patches/kernel/0146-x86-kasan-64-Teach-KASAN-about-the-cpu_entry_area.patch

   1 From 37fa97179211b36e3b5d3eb2dae94ad420ea9732 Mon Sep 17 00:00:00 2001
   2 From: Andy Lutomirski <luto@kernel.org>
   3 Date: Mon, 4 Dec 2017 15:07:16 +0100
   4 Subject: [PATCH 146/233] x86/kasan/64: Teach KASAN about the cpu_entry_area
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5754
  10
  11 The cpu_entry_area will contain stacks.  Make sure that KASAN has
  12 appropriate shadow mappings for them.
  13
  14 Signed-off-by: Andy Lutomirski <luto@kernel.org>
  15 Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
  16 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  17 Cc: Alexander Potapenko <glider@google.com>
  18 Cc: Boris Ostrovsky <boris.ostrovsky@oracle.com>
  19 Cc: Borislav Petkov <bp@alien8.de>
  20 Cc: Borislav Petkov <bpetkov@suse.de>
  21 Cc: Brian Gerst <brgerst@gmail.com>
  22 Cc: Dave Hansen <dave.hansen@intel.com>
  23 Cc: Dave Hansen <dave.hansen@linux.intel.com>
  24 Cc: David Laight <David.Laight@aculab.com>
  25 Cc: Denys Vlasenko <dvlasenk@redhat.com>
  26 Cc: Dmitry Vyukov <dvyukov@google.com>
  27 Cc: Eduardo Valentin <eduval@amazon.com>
  28 Cc: Greg KH <gregkh@linuxfoundation.org>
  29 Cc: H. Peter Anvin <hpa@zytor.com>
  30 Cc: Josh Poimboeuf <jpoimboe@redhat.com>
  31 Cc: Juergen Gross <jgross@suse.com>
  32 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  33 Cc: Peter Zijlstra <peterz@infradead.org>
  34 Cc: Rik van Riel <riel@redhat.com>
  35 Cc: Will Deacon <will.deacon@arm.com>
  36 Cc: aliguori@amazon.com
  37 Cc: daniel.gruss@iaik.tugraz.at
  38 Cc: hughd@google.com
  39 Cc: kasan-dev@googlegroups.com
  40 Cc: keescook@google.com
  41 Link: https://lkml.kernel.org/r/20171204150605.642806442@linutronix.de
  42 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  43 (cherry picked from commit 21506525fb8ddb0342f2a2370812d47f6a1f3833)
  44 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  45 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  46 (cherry picked from commit 17833d4cfca7e4284f68fb9f3804a91f2541a83a)
  47 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  48 ---
  49  arch/x86/mm/kasan_init_64.c | 18 +++++++++++++++++-
  50  1 file changed, 17 insertions(+), 1 deletion(-)
  51
  52 diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c
  53 index 3d7341986e13..d8836e45bc07 100644
  54 --- a/arch/x86/mm/kasan_init_64.c
  55 +++ b/arch/x86/mm/kasan_init_64.c
  56 @@ -276,6 +276,7 @@ void __init kasan_early_init(void)
  57  void __init kasan_init(void)
  58  {
  59         int i;
  60 +       void *shadow_cpu_entry_begin, *shadow_cpu_entry_end;
  61
  62  #ifdef CONFIG_KASAN_INLINE
  63         register_die_notifier(&kasan_die_notifier);
  64 @@ -328,8 +329,23 @@ void __init kasan_init(void)
  65                               (unsigned long)kasan_mem_to_shadow(_end),
  66                               early_pfn_to_nid(__pa(_stext)));
  67
  68 +       shadow_cpu_entry_begin = (void *)__fix_to_virt(FIX_CPU_ENTRY_AREA_BOTTOM);
  69 +       shadow_cpu_entry_begin = kasan_mem_to_shadow(shadow_cpu_entry_begin);
  70 +       shadow_cpu_entry_begin = (void *)round_down((unsigned long)shadow_cpu_entry_begin,
  71 +                                               PAGE_SIZE);
  72 +
  73 +       shadow_cpu_entry_end = (void *)(__fix_to_virt(FIX_CPU_ENTRY_AREA_TOP) + PAGE_SIZE);
  74 +       shadow_cpu_entry_end = kasan_mem_to_shadow(shadow_cpu_entry_end);
  75 +       shadow_cpu_entry_end = (void *)round_up((unsigned long)shadow_cpu_entry_end,
  76 +                                       PAGE_SIZE);
  77 +
  78         kasan_populate_zero_shadow(kasan_mem_to_shadow((void *)MODULES_END),
  79 -                       (void *)KASAN_SHADOW_END);
  80 +                                  shadow_cpu_entry_begin);
  81 +
  82 +       kasan_populate_shadow((unsigned long)shadow_cpu_entry_begin,
  83 +                             (unsigned long)shadow_cpu_entry_end, 0);
  84 +
  85 +       kasan_populate_zero_shadow(shadow_cpu_entry_end, (void *)KASAN_SHADOW_END);
  86
  87         load_cr3(init_top_pgt);
  88         __flush_tlb_all();
  89 --
  90 2.14.2
  91