]>
Commit | Line | Data |
---|---|---|
035dbe67 FG |
1 | From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
2 | From: Jike Song <albcamus@gmail.com> | |
3 | Date: Tue, 9 Jan 2018 00:03:41 +0800 | |
4 | Subject: [PATCH] x86/mm/pti: Remove dead logic in pti_user_pagetable_walk*() | |
5 | MIME-Version: 1.0 | |
6 | Content-Type: text/plain; charset=UTF-8 | |
7 | Content-Transfer-Encoding: 8bit | |
8 | ||
9 | CVE-2017-5754 | |
10 | ||
11 | The following code contains dead logic: | |
12 | ||
13 | 162 if (pgd_none(*pgd)) { | |
14 | 163 unsigned long new_p4d_page = __get_free_page(gfp); | |
15 | 164 if (!new_p4d_page) | |
16 | 165 return NULL; | |
17 | 166 | |
18 | 167 if (pgd_none(*pgd)) { | |
19 | 168 set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page))); | |
20 | 169 new_p4d_page = 0; | |
21 | 170 } | |
22 | 171 if (new_p4d_page) | |
23 | 172 free_page(new_p4d_page); | |
24 | 173 } | |
25 | ||
26 | There can't be any difference between two pgd_none(*pgd) at L162 and L167, | |
27 | so it's always false at L171. | |
28 | ||
29 | Dave Hansen explained: | |
30 | ||
31 | Yes, the double-test was part of an optimization where we attempted to | |
32 | avoid using a global spinlock in the fork() path. We would check for | |
33 | unallocated mid-level page tables without the lock. The lock was only | |
34 | taken when we needed to *make* an entry to avoid collisions. | |
35 | ||
36 | Now that it is all single-threaded, there is no chance of a collision, | |
37 | no need for a lock, and no need for the re-check. | |
38 | ||
39 | As all these functions are only called during init, mark them __init as | |
40 | well. | |
41 | ||
42 | Fixes: 03f4424f348e ("x86/mm/pti: Add functions to clone kernel PMDs") | |
43 | Signed-off-by: Jike Song <albcamus@gmail.com> | |
44 | Signed-off-by: Thomas Gleixner <tglx@linutronix.de> | |
45 | Cc: Alan Cox <gnomes@lxorguk.ukuu.org.uk> | |
46 | Cc: Andi Kleen <ak@linux.intel.com> | |
47 | Cc: Tom Lendacky <thomas.lendacky@amd.com> | |
48 | Cc: Peter Zijlstra <peterz@infradead.org> | |
49 | Cc: Tim Chen <tim.c.chen@linux.intel.com> | |
50 | Cc: Jiri Koshina <jikos@kernel.org> | |
51 | Cc: Dave Hansen <dave.hansen@intel.com> | |
52 | Cc: Borislav Petkov <bp@alien8.de> | |
53 | Cc: Kees Cook <keescook@google.com> | |
54 | Cc: Andi Lutomirski <luto@amacapital.net> | |
55 | Cc: Linus Torvalds <torvalds@linux-foundation.org> | |
56 | Cc: Greg KH <gregkh@linux-foundation.org> | |
57 | Cc: David Woodhouse <dwmw@amazon.co.uk> | |
58 | Cc: Paul Turner <pjt@google.com> | |
59 | Cc: stable@vger.kernel.org | |
60 | Link: https://lkml.kernel.org/r/20180108160341.3461-1-albcamus@gmail.com | |
61 | ||
62 | (cherry picked from commit 8d56eff266f3e41a6c39926269c4c3f58f881a8e) | |
63 | Signed-off-by: Andy Whitcroft <apw@canonical.com> | |
64 | Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
65 | (cherry picked from commit de8ab6bea570e70d1478af2c1667714bc900ae70) | |
66 | Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> | |
67 | --- | |
68 | arch/x86/mm/pti.c | 32 ++++++-------------------------- | |
69 | 1 file changed, 6 insertions(+), 26 deletions(-) | |
70 | ||
71 | diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c | |
72 | index 43d4a4a29037..ce38f165489b 100644 | |
73 | --- a/arch/x86/mm/pti.c | |
74 | +++ b/arch/x86/mm/pti.c | |
75 | @@ -149,7 +149,7 @@ pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd) | |
76 | * | |
77 | * Returns a pointer to a P4D on success, or NULL on failure. | |
78 | */ | |
79 | -static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address) | |
80 | +static __init p4d_t *pti_user_pagetable_walk_p4d(unsigned long address) | |
81 | { | |
82 | pgd_t *pgd = kernel_to_user_pgdp(pgd_offset_k(address)); | |
83 | gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO); | |
84 | @@ -164,12 +164,7 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address) | |
85 | if (!new_p4d_page) | |
86 | return NULL; | |
87 | ||
88 | - if (pgd_none(*pgd)) { | |
89 | - set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page))); | |
90 | - new_p4d_page = 0; | |
91 | - } | |
92 | - if (new_p4d_page) | |
93 | - free_page(new_p4d_page); | |
94 | + set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page))); | |
95 | } | |
96 | BUILD_BUG_ON(pgd_large(*pgd) != 0); | |
97 | ||
98 | @@ -182,7 +177,7 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address) | |
99 | * | |
100 | * Returns a pointer to a PMD on success, or NULL on failure. | |
101 | */ | |
102 | -static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) | |
103 | +static __init pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) | |
104 | { | |
105 | gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO); | |
106 | p4d_t *p4d = pti_user_pagetable_walk_p4d(address); | |
107 | @@ -194,12 +189,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) | |
108 | if (!new_pud_page) | |
109 | return NULL; | |
110 | ||
111 | - if (p4d_none(*p4d)) { | |
112 | - set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page))); | |
113 | - new_pud_page = 0; | |
114 | - } | |
115 | - if (new_pud_page) | |
116 | - free_page(new_pud_page); | |
117 | + set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page))); | |
118 | } | |
119 | ||
120 | pud = pud_offset(p4d, address); | |
121 | @@ -213,12 +203,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address) | |
122 | if (!new_pmd_page) | |
123 | return NULL; | |
124 | ||
125 | - if (pud_none(*pud)) { | |
126 | - set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page))); | |
127 | - new_pmd_page = 0; | |
128 | - } | |
129 | - if (new_pmd_page) | |
130 | - free_page(new_pmd_page); | |
131 | + set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page))); | |
132 | } | |
133 | ||
134 | return pmd_offset(pud, address); | |
135 | @@ -251,12 +236,7 @@ static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address) | |
136 | if (!new_pte_page) | |
137 | return NULL; | |
138 | ||
139 | - if (pmd_none(*pmd)) { | |
140 | - set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page))); | |
141 | - new_pte_page = 0; | |
142 | - } | |
143 | - if (new_pte_page) | |
144 | - free_page(new_pte_page); | |
145 | + set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page))); | |
146 | } | |
147 | ||
148 | pte = pte_offset_kernel(pmd, address); | |
149 | -- | |
150 | 2.14.2 | |
151 |