From patchwork Mon May 21 21:11:42 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg KH X-Patchwork-Id: 10416589 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 39F8260365 for ; Mon, 21 May 2018 21:24:08 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 29D9028A77 for ; Mon, 21 May 2018 21:24:08 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1E77728A7C; Mon, 21 May 2018 21:24:08 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B807428A77 for ; Mon, 21 May 2018 21:24:06 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id E347D6B0007; Mon, 21 May 2018 17:24:03 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id DE6316B0008; Mon, 21 May 2018 17:24:03 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CA7706B000C; Mon, 21 May 2018 17:24:03 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pf0-f199.google.com (mail-pf0-f199.google.com [209.85.192.199]) by kanga.kvack.org (Postfix) with ESMTP id 73C2D6B0007 for ; Mon, 21 May 2018 17:24:03 -0400 (EDT) Received: by mail-pf0-f199.google.com with SMTP id l85-v6so9791561pfb.18 for ; Mon, 21 May 2018 14:24:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:dkim-signature:from:to:cc:subject:date :message-id:in-reply-to:references:user-agent:mime-version; bh=EGInxhD3xoKJlwfaqME8D6p9ximRCfAjN1Dr6z8VUGE=; b=egpglSlT3bmJV3YIiD+XwHvfgAxxbVBNLNUu6Z1zwTHGj6JrSl7S5UZFmAUbuBOzXB ijshkU/+/98oQKkyE5DBOCgk/hwYnnOQyr8uVSN7M1Aph5hO1yO/LzIxaMvR2mOGXePe OMC0x1OZBJ9zV5kRRnG373LEJJ1o2Ob+6S1wTTtGBEPWVNJmX0VY2f8iGAcEU6K0PW1i oNrSPOW+YJk4+ngzcewbak4GmAThL8+gKE0FHn1cJ/9TPSIn0HxHiRylnJlfHGN4Ftce e+41Kn28vnQOkJivONytCkbkQTyOmUwim5DLXNyzN1iXRmcP4fQWW4aMmQhoJRFq7q6h Hz3w== X-Gm-Message-State: ALKqPwf+nXgQ6NYHP17KnJhFhEaScK5GK3Yv4MIuZPg9LzCJ9s64amO9 zsxVJ4yAFwAOhVpm3oooklx6h7ho4gIaLndzq+HGALMIUwpglkuxcBmXDpWQ4JRSjB/kAai8Cni 2dWss62YtLc78l+TAqJqWE9R0LsyXg56U3K8ceXTlRLIwdZTqCyadVOR4XOq+LcQ= X-Received: by 2002:a62:c2:: with SMTP id 185-v6mr21511436pfa.238.1526937843128; Mon, 21 May 2018 14:24:03 -0700 (PDT) X-Google-Smtp-Source: AB8JxZquXMNfaMe4283inIYSWI9hyyXITEclph/Mu8fz9EAEME+Zc4DXwd78p6kZthOjbbbornEW X-Received: by 2002:a62:c2:: with SMTP id 185-v6mr21511304pfa.238.1526937839828; Mon, 21 May 2018 14:23:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1526937839; cv=none; d=google.com; s=arc-20160816; b=JVcZrAJ0UE5/skQQPQJoRfgt1W9O9Cdj0C24Djoo6rH5vsrWT2G174QaQ6WTMQHjix wP3vogRK2REvZpW1UtK/lFjb/a/8UbML4i6vvg2ufWFF5WMHcLrmcAQJzZNPgaEtzOKl L9JLNMji99COZYcFj38DqGbLaSdCUoyCBP/+itKF2Dv1BXwuSj98Gt2emcThjNlH9gIC duhou8Di4oEYPZaEXRyQ0J8jTzVMSvcY34brF1ESMx+YerjpAdg+W8TkyhCMEQKT6Bwm H1UmXIT29baviH2uyg8k4yVuKCOWI1LJIAv76M3+3bXlkGbFB6cKPjP1oPrqJnquhp/t j9Gw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:dkim-signature:arc-authentication-results; bh=EGInxhD3xoKJlwfaqME8D6p9ximRCfAjN1Dr6z8VUGE=; b=waPx/7g8ifdKuN82X3jaiB3s4CWTO+x4b9lAl63mA8Ini5KO8rpJ7MPYZBQXKDw3Ep HzNxLdkdRhDlCVHY70I5nj/BIw9QXzhrKQMaFQ06y3qdVRN6DE5adf83oQiUypdojqp/ QWgdMO1YtTIFRCwPZsjnifcUkEHx3A+gr0iecH9XU8aU43HL3HKjBPCLPGGTpdNBi5Y8 4UcK04wf8aYVr3pQF4X6pBoRx9YJYNaGrreaP0ECeRMYlV/xwEieKcCJIfGjAWG730s+ 9GweoZBCKkHMeJDenvn7xQii75FEkwc5PMCFv/Xj4FCQ2Yeo982CTlzjSqCai3VMzLRS 0uiw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=LFBbdm5V; spf=pass (google.com: domain of srs0=nia/=ii=linuxfoundation.org=gregkh@kernel.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=SRS0=nia/=II=linuxfoundation.org=gregkh@kernel.org Received: from mail.kernel.org (mail.kernel.org. [198.145.29.99]) by mx.google.com with ESMTPS id ay8-v6si15062964plb.244.2018.05.21.14.23.59 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 21 May 2018 14:23:59 -0700 (PDT) Received-SPF: pass (google.com: domain of srs0=nia/=ii=linuxfoundation.org=gregkh@kernel.org designates 198.145.29.99 as permitted sender) client-ip=198.145.29.99; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=LFBbdm5V; spf=pass (google.com: domain of srs0=nia/=ii=linuxfoundation.org=gregkh@kernel.org designates 198.145.29.99 as permitted sender) smtp.mailfrom=SRS0=nia/=II=linuxfoundation.org=gregkh@kernel.org Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id E878D20853; Mon, 21 May 2018 21:23:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1526937839; bh=8LGl64XpZKwKbTCbl4hl3AQ3loXtr7eO8CDkjMdvdgM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LFBbdm5VvUMbGUzlkniIcvyOWWfEDK1TgOnPxUCF8Mb5X31Hwygr3VZ6A14eBhXYe OSTcgBEO1szX2ppO7V+BGlTNhF7YMHBW2WI7ZdDVh2P7YPDCfizN4VwYkoPoBS7chy CDdMle/z6dacY+zcidJHiIUfQ5FG3cchrB+XG7p0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shakeel Butt , Dave Hansen , Andrew Morton , Dave Hansen , Linus Torvalds , Michael Ellermen , Peter Zijlstra , Ram Pai , Shuah Khan , Thomas Gleixner , linux-mm@kvack.org, Ingo Molnar Subject: [PATCH 4.16 045/110] x86/pkeys: Override pkey when moving away from PROT_EXEC Date: Mon, 21 May 2018 23:11:42 +0200 Message-Id: <20180521210508.147986510@linuxfoundation.org> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20180521210503.823249477@linuxfoundation.org> References: <20180521210503.823249477@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP 4.16-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dave Hansen commit 0a0b152083cfc44ec1bb599b57b7aab41327f998 upstream. I got a bug report that the following code (roughly) was causing a SIGSEGV: mprotect(ptr, size, PROT_EXEC); mprotect(ptr, size, PROT_NONE); mprotect(ptr, size, PROT_READ); *ptr = 100; The problem is hit when the mprotect(PROT_EXEC) is implicitly assigned a protection key to the VMA, and made that key ACCESS_DENY|WRITE_DENY. The PROT_NONE mprotect() failed to remove the protection key, and the PROT_NONE-> PROT_READ left the PTE usable, but the pkey still in place and left the memory inaccessible. To fix this, we ensure that we always "override" the pkee at mprotect() if the VMA does not have execute-only permissions, but the VMA has the execute-only pkey. We had a check for PROT_READ/WRITE, but it did not work for PROT_NONE. This entirely removes the PROT_* checks, which ensures that PROT_NONE now works. Reported-by: Shakeel Butt Signed-off-by: Dave Hansen Cc: Andrew Morton Cc: Dave Hansen Cc: Linus Torvalds Cc: Michael Ellermen Cc: Peter Zijlstra Cc: Ram Pai Cc: Shuah Khan Cc: Thomas Gleixner Cc: linux-mm@kvack.org Cc: stable@vger.kernel.org Fixes: 62b5f7d013f ("mm/core, x86/mm/pkeys: Add execute-only protection keys support") Link: http://lkml.kernel.org/r/20180509171351.084C5A71@viggo.jf.intel.com Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman --- arch/x86/include/asm/pkeys.h | 12 +++++++++++- arch/x86/mm/pkeys.c | 21 +++++++++++---------- 2 files changed, 22 insertions(+), 11 deletions(-) --- a/arch/x86/include/asm/pkeys.h +++ b/arch/x86/include/asm/pkeys.h @@ -2,6 +2,8 @@ #ifndef _ASM_X86_PKEYS_H #define _ASM_X86_PKEYS_H +#define ARCH_DEFAULT_PKEY 0 + #define arch_max_pkey() (boot_cpu_has(X86_FEATURE_OSPKE) ? 16 : 1) extern int arch_set_user_pkey_access(struct task_struct *tsk, int pkey, @@ -15,7 +17,7 @@ extern int __execute_only_pkey(struct mm static inline int execute_only_pkey(struct mm_struct *mm) { if (!boot_cpu_has(X86_FEATURE_OSPKE)) - return 0; + return ARCH_DEFAULT_PKEY; return __execute_only_pkey(mm); } @@ -56,6 +58,14 @@ bool mm_pkey_is_allocated(struct mm_stru return false; if (pkey >= arch_max_pkey()) return false; + /* + * The exec-only pkey is set in the allocation map, but + * is not available to any of the user interfaces like + * mprotect_pkey(). + */ + if (pkey == mm->context.execute_only_pkey) + return false; + return mm_pkey_allocation_map(mm) & (1U << pkey); } --- a/arch/x86/mm/pkeys.c +++ b/arch/x86/mm/pkeys.c @@ -94,26 +94,27 @@ int __arch_override_mprotect_pkey(struct */ if (pkey != -1) return pkey; - /* - * Look for a protection-key-drive execute-only mapping - * which is now being given permissions that are not - * execute-only. Move it back to the default pkey. - */ - if (vma_is_pkey_exec_only(vma) && - (prot & (PROT_READ|PROT_WRITE))) { - return 0; - } + /* * The mapping is execute-only. Go try to get the * execute-only protection key. If we fail to do that, * fall through as if we do not have execute-only - * support. + * support in this mm. */ if (prot == PROT_EXEC) { pkey = execute_only_pkey(vma->vm_mm); if (pkey > 0) return pkey; + } else if (vma_is_pkey_exec_only(vma)) { + /* + * Protections are *not* PROT_EXEC, but the mapping + * is using the exec-only pkey. This mapping was + * PROT_EXEC and will no longer be. Move back to + * the default pkey. + */ + return ARCH_DEFAULT_PKEY; } + /* * This is a vanilla, non-pkey mprotect (or we failed to * setup execute-only), inherit the pkey from the VMA we