Commit 316d097c authored by Dave Hansen's avatar Dave Hansen Committed by Thomas Gleixner
Browse files

x86/pti: Filter at vma->vm_page_prot population 



commit ce9962bf7e22bb3891655c349faff618922d4a73

0day reported warnings at boot on 32-bit systems without NX support:

attempted to set unsupported pgprot: 8000000000000025 bits: 8000000000000000 supported: 7fffffffffffffff
WARNING: CPU: 0 PID: 1 at
arch/x86/include/asm/pgtable.h:540 handle_mm_fault+0xfc1/0xfe0:
 check_pgprot at arch/x86/include/asm/pgtable.h:535
 (inlined by) pfn_pte at arch/x86/include/asm/pgtable.h:549
 (inlined by) do_anonymous_page at mm/memory.c:3169
 (inlined by) handle_pte_fault at mm/memory.c:3961
 (inlined by) __handle_mm_fault at mm/memory.c:4087
 (inlined by) handle_mm_fault at mm/memory.c:4124

The problem is that due to the recent commit which removed auto-massaging
of page protections, filtering page permissions at PTE creation time is not
longer done, so vma->vm_page_prot is passed unfiltered to PTE creation.

Filter the page protections before they are installed in vma->vm_page_prot.

Fixes: fb43d6cb ("x86/mm: Do not auto-massage page protections")
Reported-by: default avatarFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Acked-by: default avatarIngo Molnar <mingo@kernel.org>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Juergen Gross <jgross@suse.com>
Cc: Kees Cook <keescook@google.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Hugh Dickins <hughd@google.com>
Cc: linux-mm@kvack.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Nadav Amit <namit@vmware.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Arjan van de Ven <arjan@linux.intel.com>
Link: https://lkml.kernel.org/r/20180420222028.99D72858@viggo.jf.intel.com
parent b7c21bc5

arch/x86/Kconfig

+4 −0
Original line number Original line Diff line number Diff line
@@ -52,6 +52,7 @@ config X86 
	select ARCH_HAS_DEVMEM_IS_ALLOWED

	select ARCH_HAS_DEVMEM_IS_ALLOWED

	select ARCH_HAS_ELF_RANDOMIZE

	select ARCH_HAS_ELF_RANDOMIZE

	select ARCH_HAS_FAST_MULTIPLIER

	select ARCH_HAS_FAST_MULTIPLIER

	select ARCH_HAS_FILTER_PGPROT

	select ARCH_HAS_FORTIFY_SOURCE

	select ARCH_HAS_FORTIFY_SOURCE

	select ARCH_HAS_GCOV_PROFILE_ALL

	select ARCH_HAS_GCOV_PROFILE_ALL

	select ARCH_HAS_KCOV			if X86_64

	select ARCH_HAS_KCOV			if X86_64
@@ -273,6 +274,9 @@ config ARCH_HAS_CPU_RELAX 
config ARCH_HAS_CACHE_LINE_SIZE

config ARCH_HAS_CACHE_LINE_SIZE

	def_bool y

	def_bool y





config ARCH_HAS_FILTER_PGPROT

	def_bool y



config HAVE_SETUP_PER_CPU_AREA

config HAVE_SETUP_PER_CPU_AREA

	def_bool y

	def_bool y

arch/x86/include/asm/pgtable.h

+5 −0
Original line number Original line Diff line number Diff line
@@ -601,6 +601,11 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot) 




#define canon_pgprot(p) __pgprot(massage_pgprot(p))

#define canon_pgprot(p) __pgprot(massage_pgprot(p))





static inline pgprot_t arch_filter_pgprot(pgprot_t prot)

{

	return canon_pgprot(prot);

}



static inline int is_new_memtype_allowed(u64 paddr, unsigned long size,

static inline int is_new_memtype_allowed(u64 paddr, unsigned long size,

					 enum page_cache_mode pcm,

					 enum page_cache_mode pcm,

					 enum page_cache_mode new_pcm)

					 enum page_cache_mode new_pcm)

mm/mmap.c

+10 −1
Original line number Original line Diff line number Diff line
@@ -100,11 +100,20 @@ pgprot_t protection_map[16] __ro_after_init = { 
	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111

	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111

};

};





#ifndef CONFIG_ARCH_HAS_FILTER_PGPROT

static inline pgprot_t arch_filter_pgprot(pgprot_t prot)

{

	return prot;

}

#endif



pgprot_t vm_get_page_prot(unsigned long vm_flags)

pgprot_t vm_get_page_prot(unsigned long vm_flags)

{

{

	return __pgprot(pgprot_val(protection_map[vm_flags &

	pgprot_t ret = __pgprot(pgprot_val(protection_map[vm_flags &

				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |

				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |

			pgprot_val(arch_vm_get_page_prot(vm_flags)));

			pgprot_val(arch_vm_get_page_prot(vm_flags)));



	return arch_filter_pgprot(ret);

}

}

EXPORT_SYMBOL(vm_get_page_prot);

EXPORT_SYMBOL(vm_get_page_prot);

CRA Git | Maintained and supported by SUSTech CRA and CCSE