patches/kernel/0254-x86-mm-pti-Remove-dead-logic-in-pti_user_pagetable_w.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Jike Song <albcamus@gmail.com>
   3 Date: Tue, 9 Jan 2018 00:03:41 +0800
   4 Subject: [PATCH] x86/mm/pti: Remove dead logic in pti_user_pagetable_walk*()
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5754
  10
  11 The following code contains dead logic:
  12
  13  162 if (pgd_none(*pgd)) {
  14  163         unsigned long new_p4d_page = __get_free_page(gfp);
  15  164         if (!new_p4d_page)
  16  165                 return NULL;
  17  166
  18  167         if (pgd_none(*pgd)) {
  19  168                 set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page)));
  20  169                 new_p4d_page = 0;
  21  170         }
  22  171         if (new_p4d_page)
  23  172                 free_page(new_p4d_page);
  24  173 }
  25
  26 There can't be any difference between two pgd_none(*pgd) at L162 and L167,
  27 so it's always false at L171.
  28
  29 Dave Hansen explained:
  30
  31  Yes, the double-test was part of an optimization where we attempted to
  32  avoid using a global spinlock in the fork() path.  We would check for
  33  unallocated mid-level page tables without the lock.  The lock was only
  34  taken when we needed to *make* an entry to avoid collisions.
  35
  36  Now that it is all single-threaded, there is no chance of a collision,
  37  no need for a lock, and no need for the re-check.
  38
  39 As all these functions are only called during init, mark them __init as
  40 well.
  41
  42 Fixes: 03f4424f348e ("x86/mm/pti: Add functions to clone kernel PMDs")
  43 Signed-off-by: Jike Song <albcamus@gmail.com>
  44 Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  45 Cc: Alan Cox <gnomes@lxorguk.ukuu.org.uk>
  46 Cc: Andi Kleen <ak@linux.intel.com>
  47 Cc: Tom Lendacky <thomas.lendacky@amd.com>
  48 Cc: Peter Zijlstra <peterz@infradead.org>
  49 Cc: Tim Chen <tim.c.chen@linux.intel.com>
  50 Cc: Jiri Koshina <jikos@kernel.org>
  51 Cc: Dave Hansen <dave.hansen@intel.com>
  52 Cc: Borislav Petkov <bp@alien8.de>
  53 Cc: Kees Cook <keescook@google.com>
  54 Cc: Andi Lutomirski <luto@amacapital.net>
  55 Cc: Linus Torvalds <torvalds@linux-foundation.org>
  56 Cc: Greg KH <gregkh@linux-foundation.org>
  57 Cc: David Woodhouse <dwmw@amazon.co.uk>
  58 Cc: Paul Turner <pjt@google.com>
  59 Cc: stable@vger.kernel.org
  60 Link: https://lkml.kernel.org/r/20180108160341.3461-1-albcamus@gmail.com
  61
  62 (cherry picked from commit 8d56eff266f3e41a6c39926269c4c3f58f881a8e)
  63 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  64 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  65 (cherry picked from commit de8ab6bea570e70d1478af2c1667714bc900ae70)
  66 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  67 ---
  68  arch/x86/mm/pti.c | 32 ++++++--------------------------
  69  1 file changed, 6 insertions(+), 26 deletions(-)
  70
  71 diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c
  72 index 43d4a4a29037..ce38f165489b 100644
  73 --- a/arch/x86/mm/pti.c
  74 +++ b/arch/x86/mm/pti.c
  75 @@ -149,7 +149,7 @@ pgd_t __pti_set_user_pgd(pgd_t *pgdp, pgd_t pgd)
  76   *
  77   * Returns a pointer to a P4D on success, or NULL on failure.
  78   */
  79 -static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
  80 +static __init p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
  81  {
  82         pgd_t *pgd = kernel_to_user_pgdp(pgd_offset_k(address));
  83         gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
  84 @@ -164,12 +164,7 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
  85                 if (!new_p4d_page)
  86                         return NULL;
  87
  88 -               if (pgd_none(*pgd)) {
  89 -                       set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page)));
  90 -                       new_p4d_page = 0;
  91 -               }
  92 -               if (new_p4d_page)
  93 -                       free_page(new_p4d_page);
  94 +               set_pgd(pgd, __pgd(_KERNPG_TABLE | __pa(new_p4d_page)));
  95         }
  96         BUILD_BUG_ON(pgd_large(*pgd) != 0);
  97
  98 @@ -182,7 +177,7 @@ static p4d_t *pti_user_pagetable_walk_p4d(unsigned long address)
  99   *
 100   * Returns a pointer to a PMD on success, or NULL on failure.
 101   */
 102 -static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
 103 +static __init pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
 104  {
 105         gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO);
 106         p4d_t *p4d = pti_user_pagetable_walk_p4d(address);
 107 @@ -194,12 +189,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
 108                 if (!new_pud_page)
 109                         return NULL;
 110
 111 -               if (p4d_none(*p4d)) {
 112 -                       set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page)));
 113 -                       new_pud_page = 0;
 114 -               }
 115 -               if (new_pud_page)
 116 -                       free_page(new_pud_page);
 117 +               set_p4d(p4d, __p4d(_KERNPG_TABLE | __pa(new_pud_page)));
 118         }
 119
 120         pud = pud_offset(p4d, address);
 121 @@ -213,12 +203,7 @@ static pmd_t *pti_user_pagetable_walk_pmd(unsigned long address)
 122                 if (!new_pmd_page)
 123                         return NULL;
 124
 125 -               if (pud_none(*pud)) {
 126 -                       set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page)));
 127 -                       new_pmd_page = 0;
 128 -               }
 129 -               if (new_pmd_page)
 130 -                       free_page(new_pmd_page);
 131 +               set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page)));
 132         }
 133
 134         return pmd_offset(pud, address);
 135 @@ -251,12 +236,7 @@ static __init pte_t *pti_user_pagetable_walk_pte(unsigned long address)
 136                 if (!new_pte_page)
 137                         return NULL;
 138
 139 -               if (pmd_none(*pmd)) {
 140 -                       set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page)));
 141 -                       new_pte_page = 0;
 142 -               }
 143 -               if (new_pte_page)
 144 -                       free_page(new_pte_page);
 145 +               set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page)));
 146         }
 147
 148         pte = pte_offset_kernel(pmd, address);
 149 --
 150 2.14.2
 151