2020-01-14 08:14:19

by Christophe Leroy

Subject: [PATCH] powerpc/ptdump: fix W+X verification

Verification cannot rely on simple bit checking because on some
platforms PAGE_RW is 0, checking that a page is not W means
checking that PAGE_RO is set instead of checking that PAGE_RW
is not set.

Use pte helpers instead of checking bits.

Signed-off-by: Christophe Leroy <[email protected]>
Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot")
---
arch/powerpc/mm/ptdump/ptdump.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/powerpc/mm/ptdump/ptdump.c b/arch/powerpc/mm/ptdump/ptdump.c
index 4af0d5d9589e..206156255247 100644
--- a/arch/powerpc/mm/ptdump/ptdump.c
+++ b/arch/powerpc/mm/ptdump/ptdump.c
@@ -175,10 +175,12 @@ static void dump_addr(struct pg_state *st, unsigned long addr)

static void note_prot_wx(struct pg_state *st, unsigned long addr)
{
+ pte_t pte = __pte(st->current_flags);
+
if (!IS_ENABLED(CONFIG_PPC_DEBUG_WX) || !st->check_wx)
return;

- if (!((st->current_flags & pgprot_val(PAGE_KERNEL_X)) == pgprot_val(PAGE_KERNEL_X)))
+ if (!pte_write(pte) || !pte_exec(pte))
return;

WARN_ONCE(1, "powerpc/mm: Found insecure W+X mapping at address %p/%pS\n",
--
2.13.3

2020-01-29 05:18:53

by Michael Ellerman

Subject: Re: [PATCH] powerpc/ptdump: fix W+X verification

On Tue, 2020-01-14 at 08:13:09 UTC, Christophe Leroy wrote:
> Verification cannot rely on simple bit checking because on some
> platforms PAGE_RW is 0, checking that a page is not W means
> checking that PAGE_RO is set instead of checking that PAGE_RW
> is not set.
>
> Use pte helpers instead of checking bits.
>
> Signed-off-by: Christophe Leroy <[email protected]>
> Fixes: 453d87f6a8ae ("powerpc/mm: Warn if W+X pages found on boot")

Applied to powerpc next, thanks.

https://git.kernel.org/powerpc/c/d80ae83f1f932ab7af47b54d0d3bef4f4dba489f

cheers