]>
Commit | Line | Data |
---|---|---|
59d5af67 | 1 | From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 |
321d628a FG |
2 | From: Andy Lutomirski <luto@kernel.org> |
3 | Date: Sun, 10 Dec 2017 22:47:19 -0800 | |
59d5af67 FG |
4 | Subject: [PATCH] x86/vsyscall/64: Explicitly set _PAGE_USER in the pagetable |
5 | hierarchy | |
321d628a FG |
6 | MIME-Version: 1.0 |
7 | Content-Type: text/plain; charset=UTF-8 | |
8 | Content-Transfer-Encoding: 8bit | |
9 | ||
10 | CVE-2017-5754 | |
11 | ||
12 | The kernel is very erratic as to which pagetables have _PAGE_USER set. The | |
13 | vsyscall page gets lucky: it seems that all of the relevant pagetables are | |
14 | among the apparently arbitrary ones that set _PAGE_USER. Rather than | |
15 | relying on chance, just explicitly set _PAGE_USER. | |
16 | ||
17 | This will let us clean up pagetable setup to stop setting _PAGE_USER. The | |
18 | added code can also be reused by pagetable isolation to manage the | |
19 | _PAGE_USER bit in the usermode tables. | |
20 | ||
21 | [ tglx: Folded paravirt fix from Juergen Gross ] | |
22 | ||
23 | Signed-off-by: Andy Lutomirski <luto@kernel.org> | |
24 | Signed-off-by: Thomas Gleixner <tglx@linutronix.de> | |
25 | Cc: Borislav Petkov <bp@alien8.de> | |
26 | Cc: Brian Gerst <brgerst@gmail.com> | |
27 | Cc: Dave Hansen <dave.hansen@linux.intel.com> | |
28 | Cc: David Laight <David.Laight@aculab.com> | |
29 | Cc: H. Peter Anvin <hpa@zytor.com> | |
30 | Cc: Josh Poimboeuf <jpoimboe@redhat.com> | |
31 | Cc: Juergen Gross <jgross@suse.com> | |
32 | Cc: Kees Cook <keescook@chromium.org> | |
33 | Cc: Linus Torvalds <torvalds@linux-foundation.org> | |
34 | Cc: Peter Zijlstra <peterz@infradead.org> | |
35 | Signed-off-by: Ingo Molnar <mingo@kernel.org> | |
36 | (cherry picked from commit 49275fef986abfb8b476e4708aaecc07e7d3e087) | |
37 | Signed-off-by: Andy Whitcroft <apw@canonical.com> | |
38 | Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> | |
39 | (cherry picked from commit 445742d3632efea229c0b974f91e56a19cf31996) | |
40 | Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> | |
41 | --- | |
42 | arch/x86/entry/vsyscall/vsyscall_64.c | 34 +++++++++++++++++++++++++++++++++- | |
43 | 1 file changed, 33 insertions(+), 1 deletion(-) | |
44 | ||
45 | diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c | |
46 | index ce1d7534fa53..91f3133cf5f1 100644 | |
47 | --- a/arch/x86/entry/vsyscall/vsyscall_64.c | |
48 | +++ b/arch/x86/entry/vsyscall/vsyscall_64.c | |
49 | @@ -36,6 +36,7 @@ | |
50 | #include <asm/unistd.h> | |
51 | #include <asm/fixmap.h> | |
52 | #include <asm/traps.h> | |
53 | +#include <asm/paravirt.h> | |
54 | ||
55 | #define CREATE_TRACE_POINTS | |
56 | #include "vsyscall_trace.h" | |
57 | @@ -328,16 +329,47 @@ int in_gate_area_no_mm(unsigned long addr) | |
58 | return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR; | |
59 | } | |
60 | ||
61 | +/* | |
62 | + * The VSYSCALL page is the only user-accessible page in the kernel address | |
63 | + * range. Normally, the kernel page tables can have _PAGE_USER clear, but | |
64 | + * the tables covering VSYSCALL_ADDR need _PAGE_USER set if vsyscalls | |
65 | + * are enabled. | |
66 | + * | |
67 | + * Some day we may create a "minimal" vsyscall mode in which we emulate | |
68 | + * vsyscalls but leave the page not present. If so, we skip calling | |
69 | + * this. | |
70 | + */ | |
71 | +static void __init set_vsyscall_pgtable_user_bits(void) | |
72 | +{ | |
73 | + pgd_t *pgd; | |
74 | + p4d_t *p4d; | |
75 | + pud_t *pud; | |
76 | + pmd_t *pmd; | |
77 | + | |
78 | + pgd = pgd_offset_k(VSYSCALL_ADDR); | |
79 | + set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER)); | |
80 | + p4d = p4d_offset(pgd, VSYSCALL_ADDR); | |
81 | +#if CONFIG_PGTABLE_LEVELS >= 5 | |
82 | + p4d->p4d |= _PAGE_USER; | |
83 | +#endif | |
84 | + pud = pud_offset(p4d, VSYSCALL_ADDR); | |
85 | + set_pud(pud, __pud(pud_val(*pud) | _PAGE_USER)); | |
86 | + pmd = pmd_offset(pud, VSYSCALL_ADDR); | |
87 | + set_pmd(pmd, __pmd(pmd_val(*pmd) | _PAGE_USER)); | |
88 | +} | |
89 | + | |
90 | void __init map_vsyscall(void) | |
91 | { | |
92 | extern char __vsyscall_page; | |
93 | unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page); | |
94 | ||
95 | - if (vsyscall_mode != NONE) | |
96 | + if (vsyscall_mode != NONE) { | |
97 | __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall, | |
98 | vsyscall_mode == NATIVE | |
99 | ? PAGE_KERNEL_VSYSCALL | |
100 | : PAGE_KERNEL_VVAR); | |
101 | + set_vsyscall_pgtable_user_bits(); | |
102 | + } | |
103 | ||
104 | BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) != | |
105 | (unsigned long)VSYSCALL_ADDR); | |
106 | -- | |
107 | 2.14.2 | |
108 |