patches/kernel/0166-x86-vsyscall-64-Explicitly-set-_PAGE_USER-in-the-pag.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Andy Lutomirski <luto@kernel.org>
   3 Date: Sun, 10 Dec 2017 22:47:19 -0800
   4 Subject: [PATCH] x86/vsyscall/64: Explicitly set _PAGE_USER in the pagetable
   5  hierarchy
   6 MIME-Version: 1.0
   7 Content-Type: text/plain; charset=UTF-8
   8 Content-Transfer-Encoding: 8bit
   9
  10 CVE-2017-5754
  11
  12 The kernel is very erratic as to which pagetables have _PAGE_USER set.  The
  13 vsyscall page gets lucky: it seems that all of the relevant pagetables are
  14 among the apparently arbitrary ones that set _PAGE_USER.  Rather than
  15 relying on chance, just explicitly set _PAGE_USER.
  16
  17 This will let us clean up pagetable setup to stop setting _PAGE_USER.  The
  18 added code can also be reused by pagetable isolation to manage the
  19 _PAGE_USER bit in the usermode tables.
  20
  21 [ tglx: Folded paravirt fix from Juergen Gross ]
  22
  23 Signed-off-by: Andy Lutomirski <luto@kernel.org>
  24 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  25 Cc: Borislav Petkov <bp@alien8.de>
  26 Cc: Brian Gerst <brgerst@gmail.com>
  27 Cc: Dave Hansen <dave.hansen@linux.intel.com>
  28 Cc: David Laight <David.Laight@aculab.com>
  29 Cc: H. Peter Anvin <hpa@zytor.com>
  30 Cc: Josh Poimboeuf <jpoimboe@redhat.com>
  31 Cc: Juergen Gross <jgross@suse.com>
  32 Cc: Kees Cook <keescook@chromium.org>
  33 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  34 Cc: Peter Zijlstra <peterz@infradead.org>
  35 Signed-off-by: Ingo Molnar <mingo@kernel.org>
  36 (cherry picked from commit 49275fef986abfb8b476e4708aaecc07e7d3e087)
  37 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  38 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  39 (cherry picked from commit 445742d3632efea229c0b974f91e56a19cf31996)
  40 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  41 ---
  42  arch/x86/entry/vsyscall/vsyscall_64.c | 34 +++++++++++++++++++++++++++++++++-
  43  1 file changed, 33 insertions(+), 1 deletion(-)
  44
  45 diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
  46 index ce1d7534fa53..91f3133cf5f1 100644
  47 --- a/arch/x86/entry/vsyscall/vsyscall_64.c
  48 +++ b/arch/x86/entry/vsyscall/vsyscall_64.c
  49 @@ -36,6 +36,7 @@
  50  #include <asm/unistd.h>
  51  #include <asm/fixmap.h>
  52  #include <asm/traps.h>
  53 +#include <asm/paravirt.h>
  54
  55  #define CREATE_TRACE_POINTS
  56  #include "vsyscall_trace.h"
  57 @@ -328,16 +329,47 @@ int in_gate_area_no_mm(unsigned long addr)
  58         return vsyscall_mode != NONE && (addr & PAGE_MASK) == VSYSCALL_ADDR;
  59  }
  60
  61 +/*
  62 + * The VSYSCALL page is the only user-accessible page in the kernel address
  63 + * range.  Normally, the kernel page tables can have _PAGE_USER clear, but
  64 + * the tables covering VSYSCALL_ADDR need _PAGE_USER set if vsyscalls
  65 + * are enabled.
  66 + *
  67 + * Some day we may create a "minimal" vsyscall mode in which we emulate
  68 + * vsyscalls but leave the page not present.  If so, we skip calling
  69 + * this.
  70 + */
  71 +static void __init set_vsyscall_pgtable_user_bits(void)
  72 +{
  73 +       pgd_t *pgd;
  74 +       p4d_t *p4d;
  75 +       pud_t *pud;
  76 +       pmd_t *pmd;
  77 +
  78 +       pgd = pgd_offset_k(VSYSCALL_ADDR);
  79 +       set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER));
  80 +       p4d = p4d_offset(pgd, VSYSCALL_ADDR);
  81 +#if CONFIG_PGTABLE_LEVELS >= 5
  82 +       p4d->p4d |= _PAGE_USER;
  83 +#endif
  84 +       pud = pud_offset(p4d, VSYSCALL_ADDR);
  85 +       set_pud(pud, __pud(pud_val(*pud) | _PAGE_USER));
  86 +       pmd = pmd_offset(pud, VSYSCALL_ADDR);
  87 +       set_pmd(pmd, __pmd(pmd_val(*pmd) | _PAGE_USER));
  88 +}
  89 +
  90  void __init map_vsyscall(void)
  91  {
  92         extern char __vsyscall_page;
  93         unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page);
  94
  95 -       if (vsyscall_mode != NONE)
  96 +       if (vsyscall_mode != NONE) {
  97                 __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall,
  98                              vsyscall_mode == NATIVE
  99                              ? PAGE_KERNEL_VSYSCALL
 100                              : PAGE_KERNEL_VVAR);
 101 +               set_vsyscall_pgtable_user_bits();
 102 +       }
 103
 104         BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) !=
 105                      (unsigned long)VSYSCALL_ADDR);
 106 --
 107 2.14.2
 108