Commit 2cd4bd19 authored by Ram Pai's avatar Ram Pai Committed by Michael Ellerman
Browse files

powerpc/pkeys: Fix handling of pkey state across fork() 



Protection key tracking information is not copied over to the
mm_struct of the child during fork(). This can cause the child to
erroneously allocate keys that were already allocated. Any allocated
execute-only key is lost aswell.

Add code; called by dup_mmap(), to copy the pkey state from parent to
child explicitly.

This problem was originally found by Dave Hansen on x86, which turns
out to be a problem on powerpc aswell.

Fixes: cf43d3b2 ("powerpc: Enable pkey subsystem")
Cc: stable@vger.kernel.org # v4.16+
Reviewed-by: default avatarThiago Jung Bauermann <bauerman@linux.ibm.com>
Signed-off-by: default avatarRam Pai <linuxram@us.ibm.com>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent 2f07229f

arch/powerpc/include/asm/mmu_context.h

+9 −6
Original line number Original line Diff line number Diff line
@@ -217,12 +217,6 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, 
#endif

#endif

}

}





static inline int arch_dup_mmap(struct mm_struct *oldmm,

				struct mm_struct *mm)

{

	return 0;

}



#ifdef CONFIG_PPC_BOOK3E_64

#ifdef CONFIG_PPC_BOOK3E_64

static inline void arch_exit_mmap(struct mm_struct *mm)

static inline void arch_exit_mmap(struct mm_struct *mm)

{

{
@@ -247,6 +241,7 @@ static inline void arch_bprm_mm_init(struct mm_struct *mm, 
#ifdef CONFIG_PPC_MEM_KEYS

#ifdef CONFIG_PPC_MEM_KEYS

bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,

bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write,

			       bool execute, bool foreign);

			       bool execute, bool foreign);

void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm);

#else /* CONFIG_PPC_MEM_KEYS */

#else /* CONFIG_PPC_MEM_KEYS */

static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,

static inline bool arch_vma_access_permitted(struct vm_area_struct *vma,

		bool write, bool execute, bool foreign)

		bool write, bool execute, bool foreign)
@@ -259,6 +254,7 @@ static inline bool arch_vma_access_permitted(struct vm_area_struct *vma, 
#define thread_pkey_regs_save(thread)

#define thread_pkey_regs_save(thread)

#define thread_pkey_regs_restore(new_thread, old_thread)

#define thread_pkey_regs_restore(new_thread, old_thread)

#define thread_pkey_regs_init(thread)

#define thread_pkey_regs_init(thread)

#define arch_dup_pkeys(oldmm, mm)





static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)

static inline u64 pte_to_hpte_pkey_bits(u64 pteflags)

{

{
@@ -267,5 +263,12 @@ static inline u64 pte_to_hpte_pkey_bits(u64 pteflags) 




#endif /* CONFIG_PPC_MEM_KEYS */

#endif /* CONFIG_PPC_MEM_KEYS */





static inline int arch_dup_mmap(struct mm_struct *oldmm,

				struct mm_struct *mm)

{

	arch_dup_pkeys(oldmm, mm);

	return 0;

}



#endif /* __KERNEL__ */

#endif /* __KERNEL__ */

#endif /* __ASM_POWERPC_MMU_CONTEXT_H */
 
#endif /* __ASM_POWERPC_MMU_CONTEXT_H */

arch/powerpc/mm/pkeys.c

+10 −0
Original line number Original line Diff line number Diff line
@@ -415,3 +415,13 @@ bool arch_vma_access_permitted(struct vm_area_struct *vma, bool write, 




	return pkey_access_permitted(vma_pkey(vma), write, execute);

	return pkey_access_permitted(vma_pkey(vma), write, execute);

}

}



void arch_dup_pkeys(struct mm_struct *oldmm, struct mm_struct *mm)

{

	if (static_branch_likely(&pkey_disabled))

		return;



	/* Duplicate the oldmm pkey state in mm: */

	mm_pkey_allocation_map(mm) = mm_pkey_allocation_map(oldmm);

	mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE