
*insn
,
216 struct pt_regs
*regs
)
218 unsigned char buf
[MAX_INSN_SIZE
];
219 int x86_64
= !test_thread_flag(TIF_IA32
);
223 not_copied
= copy_from_user(buf
, (void __user
*)regs
->ip
, sizeof(buf
));
224 nr_copied
= sizeof(buf
) - not_copied
;
226 * The decoder _should_ fail nicely if we pass it a short buffer.
227 * But, let's not depend on that implementation detail. If we
228 * did not get anything, just error out now.
232 insn_init(insn
, buf
, nr_copied
, x86_64
);
233 insn_get_length(insn
);
235 * copy_from_user() tries to get as many bytes as we could see in
236 * the largest possible instruction. If the instruction we are
237 * after is shorter than that _and_ we attempt to copy from
238 * something unreadable, we might get a short read. This is OK
239 * as long as the read did not stop in the middle of the
240 * instruction. Check to see if we got a partial instruction.
242 if (nr_copied
< insn
->length
)
245 insn_get_opcode(insn
);
247 * We only _really_ need to decode bndcl/bndcn/bndcu
248 * Error out on anything else.
250 if (insn
->opcode
.bytes
[0] != 0x0f)
252 if ((insn
->opcode
.bytes
[1] != 0x1a) &&
253 (insn
->opcode
.bytes
[1] != 0x1b))
262 * If a bounds overflow occurs then a #BR is generated. This
263 * function decodes MPX instructions to get violation address
264 * and set this address into extended struct siginfo.
266 * Note that this is not a super precise way of doing this.
267 * Userspace could have, by the time we get here, written
268 * anything it wants in to the instructions. We can not
269 * trust anything about it. They might not be valid
270 * instructions or might encode invalid registers, etc...
272 * The caller is expected to kfree() the returned siginfo_t.
274 siginfo_t
*mpx_generate_siginfo(struct pt_regs
*regs
,
275 struct xsave_struct
*xsave_buf
)
277 struct bndreg
*bndregs
, *bndreg
;
278 siginfo_t
*info
= NULL
;
283 err
= mpx_insn_decode(&insn
, regs
);
288 * We know at this point that we are only dealing with
291 insn_get_modrm(&insn
);
292 bndregno
= X86_MODRM_REG(insn
.modrm
.value
);
297 /* get the bndregs _area_ of the xsave structure */
298 bndregs
= get_xsave_addr(xsave_buf
, XSTATE_BNDREGS
);
303 /* now go select the individual register in the set of 4 */
304 bndreg
= &bndregs
[bndregno
];
306 info
= kzalloc(sizeof(*info
), GFP_KERNEL
);
312 * The registers are always 64-bit, but the upper 32
313 * bits are ignored in 32-bit mode. Also, note that the
314 * upper bounds are architecturally represented in 1's
317 * The 'unsigned long' cast is because the compiler
318 * complains when casting from integers to different-size
321 info
->si_lower
= (void __user
*)(unsigned long)bndreg
->lower_bound
;
322 info
->si_upper
= (void __user
*)(unsigned long)~bndreg
->upper_bound
;
323 info
->si_addr_lsb
= 0;
324 info
->si_signo
= SIGSEGV
;
326 info
->si_code
= SEGV_BNDERR
;
327 info
->si_addr
= mpx_get_addr_ref(&insn
, regs
);
329 * We were not able to extract an address from the instruction,
330 * probably because there was something invalid in it.
332 if (info
->si_addr
== (void *)-1) {
338 /* info might be NULL, but kfree() handles that */
343 static __user
void *task_get_bounds_dir(struct task_struct
*tsk
)
345 struct bndcsr
*bndcsr
;
347 if (!cpu_feature_enabled(X86_FEATURE_MPX
))
348 return MPX_INVALID_BOUNDS_DIR
;
351 * 32-bit binaries on 64-bit kernels are currently
354 if (IS_ENABLED(CONFIG_X86_64
) && test_thread_flag(TIF_IA32
))
355 return MPX_INVALID_BOUNDS_DIR
;
357 * The bounds directory pointer is stored in a register
358 * only accessible if we first do an xsave.
360 fpu_save_init(&tsk
->thread
.fpu
);
361 bndcsr
= get_xsave_addr(&tsk
->thread
.fpu
.state
->xsave
, XSTATE_BNDCSR
);
363 return MPX_INVALID_BOUNDS_DIR
;
366 * Make sure the register looks valid by checking the
369 if (!(bndcsr
->bndcfgu
& MPX_BNDCFG_ENABLE_FLAG
))
370 return MPX_INVALID_BOUNDS_DIR
;
373 * Lastly, mask off the low bits used for configuration
374 * flags, and return the address of the bounds table.
376 return (void __user
*)(unsigned long)
377 (bndcsr
->bndcfgu
& MPX_BNDCFG_ADDR_MASK
);
380 int mpx_enable_management(struct task_struct
*tsk
)
382 void __user
*bd_base
= MPX_INVALID_BOUNDS_DIR
;
383 struct mm_struct
*mm
= tsk
->mm
;
387 * runtime in the userspace will be responsible for allocation of
388 * the bounds directory. Then, it will save the base of the bounds
389 * directory into XSAVE/XRSTOR Save Area and enable MPX through
390 * XRSTOR instruction.
392 * xsave_state() is expected to be very expensive. Storing the bounds
393 * directory here means that we do not have to do xsave in the unmap
394 * path; we can just use mm->bd_addr instead.
396 bd_base
= task_get_bounds_dir(tsk
);
397 down_write(&mm
->mmap_sem
);
398 mm
->bd_addr
= bd_base
;
399 if (mm
->bd_addr
== MPX_INVALID_BOUNDS_DIR
)
402 up_write(&mm
->mmap_sem
);
406 int mpx_disable_management(struct task_struct
*tsk
)
408 struct mm_struct
*mm
= current
->mm
;
410 if (!cpu_feature_enabled(X86_FEATURE_MPX
))
413 down_write(&mm
->mmap_sem
);
414 mm
->bd_addr
= MPX_INVALID_BOUNDS_DIR
;
415 up_write(&mm
->mmap_sem
);
420 * With 32-bit mode, MPX_BT_SIZE_BYTES is 4MB, and the size of each
421 * bounds table is 16KB. With 64-bit mode, MPX_BT_SIZE_BYTES is 2GB,
422 * and the size of each bounds table is 4MB.
424 static int allocate_bt(long __user
*bd_entry
)
426 unsigned long expected_old_val
= 0;
427 unsigned long actual_old_val
= 0;
428 unsigned long bt_addr
;
432 * Carve the virtual space out of userspace for the new
435 bt_addr
= mpx_mmap(MPX_BT_SIZE_BYTES
);
436 if (IS_ERR((void *)bt_addr
))
437 return PTR_ERR((void *)bt_addr
);
439 * Set the valid flag (kinda like _PAGE_PRESENT in a pte)
441 bt_addr
= bt_addr
| MPX_BD_ENTRY_VALID_FLAG
;
444 * Go poke the address of the new bounds table in to the
445 * bounds directory entry out in userspace memory. Note:
446 * we may race with another CPU instantiating the same table.
447 * In that case the cmpxchg will see an unexpected
450 * This can fault, but that's OK because we do not hold
451 * mmap_sem at this point, unlike some of the other part
452 * of the MPX code that have to pagefault_disable().
454 ret
= user_atomic_cmpxchg_inatomic(&actual_old_val
, bd_entry
,
455 expected_old_val
, bt_addr
);
460 * The user_atomic_cmpxchg_inatomic() will only return nonzero
461 * for faults, *not* if the cmpxchg itself fails. Now we must
462 * verify that the cmpxchg itself completed successfully.
465 * We expected an empty 'expected_old_val', but instead found
466 * an apparently valid entry. Assume we raced with another
467 * thread to instantiate this table and desclare succecss.
469 if (actual_old_val
& MPX_BD_ENTRY_VALID_FLAG
) {
474 * We found a non-empty bd_entry but it did not have the
475 * VALID_FLAG set. Return an error which will result in
476 * a SEGV since this probably means that somebody scribbled
477 * some invalid data in to a bounds table.
479 if (expected_old_val
!= actual_old_val
) {
485 vm_munmap(bt_addr
& MPX_BT_ADDR_MASK
, MPX_BT_SIZE_BYTES
);
490 * When a BNDSTX instruction attempts to save bounds to a bounds
491 * table, it will first attempt to look up the table in the
492 * first-level bounds directory. If it does not find a table in
493 * the directory, a #BR is generated and we get here in order to
494 * allocate a new table.
496 * With 32-bit mode, the size of BD is 4MB, and the size of each
497 * bound table is 16KB. With 64-bit mode, the size of BD is 2GB,
498 * and the size of each bound table is 4MB.
500 static int do_mpx_bt_fault(struct xsave_struct
*xsave_buf
)
502 unsigned long bd_entry
, bd_base
;
503 struct bndcsr
*bndcsr
;
505 bndcsr
= get_xsave_addr(xsave_buf
, XSTATE_BNDCSR
);
509 * Mask off the preserve and enable bits
511 bd_base
= bndcsr
->bndcfgu
& MPX_BNDCFG_ADDR_MASK
;
513 * The hardware provides the address of the missing or invalid
514 * entry via BNDSTATUS, so we don't have to go look it up.
516 bd_entry
= bndcsr
->bndstatus
& MPX_BNDSTA_ADDR_MASK
;
518 * Make sure the directory entry is within where we think
521 if ((bd_entry
< bd_base
) ||
522 (bd_entry
>= bd_base
+ MPX_BD_SIZE_BYTES
))
525 return allocate_bt((long __user
*)bd_entry
);
528 int mpx_handle_bd_fault(struct xsave_struct
*xsave_buf
)
531 * Userspace never asked us to manage the bounds tables,
534 if (!kernel_managing_mpx_tables(current
->mm
))
537 if (do_mpx_bt_fault(xsave_buf
)) {
538 force_sig(SIGSEGV
, current
);
540 * The force_sig() is essentially "handling" this
541 * exception, so we do not pass up the error
542 * from do_mpx_bt_fault().
549 * A thin wrapper around get_user_pages(). Returns 0 if the
550 * fault was resolved or -errno if not.
552 static int mpx_resolve_fault(long __user
*addr
, int write
)
558 gup_ret
= get_user_pages(current
, current
->mm
, (unsigned long)addr
,
559 nr_pages
, write
, force
, NULL
, NULL
);
561 * get_user_pages() returns number of pages gotten.
562 * 0 means we failed to fault in and get anything,
563 * probably because 'addr' is bad.
567 /* Other error, return it */
570 /* must have gup'd a page and gup_ret>0, success */
575 * Get the base of bounds tables pointed by specific bounds
578 static int get_bt_addr(struct mm_struct
*mm
,
579 long __user
*bd_entry
, unsigned long *bt_addr
)
584 if (!access_ok(VERIFY_READ
, (bd_entry
), sizeof(*bd_entry
)))
591 ret
= get_user(*bt_addr
, bd_entry
);
596 ret
= mpx_resolve_fault(bd_entry
, need_write
);
598 * If we could not resolve the fault, consider it
599 * userspace's fault and error out.
605 valid_bit
= *bt_addr
& MPX_BD_ENTRY_VALID_FLAG
;
606 *bt_addr
&= MPX_BT_ADDR_MASK
;
609 * When the kernel is managing bounds tables, a bounds directory
610 * entry will either have a valid address (plus the valid bit)
611 * *OR* be completely empty. If we see a !valid entry *and* some
612 * data in the address field, we know something is wrong. This
613 * -EINVAL return will cause a SIGSEGV.
615 if (!valid_bit
&& *bt_addr
)
618 * Do we have an completely zeroed bt entry? That is OK. It
619 * just means there was no bounds table for this memory. Make
620 * sure to distinguish this from -EINVAL, which will cause
630 * Free the backing physical pages of bounds table 'bt_addr'.
631 * Assume start...end is within that bounds table.
633 static int zap_bt_entries(struct mm_struct
*mm
,
634 unsigned long bt_addr
,
635 unsigned long start
, unsigned long end
)
637 struct vm_area_struct
*vma
;
638 unsigned long addr
, len
;
641 * Find the first overlapping vma. If vma->vm_start > start, there
642 * will be a hole in the bounds table. This -EINVAL return will
645 vma
= find_vma(mm
, start
);
646 if (!vma
|| vma
->vm_start
> start
)
650 * A NUMA policy on a VM_MPX VMA could cause this bouds table to
651 * be split. So we need to look across the entire 'start -> end'
652 * range of this bounds table, find all of the VM_MPX VMAs, and
656 while (vma
&& vma
->vm_start
< end
) {
658 * We followed a bounds directory entry down
659 * here. If we find a non-MPX VMA, that's bad,
660 * so stop immediately and return an error. This
661 * probably results in a SIGSEGV.
663 if (!is_mpx_vma(vma
))
666 len
= min(vma
->vm_end
, end
) - addr
;
667 zap_page_range(vma
, addr
, len
, NULL
);
670 addr
= vma
->vm_start
;
676 static int unmap_single_bt(struct mm_struct
*mm
,
677 long __user
*bd_entry
, unsigned long bt_addr
)
679 unsigned long expected_old_val
= bt_addr
| MPX_BD_ENTRY_VALID_FLAG
;
680 unsigned long actual_old_val
= 0;
687 ret
= user_atomic_cmpxchg_inatomic(&actual_old_val
, bd_entry
,
688 expected_old_val
, 0);
693 ret
= mpx_resolve_fault(bd_entry
, need_write
);
695 * If we could not resolve the fault, consider it
696 * userspace's fault and error out.
702 * The cmpxchg was performed, check the results.
704 if (actual_old_val
!= expected_old_val
) {
706 * Someone else raced with us to unmap the table.
707 * There was no bounds table pointed to by the
708 * directory, so declare success. Somebody freed
714 * Something messed with the bounds directory
715 * entry. We hold mmap_sem for read or write
716 * here, so it could not be a _new_ bounds table
717 * that someone just allocated. Something is
718 * wrong, so pass up the error and SIGSEGV.
724 * Note, we are likely being called under do_munmap() already. To
725 * avoid recursion, do_munmap() will check whether it comes
726 * from one bounds table through VM_MPX flag.
728 return do_munmap(mm
, bt_addr
, MPX_BT_SIZE_BYTES
);
732 * If the bounds table pointed by bounds directory 'bd_entry' is
733 * not shared, unmap this whole bounds table. Otherwise, only free
734 * those backing physical pages of bounds table entries covered
735 * in this virtual address region start...end.
737 static int unmap_shared_bt(struct mm_struct
*mm
,
738 long __user
*bd_entry
, unsigned long start
,
739 unsigned long end
, bool prev_shared
, bool next_shared
)
741 unsigned long bt_addr
;
744 ret
= get_bt_addr(mm
, bd_entry
, &bt_addr
);
746 * We could see an "error" ret for not-present bounds
747 * tables (not really an error), or actual errors, but
748 * stop unmapping either way.
753 if (prev_shared
&& next_shared
)
754 ret
= zap_bt_entries(mm
, bt_addr
,
755 bt_addr
+MPX_GET_BT_ENTRY_OFFSET(start
),
756 bt_addr
+MPX_GET_BT_ENTRY_OFFSET(end
));
757 else if (prev_shared
)
758 ret
= zap_bt_entries(mm
, bt_addr
,
759 bt_addr
+MPX_GET_BT_ENTRY_OFFSET(start
),
760 bt_addr
+MPX_BT_SIZE_BYTES
);
761 else if (next_shared
)
762 ret
= zap_bt_entries(mm
, bt_addr
, bt_addr
,
763 bt_addr
+MPX_GET_BT_ENTRY_OFFSET(end
));
765 ret
= unmap_single_bt(mm
, bd_entry
, bt_addr
);
771 * A virtual address region being munmap()ed might share bounds table
772 * with adjacent VMAs. We only need to free the backing physical
773 * memory of these shared bounds tables entries covered in this virtual
776 static int unmap_edge_bts(struct mm_struct
*mm
,
777 unsigned long start
, unsigned long end
)
780 long __user
*bde_start
, *bde_end
;
781 struct vm_area_struct
*prev
, *next
;
782 bool prev_shared
= false, next_shared
= false;
784 bde_start
= mm
->bd_addr
+ MPX_GET_BD_ENTRY_OFFSET(start
);
785 bde_end
= mm
->bd_addr
+ MPX_GET_BD_ENTRY_OFFSET(end
-1);
788 * Check whether bde_start and bde_end are shared with adjacent
791 * We already unliked the VMAs from the mm's rbtree so 'start'
792 * is guaranteed to be in a hole. This gets us the first VMA
793 * before the hole in to 'prev' and the next VMA after the hole
796 next
= find_vma_prev(mm
, start
, &prev
);
797 if (prev
&& (mm
->bd_addr
+ MPX_GET_BD_ENTRY_OFFSET(prev
->vm_end
-1))
800 if (next
&& (mm
->bd_addr
+ MPX_GET_BD_ENTRY_OFFSET(next
->vm_start
))
805 * This virtual address region being munmap()ed is only
806 * covered by one bounds table.
808 * In this case, if this table is also shared with adjacent
809 * VMAs, only part of the backing physical memory of the bounds
810 * table need be freeed. Otherwise the whole bounds table need
813 if (bde_start
== bde_end
) {
814 return unmap_shared_bt(mm
, bde_start
, start
, end
,
815 prev_shared
, next_shared
);
819 * If more than one bounds tables are covered in this virtual
820 * address region being munmap()ed, we need to separately check
821 * whether bde_start and bde_end are shared with adjacent VMAs.
823 ret
= unmap_shared_bt(mm
, bde_start
, start
, end
, prev_shared
, false);
826 ret
= unmap_shared_bt(mm
, bde_end
, start
, end
, false, next_shared
);
833 static int mpx_unmap_tables(struct mm_struct
*mm
,
834 unsigned long start
, unsigned long end
)
837 long __user
*bd_entry
, *bde_start
, *bde_end
;
838 unsigned long bt_addr
;
841 * "Edge" bounds tables are those which are being used by the region
842 * (start -> end), but that may be shared with adjacent areas. If they
843 * turn out to be completely unshared, they will be freed. If they are
844 * shared, we will free the backing store (like an MADV_DONTNEED) for
845 * areas used by this region.
847 ret
= unmap_edge_bts(mm
, start
, end
);
849 /* non-present tables are OK */
852 /* Success, or no tables to unmap */
861 * Only unmap the bounds table that are
863 * 2. not at the edges of the mapping, even if full aligned
865 bde_start
= mm
->bd_addr
+ MPX_GET_BD_ENTRY_OFFSET(start
);
866 bde_end
= mm
->bd_addr
+ MPX_GET_BD_ENTRY_OFFSET(end
-1);
867 for (bd_entry
= bde_start
+ 1; bd_entry
< bde_end
; bd_entry
++) {
868 ret
= get_bt_addr(mm
, bd_entry
, &bt_addr
);
873 /* No table here, try the next one */
879 * Note: we are being strict here.
880 * Any time we run in to an issue
881 * unmapping tables, we stop and
887 ret
= unmap_single_bt(mm
, bd_entry
, bt_addr
);
896 * Free unused bounds tables covered in a virtual address region being
897 * munmap()ed. Assume end > start.
899 * This function will be called by do_munmap(), and the VMAs covering
900 * the virtual address region start...end have already been split if
901 * necessary, and the 'vma' is the first vma in this range (start -> end).
903 void mpx_notify_unmap(struct mm_struct
*mm
, struct vm_area_struct
*vma
,
904 unsigned long start
, unsigned long end
)
909 * Refuse to do anything unless userspace has asked
910 * the kernel to help manage the bounds tables,
912 if (!kernel_managing_mpx_tables(current
->mm
))
915 * This will look across the entire 'start -> end' range,
916 * and find all of the non-VM_MPX VMAs.
918 * To avoid recursion, if a VM_MPX vma is found in the range
919 * (start->end), we will not continue follow-up work. This
920 * recursion represents having bounds tables for bounds tables,
921 * which should not occur normally. Being strict about it here
922 * helps ensure that we do not have an exploitable stack overflow.
925 if (vma
->vm_flags
& VM_MPX
)
928 } while (vma
&& vma
->vm_start
< end
);
930 ret
= mpx_unmap_tables(mm
, start
, end
);
932 force_sig(SIGSEGV
, current
);