patches/kernel/0164-x86-mm-dump_pagetables-Check-PAGE_PRESENT-for-real.patch

   1 From d54a0500d55a2856efdea3b427e91d8fcf74ca63 Mon Sep 17 00:00:00 2001
   2 From: Thomas Gleixner <tglx@linutronix.de>
   3 Date: Sat, 16 Dec 2017 01:14:39 +0100
   4 Subject: [PATCH 164/241] x86/mm/dump_pagetables: Check PAGE_PRESENT for real
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5754
  10
  11 The check for a present page in printk_prot():
  12
  13        if (!pgprot_val(prot)) {
  14                 /* Not present */
  15
  16 is bogus. If a PTE is set to PAGE_NONE then the pgprot_val is not zero and
  17 the entry is decoded in bogus ways, e.g. as RX GLB. That is confusing when
  18 analyzing mapping correctness. Check for the present bit to make an
  19 informed decision.
  20
  21 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  22 Cc: Andy Lutomirski <luto@kernel.org>
  23 Cc: Borislav Petkov <bp@alien8.de>
  24 Cc: Dave Hansen <dave.hansen@linux.intel.com>
  25 Cc: H. Peter Anvin <hpa@zytor.com>
  26 Cc: Josh Poimboeuf <jpoimboe@redhat.com>
  27 Cc: Juergen Gross <jgross@suse.com>
  28 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  29 Cc: Peter Zijlstra <peterz@infradead.org>
  30 Cc: linux-kernel@vger.kernel.org
  31 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  32 (cherry picked from commit c05344947b37f7cda726e802457370bc6eac4d26)
  33 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  34 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  35 (cherry picked from commit d902780eaea12f23b50be4ff00f8df6157c30e4a)
  36 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  37 ---
  38  arch/x86/mm/dump_pagetables.c | 2 +-
  39  1 file changed, 1 insertion(+), 1 deletion(-)
  40
  41 diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
  42 index 0470826d2bdc..91aa41c5e0dd 100644
  43 --- a/arch/x86/mm/dump_pagetables.c
  44 +++ b/arch/x86/mm/dump_pagetables.c
  45 @@ -140,7 +140,7 @@ static void printk_prot(struct seq_file *m, pgprot_t prot, int level, bool dmsg)
  46         static const char * const level_name[] =
  47                 { "cr3", "pgd", "pud", "pmd", "pte" };
  48
  49 -       if (!pgprot_val(prot)) {
  50 +       if (!(pr & _PAGE_PRESENT)) {
  51                 /* Not present */
  52                 pt_dump_cont_printf(m, dmsg, "                              ");
  53         } else {
  54 --
  55 2.14.2
  56