]>
Commit | Line | Data |
---|---|---|
321d628a FG |
1 | From 45f502dae27e55fa46c65e71c226eec759ea7385 Mon Sep 17 00:00:00 2001 |
2 | From: Thomas Gleixner <tglx@linutronix.de> | |
3 | Date: Thu, 14 Dec 2017 12:27:29 +0100 | |
e4cdf2a5 | 4 | Subject: [PATCH 168/241] arch, mm: Allow arch_dup_mmap() to fail |
321d628a FG |
5 | MIME-Version: 1.0 |
6 | Content-Type: text/plain; charset=UTF-8 | |
7 | Content-Transfer-Encoding: 8bit | |
8 | ||
9 | CVE-2017-5754 | |
10 | ||
11 | In order to sanitize the LDT initialization on x86 arch_dup_mmap() must be | |
12 | allowed to fail. Fix up all instances. | |
13 | ||
14 | Signed-off-by: Thomas Gleixner <tglx@linutronix.de> | |
15 | Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> | |
16 | Cc: Andy Lutomirski <luto@kernel.org> | |
17 | Cc: Andy Lutomirsky <luto@kernel.org> | |
18 | Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com> | |
19 | Cc: Borislav Petkov <bp@alien8.de> | |
20 | Cc: Borislav Petkov <bpetkov@suse.de> | |
21 | Cc: Brian Gerst <brgerst@gmail.com> | |
22 | Cc: Dave Hansen <dave.hansen@intel.com> | |
23 | Cc: Dave Hansen <dave.hansen@linux.intel.com> | |
24 | Cc: David Laight <David.Laight@aculab.com> | |
25 | Cc: Denys Vlasenko <dvlasenk@redhat.com> | |
26 | Cc: Eduardo Valentin <eduval@amazon.com> | |
27 | Cc: Greg KH <gregkh@linuxfoundation.org> | |
28 | Cc: H. Peter Anvin <hpa@zytor.com> | |
29 | Cc: Josh Poimboeuf <jpoimboe@redhat.com> | |
30 | Cc: Juergen Gross <jgross@suse.com> | |
31 | Cc: Linus Torvalds <torvalds@linux-foundation.org> | |
32 | Cc: Peter Zijlstra <peterz@infradead.org> | |
33 | Cc: Will Deacon <will.deacon@arm.com> | |
34 | Cc: aliguori@amazon.com | |
35 | Cc: dan.j.williams@intel.com | |
36 | Cc: hughd@google.com | |
37 | Cc: keescook@google.com | |
38 | Cc: kirill.shutemov@linux.intel.com | |
39 | Cc: linux-mm@kvack.org | |
40 | Signed-off-by: Ingo Molnar <mingo@kernel.org> | |
41 | (cherry picked from commit c10e83f598d08046dd1ebc8360d4bb12d802d51b) | |
42 | Signed-off-by: Andy Whitcroft <apw@canonical.com> | |
43 | Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
44 | (cherry picked from commit b812abb61437eda1f5718a95085d67902f813f2f) | |
45 | Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> | |
46 | --- | |
47 | arch/powerpc/include/asm/mmu_context.h | 5 +++-- | |
48 | arch/um/include/asm/mmu_context.h | 3 ++- | |
49 | arch/unicore32/include/asm/mmu_context.h | 5 +++-- | |
50 | arch/x86/include/asm/mmu_context.h | 4 ++-- | |
51 | include/asm-generic/mm_hooks.h | 5 +++-- | |
52 | kernel/fork.c | 3 +-- | |
53 | 6 files changed, 14 insertions(+), 11 deletions(-) | |
54 | ||
55 | diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h | |
56 | index 35bec1c5bd5a..60afcc94e673 100644 | |
57 | --- a/arch/powerpc/include/asm/mmu_context.h | |
58 | +++ b/arch/powerpc/include/asm/mmu_context.h | |
59 | @@ -185,9 +185,10 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, | |
60 | #endif | |
61 | } | |
62 | ||
63 | -static inline void arch_dup_mmap(struct mm_struct *oldmm, | |
64 | - struct mm_struct *mm) | |
65 | +static inline int arch_dup_mmap(struct mm_struct *oldmm, | |
66 | + struct mm_struct *mm) | |
67 | { | |
68 | + return 0; | |
69 | } | |
70 | ||
71 | static inline void arch_exit_mmap(struct mm_struct *mm) | |
72 | diff --git a/arch/um/include/asm/mmu_context.h b/arch/um/include/asm/mmu_context.h | |
73 | index b668e351fd6c..fca34b2177e2 100644 | |
74 | --- a/arch/um/include/asm/mmu_context.h | |
75 | +++ b/arch/um/include/asm/mmu_context.h | |
76 | @@ -15,9 +15,10 @@ extern void uml_setup_stubs(struct mm_struct *mm); | |
77 | /* | |
78 | * Needed since we do not use the asm-generic/mm_hooks.h: | |
79 | */ | |
80 | -static inline void arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm) | |
81 | +static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm) | |
82 | { | |
83 | uml_setup_stubs(mm); | |
84 | + return 0; | |
85 | } | |
86 | extern void arch_exit_mmap(struct mm_struct *mm); | |
87 | static inline void arch_unmap(struct mm_struct *mm, | |
88 | diff --git a/arch/unicore32/include/asm/mmu_context.h b/arch/unicore32/include/asm/mmu_context.h | |
89 | index 59b06b48f27d..5c205a9cb5a6 100644 | |
90 | --- a/arch/unicore32/include/asm/mmu_context.h | |
91 | +++ b/arch/unicore32/include/asm/mmu_context.h | |
92 | @@ -81,9 +81,10 @@ do { \ | |
93 | } \ | |
94 | } while (0) | |
95 | ||
96 | -static inline void arch_dup_mmap(struct mm_struct *oldmm, | |
97 | - struct mm_struct *mm) | |
98 | +static inline int arch_dup_mmap(struct mm_struct *oldmm, | |
99 | + struct mm_struct *mm) | |
100 | { | |
101 | + return 0; | |
102 | } | |
103 | ||
104 | static inline void arch_unmap(struct mm_struct *mm, | |
105 | diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h | |
106 | index efc530642f7d..9be54d9c04c4 100644 | |
107 | --- a/arch/x86/include/asm/mmu_context.h | |
108 | +++ b/arch/x86/include/asm/mmu_context.h | |
109 | @@ -175,10 +175,10 @@ do { \ | |
110 | } while (0) | |
111 | #endif | |
112 | ||
113 | -static inline void arch_dup_mmap(struct mm_struct *oldmm, | |
114 | - struct mm_struct *mm) | |
115 | +static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm) | |
116 | { | |
117 | paravirt_arch_dup_mmap(oldmm, mm); | |
118 | + return 0; | |
119 | } | |
120 | ||
121 | static inline void arch_exit_mmap(struct mm_struct *mm) | |
122 | diff --git a/include/asm-generic/mm_hooks.h b/include/asm-generic/mm_hooks.h | |
123 | index 41e5b6784b97..7a2980f4e3e6 100644 | |
124 | --- a/include/asm-generic/mm_hooks.h | |
125 | +++ b/include/asm-generic/mm_hooks.h | |
126 | @@ -6,9 +6,10 @@ | |
127 | #ifndef _ASM_GENERIC_MM_HOOKS_H | |
128 | #define _ASM_GENERIC_MM_HOOKS_H | |
129 | ||
130 | -static inline void arch_dup_mmap(struct mm_struct *oldmm, | |
131 | - struct mm_struct *mm) | |
132 | +static inline int arch_dup_mmap(struct mm_struct *oldmm, | |
133 | + struct mm_struct *mm) | |
134 | { | |
135 | + return 0; | |
136 | } | |
137 | ||
138 | static inline void arch_exit_mmap(struct mm_struct *mm) | |
139 | diff --git a/kernel/fork.c b/kernel/fork.c | |
140 | index 8efc6b4466e3..1d907772b9d2 100644 | |
141 | --- a/kernel/fork.c | |
142 | +++ b/kernel/fork.c | |
143 | @@ -712,8 +712,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, | |
144 | goto out; | |
145 | } | |
146 | /* a new mm has just been created */ | |
147 | - arch_dup_mmap(oldmm, mm); | |
148 | - retval = 0; | |
149 | + retval = arch_dup_mmap(oldmm, mm); | |
150 | out: | |
151 | up_write(&mm->mmap_sem); | |
152 | flush_tlb_mm(oldmm); | |
153 | -- | |
154 | 2.14.2 | |
155 |