From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Laurent Dufour <ldufour@linux.vnet.ibm.com>,
Thomas Gleixner <tglx@linutronix.de>,
linux-mm@kvack.org, Dave Hansen <dave.hansen@linux.intel.com>
Subject: [PATCH 4.9 55/64] x86/mm: Fix fault error path using unsafe vma pointer
Date: Tue, 3 Oct 2017 14:23:47 +0200 [thread overview]
Message-ID: <20171003114231.611407056@linuxfoundation.org> (raw)
In-Reply-To: <20171003114228.884821129@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Dufour <ldufour@linux.vnet.ibm.com>
commit a3c4fb7c9c2ebfd50b8c60f6c069932bb319bc37 upstream.
commit 7b2d0dbac489 ("x86/mm/pkeys: Pass VMA down in to fault signal
generation code") passes down a vma pointer to the error path, but that is
done once the mmap_sem is released when calling mm_fault_error() from
__do_page_fault().
This is dangerous as the vma structure is no more safe to be used once the
mmap_sem has been released. As only the protection key value is required in
the error processing, we could just pass down this value.
Fix it by passing a pointer to a protection key value down to the fault
signal generation code. The use of a pointer allows to keep the check
generating a warning message in fill_sig_info_pkey() when the vma was not
known. If the pointer is valid, the protection value can be accessed by
deferencing the pointer.
[ tglx: Made *pkey u32 as that's the type which is passed in siginfo ]
Fixes: 7b2d0dbac489 ("x86/mm/pkeys: Pass VMA down in to fault signal generation code")
Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-mm@kvack.org
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Link: http://lkml.kernel.org/r/1504513935-12742-1-git-send-email-ldufour@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/mm/fault.c | 47 ++++++++++++++++++++++++-----------------------
1 file changed, 24 insertions(+), 23 deletions(-)
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -191,8 +191,7 @@ is_prefetch(struct pt_regs *regs, unsign
* 6. T1 : reaches here, sees vma_pkey(vma)=5, when we really
* faulted on a pte with its pkey=4.
*/
-static void fill_sig_info_pkey(int si_code, siginfo_t *info,
- struct vm_area_struct *vma)
+static void fill_sig_info_pkey(int si_code, siginfo_t *info, u32 *pkey)
{
/* This is effectively an #ifdef */
if (!boot_cpu_has(X86_FEATURE_OSPKE))
@@ -208,7 +207,7 @@ static void fill_sig_info_pkey(int si_co
* valid VMA, so we should never reach this without a
* valid VMA.
*/
- if (!vma) {
+ if (!pkey) {
WARN_ONCE(1, "PKU fault with no VMA passed in");
info->si_pkey = 0;
return;
@@ -218,13 +217,12 @@ static void fill_sig_info_pkey(int si_co
* absolutely guranteed to be 100% accurate because of
* the race explained above.
*/
- info->si_pkey = vma_pkey(vma);
+ info->si_pkey = *pkey;
}
static void
force_sig_info_fault(int si_signo, int si_code, unsigned long address,
- struct task_struct *tsk, struct vm_area_struct *vma,
- int fault)
+ struct task_struct *tsk, u32 *pkey, int fault)
{
unsigned lsb = 0;
siginfo_t info;
@@ -239,7 +237,7 @@ force_sig_info_fault(int si_signo, int s
lsb = PAGE_SHIFT;
info.si_addr_lsb = lsb;
- fill_sig_info_pkey(si_code, &info, vma);
+ fill_sig_info_pkey(si_code, &info, pkey);
force_sig_info(si_signo, &info, tsk);
}
@@ -718,8 +716,6 @@ no_context(struct pt_regs *regs, unsigne
struct task_struct *tsk = current;
unsigned long flags;
int sig;
- /* No context means no VMA to pass down */
- struct vm_area_struct *vma = NULL;
/* Are we prepared to handle this kernel fault? */
if (fixup_exception(regs, X86_TRAP_PF)) {
@@ -744,7 +740,7 @@ no_context(struct pt_regs *regs, unsigne
/* XXX: hwpoison faults will set the wrong code. */
force_sig_info_fault(signal, si_code, address,
- tsk, vma, 0);
+ tsk, NULL, 0);
}
/*
@@ -853,8 +849,7 @@ show_signal_msg(struct pt_regs *regs, un
static void
__bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
- unsigned long address, struct vm_area_struct *vma,
- int si_code)
+ unsigned long address, u32 *pkey, int si_code)
{
struct task_struct *tsk = current;
@@ -902,7 +897,7 @@ __bad_area_nosemaphore(struct pt_regs *r
tsk->thread.error_code = error_code;
tsk->thread.trap_nr = X86_TRAP_PF;
- force_sig_info_fault(SIGSEGV, si_code, address, tsk, vma, 0);
+ force_sig_info_fault(SIGSEGV, si_code, address, tsk, pkey, 0);
return;
}
@@ -915,9 +910,9 @@ __bad_area_nosemaphore(struct pt_regs *r
static noinline void
bad_area_nosemaphore(struct pt_regs *regs, unsigned long error_code,
- unsigned long address, struct vm_area_struct *vma)
+ unsigned long address, u32 *pkey)
{
- __bad_area_nosemaphore(regs, error_code, address, vma, SEGV_MAPERR);
+ __bad_area_nosemaphore(regs, error_code, address, pkey, SEGV_MAPERR);
}
static void
@@ -925,6 +920,10 @@ __bad_area(struct pt_regs *regs, unsigne
unsigned long address, struct vm_area_struct *vma, int si_code)
{
struct mm_struct *mm = current->mm;
+ u32 pkey;
+
+ if (vma)
+ pkey = vma_pkey(vma);
/*
* Something tried to access memory that isn't in our memory map..
@@ -932,7 +931,8 @@ __bad_area(struct pt_regs *regs, unsigne
*/
up_read(&mm->mmap_sem);
- __bad_area_nosemaphore(regs, error_code, address, vma, si_code);
+ __bad_area_nosemaphore(regs, error_code, address,
+ (vma) ? &pkey : NULL, si_code);
}
static noinline void
@@ -975,7 +975,7 @@ bad_area_access_error(struct pt_regs *re
static void
do_sigbus(struct pt_regs *regs, unsigned long error_code, unsigned long address,
- struct vm_area_struct *vma, unsigned int fault)
+ u32 *pkey, unsigned int fault)
{
struct task_struct *tsk = current;
int code = BUS_ADRERR;
@@ -1002,13 +1002,12 @@ do_sigbus(struct pt_regs *regs, unsigned
code = BUS_MCEERR_AR;
}
#endif
- force_sig_info_fault(SIGBUS, code, address, tsk, vma, fault);
+ force_sig_info_fault(SIGBUS, code, address, tsk, pkey, fault);
}
static noinline void
mm_fault_error(struct pt_regs *regs, unsigned long error_code,
- unsigned long address, struct vm_area_struct *vma,
- unsigned int fault)
+ unsigned long address, u32 *pkey, unsigned int fault)
{
if (fatal_signal_pending(current) && !(error_code & PF_USER)) {
no_context(regs, error_code, address, 0, 0);
@@ -1032,9 +1031,9 @@ mm_fault_error(struct pt_regs *regs, uns
} else {
if (fault & (VM_FAULT_SIGBUS|VM_FAULT_HWPOISON|
VM_FAULT_HWPOISON_LARGE))
- do_sigbus(regs, error_code, address, vma, fault);
+ do_sigbus(regs, error_code, address, pkey, fault);
else if (fault & VM_FAULT_SIGSEGV)
- bad_area_nosemaphore(regs, error_code, address, vma);
+ bad_area_nosemaphore(regs, error_code, address, pkey);
else
BUG();
}
@@ -1220,6 +1219,7 @@ __do_page_fault(struct pt_regs *regs, un
struct mm_struct *mm;
int fault, major = 0;
unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
+ u32 pkey;
tsk = current;
mm = tsk->mm;
@@ -1420,9 +1420,10 @@ good_area:
return;
}
+ pkey = vma_pkey(vma);
up_read(&mm->mmap_sem);
if (unlikely(fault & VM_FAULT_ERROR)) {
- mm_fault_error(regs, error_code, address, vma, fault);
+ mm_fault_error(regs, error_code, address, &pkey, fault);
return;
}
next prev parent reply other threads:[~2017-10-03 12:25 UTC|newest]
Thread overview: 63+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-03 12:22 [PATCH 4.9 00/64] 4.9.53-stable review Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 01/64] cifs: release cifs root_cred after exit_cifs Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 02/64] cifs: release auth_key.response for reconnect Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 03/64] fs/proc: Report eip/esp in /prod/PID/stat for coredumping Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 04/64] mac80211: fix VLAN handling with TXQs Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 05/64] mac80211_hwsim: Use proper TX power Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 06/64] mac80211: flush hw_roc_start work before cancelling the ROC Greg Kroah-Hartman
2017-10-03 12:22 ` [PATCH 4.9 07/64] genirq: Make sparse_irq_lock protect what it should protect Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 08/64] KVM: PPC: Book3S: Fix race and leak in kvm_vm_ioctl_create_spapr_tce() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 09/64] KVM: PPC: Book3S HV: Protect updates to spapr_tce_tables list Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 10/64] tracing: Fix trace_pipe behavior for instance traces Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 11/64] tracing: Erase irqsoff trace with empty write Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 12/64] md/raid5: fix a race condition in stripe batch Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 13/64] md/raid5: preserve STRIPE_ON_UNPLUG_LIST in break_stripe_batch_list Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 14/64] scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesnt parse nlmsg properly Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 15/64] drm/radeon: disable hard reset in hibernate for APUs Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 16/64] crypto: drbg - fix freeing of resources Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 17/64] crypto: talitos - Dont provide setkey for non hmac hashing algs Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 18/64] crypto: talitos - fix sha224 Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 19/64] crypto: talitos - fix hashing Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 20/64] security/keys: properly zero out sensitive key material in big_key Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 21/64] security/keys: rewrite all of big_key crypto Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 22/64] KEYS: fix writing past end of user-supplied buffer in keyring_read() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 23/64] KEYS: prevent creating a different users keyrings Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 24/64] KEYS: prevent KEYCTL_READ on negative key Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 25/64] powerpc/pseries: Fix parent_dn reference leak in add_dt_node() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 26/64] powerpc/tm: Flush TM only if CPU has TM feature Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 27/64] powerpc/ftrace: Pass the correct stack pointer for DYNAMIC_FTRACE_WITH_REGS Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 28/64] s390/mm: fix write access check in gup_huge_pmd() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 29/64] PM: core: Fix device_pm_check_callbacks() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 30/64] Fix SMB3.1.1 guest authentication to Samba Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 31/64] SMB3: Warn user if trying to sign connection that authenticated as guest Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 32/64] SMB: Validate negotiate (to protect against downgrade) even if signing off Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 33/64] SMB3: Dont ignore O_SYNC/O_DSYNC and O_DIRECT flags Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 34/64] vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 35/64] nl80211: check for the required netlink attributes presence Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 36/64] bsg-lib: dont free job in bsg_prepare_job Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 37/64] iw_cxgb4: remove the stid on listen create failure Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 38/64] iw_cxgb4: put ep reference in pass_accept_req() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 39/64] selftests/seccomp: Support glibc 2.26 siginfo_t.h Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 40/64] seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 41/64] arm64: Make sure SPsel is always set Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 42/64] arm64: fault: Route pte translation faults via do_translation_fault Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 46/64] kvm/x86: Handle async PF in RCU read-side critical sections Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 48/64] kvm: nVMX: Dont allow L2 to access the hardware CR8 Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 49/64] xfs: validate bdev support for DAX inode flag Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 50/64] etnaviv: fix gem object list corruption Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 51/64] PCI: Fix race condition with driver_override Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 52/64] btrfs: fix NULL pointer dereference from free_reloc_roots() Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 53/64] btrfs: propagate error to btrfs_cmp_data_prepare caller Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 54/64] btrfs: prevent to set invalid default subvolid Greg Kroah-Hartman
2017-10-03 12:23 ` Greg Kroah-Hartman [this message]
2017-10-03 12:23 ` [PATCH 4.9 56/64] x86/fpu: Dont let userspace set bogus xcomp_bv Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 57/64] gfs2: Fix debugfs glocks dump Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 58/64] timer/sysclt: Restrict timer migration sysctl values to 0 and 1 Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 61/64] cxl: Fix driver use count Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 62/64] KVM: VMX: use cmpxchg64 Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 63/64] video: fbdev: aty: do not leak uninitialized padding in clk to userspace Greg Kroah-Hartman
2017-10-03 12:23 ` [PATCH 4.9 64/64] swiotlb-xen: implement xen_swiotlb_dma_mmap callback Greg Kroah-Hartman
2017-10-03 19:27 ` [PATCH 4.9 00/64] 4.9.53-stable review Shuah Khan
2017-10-03 20:29 ` Tom Gall
2017-10-04 7:56 ` Greg Kroah-Hartman
2017-10-03 20:42 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171003114231.611407056@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=dave.hansen@linux.intel.com \
--cc=ldufour@linux.vnet.ibm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).