diff mbox series

[CVE-2017-1000405,xenial] mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()

Message ID 20171201211906.12150-1-cascardo@canonical.com
State New
Headers show
Series [CVE-2017-1000405,xenial] mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() | expand

Commit Message

Thadeu Lima de Souza Cascardo Dec. 1, 2017, 9:19 p.m. UTC 
From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>

Currently, we unconditionally make page table dirty in touch_pmd().
It may result in false-positive can_follow_write_pmd().

We may avoid the situation, if we would only make the page table entry
dirty if caller asks for write access -- FOLL_WRITE.

The patch also changes touch_pud() in the same way.

Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
(backported from commit a8f97366452ed491d13cf1e44241bc0b5740b1f0)
[cascardo: dropped touch_pud parts]
[cascardo: fix in-place of where touch_pmd would be called]
CVE-2017-1000405
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
---

Reproducer has been tested. It "exploits" without the patch. With the patch, it
fails.

touch_pmd was introduced later as a helper. Now, we have only one call site as
follow_devmap_pmd was not on xenial or trusty yet. So, fixing it in place is
just as fine.

Cascardo.

---
 mm/huge_memory.c | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

Comments

Stefan Bader Dec. 4, 2017, 10:21 a.m. UTC | #1 
On 01.12.2017 22:19, Thadeu Lima de Souza Cascardo wrote:
> From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
> 
> Currently, we unconditionally make page table dirty in touch_pmd().
> It may result in false-positive can_follow_write_pmd().
> 
> We may avoid the situation, if we would only make the page table entry
> dirty if caller asks for write access -- FOLL_WRITE.
> 
> The patch also changes touch_pud() in the same way.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Hugh Dickins <hughd@google.com>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> (backported from commit a8f97366452ed491d13cf1e44241bc0b5740b1f0)
> [cascardo: dropped touch_pud parts]
> [cascardo: fix in-place of where touch_pmd would be called]
> CVE-2017-1000405
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>

> ---
> 
> Reproducer has been tested. It "exploits" without the patch. With the patch, it
> fails.
> 
> touch_pmd was introduced later as a helper. Now, we have only one call site as
> follow_devmap_pmd was not on xenial or trusty yet. So, fixing it in place is
> just as fine.

Sounds good with explanation. And tested.

-Stefan

> 
> Cascardo.
> 
> ---
>  mm/huge_memory.c | 14 ++++----------
>  1 file changed, 4 insertions(+), 10 deletions(-)
> 
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 6c6f5ccfcda1..8f3769ec8575 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -1304,17 +1304,11 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
>  	VM_BUG_ON_PAGE(!PageHead(page), page);
>  	if (flags & FOLL_TOUCH) {
>  		pmd_t _pmd;
> -		/*
> -		 * We should set the dirty bit only for FOLL_WRITE but
> -		 * for now the dirty bit in the pmd is meaningless.
> -		 * And if the dirty bit will become meaningful and
> -		 * we'll only set it with FOLL_WRITE, an atomic
> -		 * set_bit will be required on the pmd to set the
> -		 * young bit, instead of the current set_pmd_at.
> -		 */
> -		_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
> +		_pmd = pmd_mkyoung(*pmd);
> +		if (flags & FOLL_WRITE)
> +			_pmd = pmd_mkdirty(_pmd);
>  		if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
> -					  pmd, _pmd,  1))
> +					  pmd, _pmd, flags & FOLL_WRITE))
>  			update_mmu_cache_pmd(vma, addr, pmd);
>  	}
>  	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
>
Colin Ian King Dec. 4, 2017, 10:34 a.m. UTC | #2 
On 01/12/17 21:19, Thadeu Lima de Souza Cascardo wrote:
> From: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
> 
> Currently, we unconditionally make page table dirty in touch_pmd().
> It may result in false-positive can_follow_write_pmd().
> 
> We may avoid the situation, if we would only make the page table entry
> dirty if caller asks for write access -- FOLL_WRITE.
> 
> The patch also changes touch_pud() in the same way.
> 
> Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> Cc: Michal Hocko <mhocko@suse.com>
> Cc: Hugh Dickins <hughd@google.com>
> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
> (backported from commit a8f97366452ed491d13cf1e44241bc0b5740b1f0)
> [cascardo: dropped touch_pud parts]
> [cascardo: fix in-place of where touch_pmd would be called]
> CVE-2017-1000405
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> ---
> 
> Reproducer has been tested. It "exploits" without the patch. With the patch, it
> fails.
> 
> touch_pmd was introduced later as a helper. Now, we have only one call site as
> follow_devmap_pmd was not on xenial or trusty yet. So, fixing it in place is
> just as fine.
> 
> Cascardo.
> 
> ---
>  mm/huge_memory.c | 14 ++++----------
>  1 file changed, 4 insertions(+), 10 deletions(-)
> 
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index 6c6f5ccfcda1..8f3769ec8575 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -1304,17 +1304,11 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
>  	VM_BUG_ON_PAGE(!PageHead(page), page);
>  	if (flags & FOLL_TOUCH) {
>  		pmd_t _pmd;
> -		/*
> -		 * We should set the dirty bit only for FOLL_WRITE but
> -		 * for now the dirty bit in the pmd is meaningless.
> -		 * And if the dirty bit will become meaningful and
> -		 * we'll only set it with FOLL_WRITE, an atomic
> -		 * set_bit will be required on the pmd to set the
> -		 * young bit, instead of the current set_pmd_at.
> -		 */
> -		_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
> +		_pmd = pmd_mkyoung(*pmd);
> +		if (flags & FOLL_WRITE)
> +			_pmd = pmd_mkdirty(_pmd);
>  		if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
> -					  pmd, _pmd,  1))
> +					  pmd, _pmd, flags & FOLL_WRITE))
>  			update_mmu_cache_pmd(vma, addr, pmd);
>  	}
>  	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
> 
Backport looks OK, there is no pud handling for THP in this older
kernel. Positive test results.

Acked-by: Colin Ian King <colin.king@canonical.com>
Thadeu Lima de Souza Cascardo Dec. 4, 2017, 10:48 a.m. UTC | #3 
Applied to xenial master-next branch.

Thanks.
Cascardo.

Applied-to: xenial/master-next
diff mbox series

Patch

diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 6c6f5ccfcda1..8f3769ec8575 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1304,17 +1304,11 @@  struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
 	VM_BUG_ON_PAGE(!PageHead(page), page);
 	if (flags & FOLL_TOUCH) {
 		pmd_t _pmd;
-		/*
-		 * We should set the dirty bit only for FOLL_WRITE but
-		 * for now the dirty bit in the pmd is meaningless.
-		 * And if the dirty bit will become meaningful and
-		 * we'll only set it with FOLL_WRITE, an atomic
-		 * set_bit will be required on the pmd to set the
-		 * young bit, instead of the current set_pmd_at.
-		 */
-		_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
+		_pmd = pmd_mkyoung(*pmd);
+		if (flags & FOLL_WRITE)
+			_pmd = pmd_mkdirty(_pmd);
 		if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
-					  pmd, _pmd,  1))
+					  pmd, _pmd, flags & FOLL_WRITE))
 			update_mmu_cache_pmd(vma, addr, pmd);
 	}
 	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {