From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id AB683808A3 for ; Wed, 14 Oct 2026 17:13:49 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EHCa7L001340; Wed, 14 Oct 2026 20:12:37 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EHCa7L001340 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="AnW+uFN4" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EHCUGf001303 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 14 Oct 2026 20:12:30 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EHCUGf001303 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-486f9d150c3so2720577f8f.3 for ; Wed, 14 Oct 2026 10:12:30 -0700 (PDT) X-Gm-Message-State: AFq9FYK1RMcTkcm3PZOOUtXU/etkX9LqrWThnmJkdn4bUy6Rf36w0SXp vyjeNzacQ6QmHhFwmUboqLjBEq6sytAqDu7/IttEE4nngJmeC4gZszNlEtN2pAo71G3DMyS6fKW Hn+p5ZPsFYxVOhUtxirw3/V1zcOfZXD6lmXBiTu6IU+7s3R7kcbe6XQ== X-Gm-Gg: AYBFou3i8uKxbXOpKFAWaQ1Xgb74WPpkkSoJWTEpeuC4WSOztVxG4XFyWDE/mdrji8A gte85D7sOG4QYsVZ7POALMXgqiG5WCkGTjYOKFSANpo1eIC6zBffERcqTQGMdt6L2cxZo69Dakj 9KIGHFwKBKpLpL2TgEOoy16EpM8IubstRTqSxAKyutXVRhnFyWFsJfKnrRhT8e1eMcricad+nfC ekGDAP1xMQ8qJIMvY0rNJtp3uVnILdykoWURl3EgwhWhByVOsJd5oOzHM1o4m01GTyEGT/OlbiW dj4nOoVfyTHzJxY9DwaPmoRoqfMXeZsg4Y5Zut2HfyL+zPqN8studVmaoxT4gsAEplTGnOH0Z38 /+4kFK0wHcD4kfWLy X-Received: by 2002:a05:600c:1e0f:b0:4a0:1f51:ba2d with SMTP id 5b1f17b1804b1-4a18e4adcbamr333330815e9.22.1791997949926; Wed, 14 Oct 2026 10:12:29 -0700 (PDT) X-Received: by 2002:a05:600c:1e0f:b0:4a0:1f51:ba2d with SMTP id 5b1f17b1804b1-4a18e4adcbamr333329675e9.22.1791997948930; Wed, 14 Oct 2026 10:12:28 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791997948; cv=none; d=google.com; s=arc-20260327; b=EnragLrCaxG35XXPNcHUYfFUVESmxZJVj+4HXJSgAhw05had8kuYx1xb+/xk8D63Gl MnjKBSYh7/4tN35Zue7U9f5PhFQwcY2SnPnbNIi/wuKb7Zoin3INJg73FTj5qT0vbDCk jPFespYmjT2K7iP1e3pPe87OhV5Bxi7aIsvitjOC40R/VLshqiIqdc25Btb2ha8aYQg9 vBqmJaEeoN5vNY/LR9QPO+IZP6Nu1xXiPZkp9I/oic2ax9otiWIOGS0JLGOHjkqp1v+1 RwW2SYKzrBbt8722tkjapAOFhRQ1AmPx+JJTGjOkjJTHK/hdw6FImEcBJG7s9dxt7ouX 6KQw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:content-transfer-encoding:mime-version:message-id:date :subject:from:dkim-signature; bh=IID3LAA6XVqZY6KcIHSS35yHwFLWwsFsuFQX60JrsNY=; fh=xUcS46XhSaUOWFT7CPWNuABJ4EJ7/+S5u4N+e+rlWN4=; b=CGqnoQRZuZxpXKXJMWsi9GdUR1xryGxe28vZc+0T4PgjN5gxSXqJQHNwdlmv2JY6oL ILcoQl7v30vhFY6aeBNcQpE8DzSkXGt+IxKRRTFmTLdI7XyioorYMboHQ+a1KFI+WOXa nxrhX4GL49ENU/7DyqJyl9lm53Bu/OGbLLgxG4zZkprNCEDdU2kIKMGHCLklnxUHfXNw iMaeZZIi9+cu6EmbXIgcgmwG3R16vTDvftLxEWK73MaIF6sHV5gpN8/QAp77NwP0vbXS PQsGgbA4efFj1ZOlHft0ayrtWuFjUCO3CyfI9K52Ob2c3EGS9iSyNciHt2Vqwfb0y4Rj EeJA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=AnW+uFN4; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48de0bf33e8si12904819f8f.304.2026.10.14.10.12.28 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 10:12:28 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=AnW+uFN4; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Content-Type:MIME-Version:Message-Id:Date:Subject :From; bh=IID3LAA6XVqZY6KcIHSS35yHwFLWwsFsuFQX60JrsNY=; b=AnW+uFN4WVZKyPpcny5 wHqfaRrmJ7wAtYi2nbkeW1Hty/gk6P0Xozbfh9d2xhDEi+wwBX+DkmTNAabw1QgLAaxEOVzmLI4Gs qXU3Q67lzQge5OMY9lLZJzTXGZjt9E7LBoEsq0MJ4OOs5ruQFbdlNXHsWucBL1XOeFIdaGNg8ZNj4 znIFRnripOFvOfJaf0i9UmOh3Lr5wAHg5/6o71sdBsCOe8b8MkJ8BL7eCB3hnS6IoBieh9scpSsMg JTvx+geiP1aDC+tlfeMt9Qm2kZy1P8QlMp9s9xpvb6eM83QK0x8W1uD04nxazzlKHOTqf/U7ixYLq T7hNRXrBZErCqsw==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xH2TH-0082VK-1V; Wed, 14 Oct 2026 19:12:27 +0200 From: Konstantin Khorenko Date: Wed, 14 Oct 2026 19:12:19 +0200 Message-Id: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-0-e34cbe0d1440@virtuozzo.com> MIME-Version: 1.0 X-B4-Tracking: v=1; b=H4sIAPS3z2oC/z2Nyw6CMBBFf8XM2hEKjaI/YaLGjXHRxygVaUmLB EP4d4sGl/eRcwYI5A0F2C0G8NSZYJyNgS0XoEph74RGxwxZmq1ZyjhKjo2nBqvSebKVwy60ziP j24JvMEftqCeFzgv1JLyZngLmec6ZZkIqriGSI+A7RPAFSmWwWDG4/obwkg9S7eScrlIEQumFV eVUSZ5M9uRvPx9P+8Nsz2Z7Y6wljTXVzr9hHD/9RQsz5wAAAA== X-Change-ID: 20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-33341d1abc4d To: Pavel Tikhomirov , Andrey Drobyshev , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2479; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=jTX79qaA+pTydjb2pFbDTqOtAzrzRqRt2TJ9Nazd7UA=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqz7f46pTL8BLaZ1JE3+tKsLqOF/CmK4h6Tour4 LMeDu+wA2iJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCas+3+AAKCRBRlgpH+WFc KpzXD/4zR48S4oSB+DhZ0HtOq9dh7WgnijegHSjgBDv/00h1de6YmY1WSv5UxAadLX1nqibP1IV XKImLZo9oXzPRQ5Azy7s5OGlSZixBNcZEwUvsYVbZdB66rBfRFyHfpzVNn3Uko32h/WRLlkC0Hx iHzZImOQEtP5+F2/RHFuip5pRHjfMoV90BM8xa4puMcKqp6pzdbkFE39gakAwrlqwc7AjoFTygh d27UgDq4fhZfMdfJv57JqLr39ESROdJrK+B4C9ovey32iMDWAsD73alSpSmcSZAHTmM00dw1r7A sICbo1ZdXD8k4PcHBTQynjQMTZIEZ69/VikJhiaox1q67PhBDADk0WKKC/TTa00NM+kbFBH9/6c k9zNmJPj/N/NbU8EwBzTudxaK900blZu0cIxmMrTaCoWyrVCu2dcBZqCRIweHW1z0CnbcjoWU/u cm7wnXZIOKgH9FJUjMYYnJL40hjE2cN9JVljCUbPAvGYWKhvOwSWDfJd75U7FAoMZwG6mKhkK3b SzgMIyidsN6OjHV43aXlL5I3BKS1bqhKB59APN/1qwLqrJLa4UehNIz0jDeoUGO3bzaAKmRr1wJ n7Kd6h1+Fe7qRWmUj9pNIBZY4qo6zhGkTxuqAGtnHVxikAGxtTwy/Fi1l2Sl56H362Vdh5VR7t3 XJWdbcBR90SQmuQ== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 0/7] mm, exec: fix the MADV_DOEXEC code we carry from Oracle X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org Fixes in the existing Oracle MADV_DOEXEC code, found while working on VSTOR-149847, and a refusal of preserved memory across setuid exec. Applies on top of "mm: keep DMA-pinned MADV_DOEXEC memory working across exec". - 1: vma_dup() takes no file reference for a file-backed VMA, so a private /dev/zero mapping marked MADV_DOEXEC is put twice (use-after-free of struct file, reachable unprivileged). - 2: a private VM_PFNMAP VMA with NULL vm_ops passed as anonymous and its PAT memtype was freed twice; refuse VM_SPECIAL. - 3: MADV_DOEXEC never cleared VM_MAYEXEC and MADV_DONTEXEC granted it unconditionally, also on noexec mounts; the copies made by exec and fork get back what do_mmap() granted. - 4: load_elf_binary() looked for the opt-in note only in the last PT_NOTE segment; a binary whose linker puts it elsewhere silently got no preserved memory. - 5: a setuid/secureexec exec with preserved memory is refused with EPERM before the point of no return: long-term pins driven from another process would keep writing into the privileged image. - 6, 7: selftests for 5 and for 1 and 3. Tested with the whole stack on release and debug kernels (MADV_DOEXEC selftests, gup_test, a Container start/exec/stop). https://virtuozzo.atlassian.net/browse/VSTOR-150232 --- Konstantin Khorenko (7): oracle/mm: take a file reference when preserving a file-backed VMA oracle/mm: refuse MADV_DOEXEC on special mappings oracle/mm: keep a MADV_DOEXEC range from becoming executable oracle/exec, elf: look for the opt-in note in every PT_NOTE segment exec: refuse to preserve memory across a privilege-changing exec selftests/mm: check that a setuid exec refuses preserved memory selftests/mm: check MADV_DOEXEC on /dev/zero and exec permission fs/binfmt_elf.c | 87 +++++++++------ fs/exec.c | 4 + include/linux/mm.h | 1 + kernel/fork.c | 4 +- mm/madvise.c | 12 +- mm/mmap.c | 17 ++- tools/testing/selftests/mm/doexec.c | 211 +++++++++++++++++++++++++++++++++++- 7 files changed, 290 insertions(+), 46 deletions(-) --- base-commit: 0f7fa776e32c8e6832e7604dc157d05d3af14513 change-id: 20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-33341d1abc4d Best regards, -- Konstantin Khorenko _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel