]>
Commit | Line | Data |
---|---|---|
321d628a FG |
1 | From 5a86516e393d12bb3965342f1f690db319d01241 Mon Sep 17 00:00:00 2001 |
2 | From: Thomas Gleixner <tglx@linutronix.de> | |
3 | Date: Sat, 30 Dec 2017 22:13:54 +0100 | |
4 | Subject: [PATCH 220/231] x86/mm: Remove preempt_disable/enable() from | |
5 | __native_flush_tlb() | |
6 | MIME-Version: 1.0 | |
7 | Content-Type: text/plain; charset=UTF-8 | |
8 | Content-Transfer-Encoding: 8bit | |
9 | ||
10 | CVE-2017-5754 | |
11 | ||
12 | The preempt_disable/enable() pair in __native_flush_tlb() was added in | |
13 | commit: | |
14 | ||
15 | 5cf0791da5c1 ("x86/mm: Disable preemption during CR3 read+write") | |
16 | ||
17 | ... to protect the UP variant of flush_tlb_mm_range(). | |
18 | ||
19 | That preempt_disable/enable() pair should have been added to the UP variant | |
20 | of flush_tlb_mm_range() instead. | |
21 | ||
22 | The UP variant was removed with commit: | |
23 | ||
24 | ce4a4e565f52 ("x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code") | |
25 | ||
26 | ... but the preempt_disable/enable() pair stayed around. | |
27 | ||
28 | The latest change to __native_flush_tlb() in commit: | |
29 | ||
30 | 6fd166aae78c ("x86/mm: Use/Fix PCID to optimize user/kernel switches") | |
31 | ||
32 | ... added an access to a per CPU variable outside the preempt disabled | |
33 | regions, which makes no sense at all. __native_flush_tlb() must always | |
34 | be called with at least preemption disabled. | |
35 | ||
36 | Remove the preempt_disable/enable() pair and add a WARN_ON_ONCE() to catch | |
37 | bad callers independent of the smp_processor_id() debugging. | |
38 | ||
39 | Signed-off-by: Thomas Gleixner <tglx@linutronix.de> | |
40 | Cc: <stable@vger.kernel.org> | |
41 | Cc: Andy Lutomirski <luto@kernel.org> | |
42 | Cc: Borislav Petkov <bp@alien8.de> | |
43 | Cc: Dave Hansen <dave.hansen@linux.intel.com> | |
44 | Cc: Dominik Brodowski <linux@dominikbrodowski.net> | |
45 | Cc: Linus Torvalds <torvalds@linux-foundation.org> | |
46 | Cc: Linus Torvalds <torvalds@linuxfoundation.org> | |
47 | Cc: Peter Zijlstra <peterz@infradead.org> | |
48 | Link: http://lkml.kernel.org/r/20171230211829.679325424@linutronix.de | |
49 | Signed-off-by: Ingo Molnar <mingo@kernel.org> | |
50 | (cherry picked from commit decab0888e6e14e11d53cefa85f8b3d3b45ce73c) | |
51 | Signed-off-by: Andy Whitcroft <apw@canonical.com> | |
52 | Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
53 | (cherry picked from commit cfcf931c425b60d0092bcb4a4deb1f5d5db0e293) | |
54 | Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> | |
55 | --- | |
56 | arch/x86/include/asm/tlbflush.h | 14 ++++++++------ | |
57 | 1 file changed, 8 insertions(+), 6 deletions(-) | |
58 | ||
59 | diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h | |
60 | index 7a04a1f1ca11..ff6a6d668c32 100644 | |
61 | --- a/arch/x86/include/asm/tlbflush.h | |
62 | +++ b/arch/x86/include/asm/tlbflush.h | |
63 | @@ -334,15 +334,17 @@ static inline void invalidate_user_asid(u16 asid) | |
64 | */ | |
65 | static inline void __native_flush_tlb(void) | |
66 | { | |
67 | - invalidate_user_asid(this_cpu_read(cpu_tlbstate.loaded_mm_asid)); | |
68 | /* | |
69 | - * If current->mm == NULL then we borrow a mm which may change | |
70 | - * during a task switch and therefore we must not be preempted | |
71 | - * while we write CR3 back: | |
72 | + * Preemption or interrupts must be disabled to protect the access | |
73 | + * to the per CPU variable and to prevent being preempted between | |
74 | + * read_cr3() and write_cr3(). | |
75 | */ | |
76 | - preempt_disable(); | |
77 | + WARN_ON_ONCE(preemptible()); | |
78 | + | |
79 | + invalidate_user_asid(this_cpu_read(cpu_tlbstate.loaded_mm_asid)); | |
80 | + | |
81 | + /* If current->mm == NULL then the read_cr3() "borrows" an mm */ | |
82 | native_write_cr3(__native_read_cr3()); | |
83 | - preempt_enable(); | |
84 | } | |
85 | ||
86 | /* | |
87 | -- | |
88 | 2.14.2 | |
89 |