From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 44C1880726 for ; Wed, 14 Oct 2026 17:13:52 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EHCegD001347; Wed, 14 Oct 2026 20:12:41 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EHCegD001347 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="gDYpOeHi" Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69EHCUbF001309 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 14 Oct 2026 20:12:30 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69EHCUbF001309 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-48afe000b94so598492f8f.3 for ; Wed, 14 Oct 2026 10:12:30 -0700 (PDT) X-Gm-Message-State: AFq9FYIzD2utwub43EA4JqsWCMgmnh5bbkD/UiL6MP6epZlFEL5yaOz7 C0U97KBpGMUzUu9vtZti8Asu1XvXGq9rRvi98zBNUO8BbyDuL3dtpblDJp0vHbo63MjSSy1f1ro qFyh517yBkfg30v70Nh1oTGZaBhun5Sy4u9rKjgVEZWy8J0cF9Cl18Q== X-Gm-Gg: AYBFou3WXHRV2KqZI04rvtAOAYFQmJ8fl6D1MHxz15pbNe2/lNxV/uKo80CNXJ7IGS4 JhP6l4SoRR9IlOn3uI7uw23NtYL6ADvM3fEwi1a1n3ZpL4634ZgseM5DHEoaZulWxw4R8h67aI9 bZDgyTVoneknVX721RDdmAD7KBqpWLiPFkVhJgYabSVzUvUj4KAVSpxRrzEXCxWQHud4C6afOXW f8RkZSAm2hJyxNyEyLmqpAskswGFNYDdhUpekc/1/ZtD8YyMsHx2ZncdXx66+WInKsD9Hn2RS0a ZBtn5OgMZMuiqRd38mPgWv5kwUkdiRLQdOc8NAw86E2zo/wMKELkxu/tL1MdwvLC7C+3RwwZCT7 1r1XY0iSf9diwwtXe X-Received: by 2002:a05:6000:288a:b0:48a:f11e:6d57 with SMTP id ffacd0b85a97d-48dbaadb3a5mr30931069f8f.19.1791997950183; Wed, 14 Oct 2026 10:12:30 -0700 (PDT) X-Received: by 2002:a05:6000:288a:b0:48a:f11e:6d57 with SMTP id ffacd0b85a97d-48dbaadb3a5mr30931005f8f.19.1791997949611; Wed, 14 Oct 2026 10:12:29 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791997949; cv=none; d=google.com; s=arc-20260327; b=a/XnXxXaXE4Xdv2f/GTqFIz5tDF5qnXszxuFaeau0H6BNc4p2Vs/JXtcDYIFB7Unyn BxAf0rzrz6YDOAprdHZncNQZC2T0CNulM53op9fa/T/JdoMjqhRvKqZ4GNrfGsDEMxLZ iYQFMot1uZUkNML2741F4iCWPwbtbfvs1aMFh8Rxi3iBamdHthQCt2gS2Icw2pwnxbs4 mlRXq1GpU3ZympSbo8G5tAWOMKE1WhJuda3jnHozjlXg8epQS9BzreePhqY+qoJgQB/O DjKiiDbjEzV+5kOEO0XVS4AbGMieOoC87qOJCKYZae/NOCI8Tvh6NQM59dA2rMkIfxMM CfMg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=EubRGS/Yi8ITntU0YVoDTIrkIuUlIBy+Znqsb2U25sM=; fh=xUcS46XhSaUOWFT7CPWNuABJ4EJ7/+S5u4N+e+rlWN4=; b=fDOQuAU3Iv+cvXB+jE4CiCwLdOmNcrFnDGznsfUGrWFbUm8S4GObojlROAohipLYkb jp3aTSDrs04Z8mnqlJM/WFJlQp/vazSEoYngS5RaMSqXUZAPeAtLvmOvTQJxfTcMyEAa 1vcO/KZ11+TbUDPwaufu/9D/9cKuINEE72LAcBpqUeinVYo6QhfZELEpRCsJg3xFWR+C sp2wb6g1BiyqaZ8QN0c0/i6whPWxwd5E5dwtgBGpvl9fC8diEDDS0AbGyC1YanyzlmfM d4RlsullgAcPfoVZidz7pKUP5y3FxcE70JtQ4TUdD0semh9ARD5Z86wKvXE6v75dsJkU w+kA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=gDYpOeHi; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48ded6e5c17si4106326f8f.168.2026.10.14.10.12.29 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 14 Oct 2026 10:12:29 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=gDYpOeHi; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=EubRGS/Yi8ITntU0YVoDTIrkIuUlIBy+Znqsb2U25sM=; b=gDYpOeHiOu4fKebTnW+ p2vTTH8l6LG/qWuYMyac2fcdv1V0zESK7DUirsg3a7N1Eat57G53oed0s+vDTExUd8XyQxKMxos/g 8TCXViwyjSYWtz07j/Ier0Stqz4MG++SXpT1UDv1vxMZjG/a+r6gmc0T7M3mDzLDVjcCqkK75E+lg 8b55Zd05jtxoTQ+LwPH0eDb5X751Uv4YgHYrrvO6R5fYDHGAl34zWXG9fbrN2eYlS52dqUwPdVbC0 u5LZI8qkH5g+1DavOhU7Jsu7ugHf7wsgq+7lEL5qdGw96Kx7vpSDBrmTR/boCMqVRM/rQvc3cusww fkcXmEGQjQGdn6Q==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xH2TI-0082VK-0V; Wed, 14 Oct 2026 19:12:28 +0200 From: Konstantin Khorenko Date: Wed, 14 Oct 2026 19:12:22 +0200 MIME-Version: 1.0 Message-Id: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-3-e34cbe0d1440@virtuozzo.com> References: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-0-e34cbe0d1440@virtuozzo.com> In-Reply-To: <20261014-b4-prep-khorenko-vstor-149847-3-doexec-oracle-fixes-v1-0-e34cbe0d1440@virtuozzo.com> To: Pavel Tikhomirov , Andrey Drobyshev , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4128; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=V9mU21Nb7txp4Y3P1cz51JTykfIIVSFbEX0L7l97MbI=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqz7f542wLi4jNc1OOfp3B25bCyrijTCfVxZQ/8 I3JTLcMuZGJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCas+3+QAKCRBRlgpH+WFc KqfrD/wLkkg2rkRags4jtNd9fSwgZ2lEi86hCsFCzwiQDfSU4ESNsAq0ArnO6MGcMUl3HvFaaul ZPtJNyuTZ10v3UcGzcXcX319TcmDdit5e7hvNqCUbFt9YloRRHx1A+ycTu9le/iGrbhva93+Alk FbYkHy5NpjLvM6XVl+sdss398nwYO20twQvAQFJJIv4KQHj75Bq6IKPVyEeVXOfAQpAS41Q4U6B BwWcWEkPlSKl51kTWQN6zWZfywDCtUtj6UU6sug5I/n6nZQrmDVYuP3RFocbnP68R/gV1zCBGIU 2Zu3iXvCE889Hwj3ImTdokncaH2J16KIr2rAItSs5uOu0NvnCF4EYV+8etT9xrz8nCwlTJpI1qn kEcfjVy2rsHqyflPsNwrAcNwz/cYxYyJWWWhL/ASB5HCz0PSdMQ4jdM4j5p2lvu8e1r1fLlWdm9 hDCMYU+UySS75zrV/PKlAjiglI/aHZHLjORfs/zXSz+X5Jc7izII/floVqxAUuGQ0mmOuX8ob8+ mYXRQyJFEF947mRxVHJ2b56a4WlNRZKELjFozz1V3kFz168k3+xyrliC405aoF9ijiQCAwKGuOl aJ3rvFqrPnGqfoRCJTLRP/3kM5nQOMcDJE3buyAaTd1118UD24OPzLsM3EjkB/Bht+M21WFA+fw FAazks3RMx7zt/Q== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 3/7] oracle/mm: keep a MADV_DOEXEC range from becoming executable X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org MADV_DOEXEC rejects executable memory and MADV_DONTEXEC gives VM_MAYEXEC back, so the intent is that a preserved range cannot become executable. Two bugs break it: - The OR-assignment in the MADV_DOEXEC case never drops VM_MAYEXEC, so mprotect(PROT_EXEC) on the range succeeds and exec carries the executable mapping into the new image. - MADV_DONTEXEC sets VM_MAYEXEC unconditionally. A private /dev/zero mapping from a noexec mount, which do_mmap() created without VM_MAYEXEC, becomes executable after MADV_DOEXEC and MADV_DONTEXEC. Clear the bit on MADV_DOEXEC and give back what do_mmap() grants such a mapping whenever the mark goes: on MADV_DONTEXEC, and when exec or fork drops it from a copy, which could otherwise never be made executable again. Fixes: 056724255f5f ("oracle/mm: introduce MADV_DOEXEC") https://virtuozzo.atlassian.net/browse/VSTOR-150232 Feature: oracle/mm: MADV_DOEXEC madvise() flag Assisted-by: LLM Signed-off-by: Konstantin Khorenko --- include/linux/mm.h | 1 + kernel/fork.c | 4 +++- mm/madvise.c | 5 +++-- mm/mmap.c | 13 ++++++++++++- 4 files changed, 19 insertions(+), 4 deletions(-) diff --git a/include/linux/mm.h b/include/linux/mm.h index 9ebf3c6dcb978..91f305fd5c025 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2463,6 +2463,7 @@ struct page *vm_normal_page_pmd(struct vm_area_struct *vma, unsigned long addr, void zap_vma_ptes(struct vm_area_struct *vma, unsigned long address, unsigned long size); void zap_vma_mt(struct vm_area_struct *vma); +vm_flags_t vma_doexec_mayexec(struct vm_area_struct *vma); void zap_page_range_single(struct vm_area_struct *vma, unsigned long address, unsigned long size, struct zap_details *details); static inline void zap_vma_pages(struct vm_area_struct *vma) diff --git a/kernel/fork.c b/kernel/fork.c index 92a7e9aae9278..25e87cdbeb073 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -715,7 +715,9 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, tmp->anon_vma = NULL; } else if (anon_vma_fork(tmp, mpnt)) goto fail_nomem_anon_vma_fork; - vm_flags_clear(tmp, VM_LOCKED_MASK | VM_EXEC_KEEP); + if (tmp->vm_flags & VM_EXEC_KEEP) + vm_flags_mod(tmp, vma_doexec_mayexec(tmp), VM_EXEC_KEEP); + vm_flags_clear(tmp, VM_LOCKED_MASK); /* * Copy/update hugetlb private vma information. */ diff --git a/mm/madvise.c b/mm/madvise.c index 644057a2bbbb0..e6972bcfc9749 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1318,7 +1318,7 @@ static int madvise_vma_behavior(struct vm_area_struct *vma, error = -EINVAL; goto out; } - new_flags |= (new_flags & ~VM_MAYEXEC) | VM_EXEC_KEEP; + new_flags = (new_flags & ~VM_MAYEXEC) | VM_EXEC_KEEP; break; case MADV_DONTEXEC: if (!VM_EXEC_KEEP) { @@ -1326,7 +1326,8 @@ static int madvise_vma_behavior(struct vm_area_struct *vma, goto out; } if (new_flags & VM_EXEC_KEEP) - new_flags = (new_flags & ~VM_EXEC_KEEP) | VM_MAYEXEC; + new_flags = (new_flags & ~VM_EXEC_KEEP) | + vma_doexec_mayexec(vma); break; case MADV_DONTDUMP: new_flags |= VM_DONTDUMP; diff --git a/mm/mmap.c b/mm/mmap.c index 52e971aee020f..69dd1514d750e 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -1750,6 +1750,17 @@ int insert_vm_struct(struct mm_struct *mm, struct vm_area_struct *vma) return 0; } +/* + * The VM_MAYEXEC that MADV_DOEXEC took from @vma, to give back when the mark + * goes: what do_mmap() grants such a mapping. + */ +vm_flags_t vma_doexec_mayexec(struct vm_area_struct *vma) +{ + if (vma->vm_file && path_noexec(&vma->vm_file->f_path)) + return 0; + return VM_MAYEXEC; +} + /* * Duplicate an anonymous VMA into a new mm as part of preserving * it across exec. @@ -1811,7 +1822,7 @@ int vma_dup(struct vm_area_struct *old_vma, struct mm_struct *mm) #else ret = copy_page_range(vma, old_vma); #endif - vm_flags_clear(vma, VM_EXEC_KEEP); + vm_flags_mod(vma, vma_doexec_mayexec(vma), VM_EXEC_KEEP); return ret; -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel