Received: by 10.213.65.68 with SMTP id h4csp1069041imn; Fri, 6 Apr 2018 14:02:53 -0700 (PDT) X-Google-Smtp-Source: AIpwx4/yMxkSB3cQZF1kv3Ts5qWc0mUVd41DWDe41a0Cul4ZT2WhmhSHE53fEITmzPDS0sXmEGvl X-Received: by 2002:a17:902:4003:: with SMTP id b3-v6mr29711338pld.15.1523048573160; Fri, 06 Apr 2018 14:02:53 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1523048573; cv=none; d=google.com; s=arc-20160816; b=l3mIpr1wjMo8ealiSITcYYdNeI6Rf1P4kLesUe4soCEE4crkzhJiMs5kOnyIMxImAB 9+To9ZL5qt1ZM3ohaDyHZdnPNz69y1UMmo2FgCgMXI3NijE2zfb/6Be15iCTKpnZNcyX xSlFO5MWujUPZZMMR6w0R8AkgIRSM6JJ6sxdYSbO6qYy2HvjOgVOsWNSsg39syllsFSG emWZGiJIGsPfdG+WRVqI/XfZ30yHUGh1I43cT/exY9Uf2uENge6pBLzRYP0reMtLNrqb WxSw1V8XyuRA02AGTlR1Y6SM/u7Wc7IeAVbRFaHHa9ukjeiiwg44vnYDyrmUtwhbzaBj zQhQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:in-reply-to:references:date :from:cc:to:subject:arc-authentication-results; bh=8urkKNCq/UnLoUm07p/OE2MoAs4cjS48srEn2JsCKLk=; b=T+mHsVxlvmxQ1YuI4R7a/hyMnfP8R+5jneibcPAvtWpjREdX0mWJeAn5DxXHojk+Xz FOfsVu9aVRLgTlhMkOFGkaDqr/inUVkwfIzR7b/FA0Gi/Yv19jhp2NwNsWyYJ1qH3tP8 Wqxo0L5RYIGWdy5XJkli4QcMbbucedtPH86ZFj6SUkqaawSliTQjDmdulOtEDshTal6C TaR+RlwASdnTFxpQlC79cypItnHJ0V1GdqCd4EDuYFrxH/6c7t8PA/2FFGJ/GIDx9BjC y4TqJz5W16vTPGyW5wM9miyOsCIQAjRebTxQUgCmV3DXLrxvi8rxUE9ovbeZiUy85sYU uHYg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id bh7-v6si9334863plb.711.2018.04.06.14.02.15; Fri, 06 Apr 2018 14:02:53 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752246AbeDFU6N (ORCPT + 99 others); Fri, 6 Apr 2018 16:58:13 -0400 Received: from mga01.intel.com ([192.55.52.88]:21561 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752012AbeDFU6H (ORCPT ); Fri, 6 Apr 2018 16:58:07 -0400 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga005.fm.intel.com ([10.253.24.32]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 06 Apr 2018 13:58:06 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.48,416,1517904000"; d="scan'208";a="218294619" Received: from viggo.jf.intel.com (HELO localhost.localdomain) ([10.54.39.119]) by fmsmga005.fm.intel.com with ESMTP; 06 Apr 2018 13:58:06 -0700 Subject: [PATCH 05/11] x86/mm: do not auto-massage page protections To: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org, Dave Hansen , aarcange@redhat.com, luto@kernel.org, torvalds@linux-foundation.org, keescook@google.com, hughd@google.com, jgross@suse.com, x86@kernel.org, namit@vmware.com From: Dave Hansen Date: Fri, 06 Apr 2018 13:55:09 -0700 References: <20180406205501.24A1A4E7@viggo.jf.intel.com> In-Reply-To: <20180406205501.24A1A4E7@viggo.jf.intel.com> Message-Id: <20180406205509.77E1D7F6@viggo.jf.intel.com> Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dave Hansen A PTE is constructed from a physical address and a pgprotval_t. __PAGE_KERNEL, for instance, is a pgprot_t and must be converted into a pgprotval_t before it can be used to create a PTE. This is done implicitly within functions like pfn_pte() by massage_pgprot(). However, this makes it very challenging to set bits (and keep them set) if your bit is being filtered out by massage_pgprot(). This moves the bit filtering out of pfn_pte() and friends. For users of PAGE_KERNEL*, filtering will be done automatically inside those macros but for users of __PAGE_KERNEL*, they need to do their own filtering now. Note that we also just move pfn_pte/pmd/pud() over to check_pgprot() instead of massage_pgprot(). This way, we still *look* for unsupported bits and properly warn about them if we find them. This might happen if an unfiltered __PAGE_KERNEL* value was passed in, for instance. Signed-off-by: Dave Hansen Cc: Andrea Arcangeli Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Kees Cook Cc: Hugh Dickins Cc: Juergen Gross Cc: x86@kernel.org Cc: Nadav Amit --- b/arch/x86/boot/compressed/kaslr.c | 3 +++ b/arch/x86/include/asm/pgtable.h | 27 ++++++++++++++++++++++----- b/arch/x86/kernel/head64.c | 2 ++ b/arch/x86/kernel/ldt.c | 6 +++++- b/arch/x86/mm/ident_map.c | 3 +++ b/arch/x86/mm/iomap_32.c | 6 ++++++ b/arch/x86/mm/ioremap.c | 3 +++ b/arch/x86/mm/kasan_init_64.c | 14 +++++++++++++- b/arch/x86/mm/pgtable.c | 3 +++ b/arch/x86/power/hibernate_64.c | 20 +++++++++++++++----- 10 files changed, 75 insertions(+), 12 deletions(-) diff -puN arch/x86/boot/compressed/kaslr.c~x86-no-auto-massage arch/x86/boot/compressed/kaslr.c --- a/arch/x86/boot/compressed/kaslr.c~x86-no-auto-massage 2018-04-06 10:47:55.879796124 -0700 +++ b/arch/x86/boot/compressed/kaslr.c 2018-04-06 10:47:55.902796124 -0700 @@ -54,6 +54,9 @@ unsigned int ptrs_per_p4d __ro_after_ini extern unsigned long get_cmd_line_ptr(void); +/* Used by PAGE_KERN* macros: */ +pteval_t __default_kernel_pte_mask __read_mostly; + /* Simplified build-specific string for starting entropy. */ static const char build_str[] = UTS_RELEASE " (" LINUX_COMPILE_BY "@" LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION; diff -puN arch/x86/include/asm/pgtable.h~x86-no-auto-massage arch/x86/include/asm/pgtable.h --- a/arch/x86/include/asm/pgtable.h~x86-no-auto-massage 2018-04-06 10:47:55.881796124 -0700 +++ b/arch/x86/include/asm/pgtable.h 2018-04-06 10:47:55.900796124 -0700 @@ -526,22 +526,39 @@ static inline pgprotval_t massage_pgprot return protval; } +static inline pgprotval_t check_pgprot(pgprot_t pgprot) +{ + pgprotval_t massaged_val = massage_pgprot(pgprot); + + /* mmdebug.h can not be included here because of dependencies */ +#ifdef CONFIG_DEBUG_VM + WARN_ONCE(pgprot_val(pgprot) != massaged_val, + "attempted to set unsupported pgprot: %016lx " + "bits: %016lx supported: %016lx\n", + pgprot_val(pgprot), + pgprot_val(pgprot) ^ massaged_val, + __supported_pte_mask); +#endif + + return massaged_val; +} + static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot) { return __pte(((phys_addr_t)page_nr << PAGE_SHIFT) | - massage_pgprot(pgprot)); + check_pgprot(pgprot)); } static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot) { return __pmd(((phys_addr_t)page_nr << PAGE_SHIFT) | - massage_pgprot(pgprot)); + check_pgprot(pgprot)); } static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot) { return __pud(((phys_addr_t)page_nr << PAGE_SHIFT) | - massage_pgprot(pgprot)); + check_pgprot(pgprot)); } static inline pte_t pte_modify(pte_t pte, pgprot_t newprot) @@ -553,7 +570,7 @@ static inline pte_t pte_modify(pte_t pte * the newprot (if present): */ val &= _PAGE_CHG_MASK; - val |= massage_pgprot(newprot) & ~_PAGE_CHG_MASK; + val |= check_pgprot(newprot) & ~_PAGE_CHG_MASK; return __pte(val); } @@ -563,7 +580,7 @@ static inline pmd_t pmd_modify(pmd_t pmd pmdval_t val = pmd_val(pmd); val &= _HPAGE_CHG_MASK; - val |= massage_pgprot(newprot) & ~_HPAGE_CHG_MASK; + val |= check_pgprot(newprot) & ~_HPAGE_CHG_MASK; return __pmd(val); } diff -puN arch/x86/kernel/head64.c~x86-no-auto-massage arch/x86/kernel/head64.c --- a/arch/x86/kernel/head64.c~x86-no-auto-massage 2018-04-06 10:47:55.883796124 -0700 +++ b/arch/x86/kernel/head64.c 2018-04-06 10:47:55.900796124 -0700 @@ -195,6 +195,8 @@ unsigned long __head __startup_64(unsign pud[i + 1] = (pudval_t)pmd + pgtable_flags; pmd_entry = __PAGE_KERNEL_LARGE_EXEC & ~_PAGE_GLOBAL; + /* Filter out unsupported __PAGE_KERNEL_* bits: */ + pmd_entry &= __supported_pte_mask; pmd_entry += sme_get_me_mask(); pmd_entry += physaddr; diff -puN arch/x86/kernel/ldt.c~x86-no-auto-massage arch/x86/kernel/ldt.c --- a/arch/x86/kernel/ldt.c~x86-no-auto-massage 2018-04-06 10:47:55.885796124 -0700 +++ b/arch/x86/kernel/ldt.c 2018-04-06 10:47:55.900796124 -0700 @@ -145,6 +145,7 @@ map_ldt_struct(struct mm_struct *mm, str unsigned long offset = i << PAGE_SHIFT; const void *src = (char *)ldt->entries + offset; unsigned long pfn; + pgprot_t pte_prot; pte_t pte, *ptep; va = (unsigned long)ldt_slot_va(slot) + offset; @@ -163,7 +164,10 @@ map_ldt_struct(struct mm_struct *mm, str * target via some kernel interface which misses a * permission check. */ - pte = pfn_pte(pfn, __pgprot(__PAGE_KERNEL_RO & ~_PAGE_GLOBAL)); + pte_prot = __pgprot(__PAGE_KERNEL_RO & ~_PAGE_GLOBAL); + /* Filter out unsuppored __PAGE_KERNEL* bits: */ + pgprot_val(pte_prot) |= __supported_pte_mask; + pte = pfn_pte(pfn, pte_prot); set_pte_at(mm, va, ptep, pte); pte_unmap_unlock(ptep, ptl); } diff -puN arch/x86/mm/ident_map.c~x86-no-auto-massage arch/x86/mm/ident_map.c --- a/arch/x86/mm/ident_map.c~x86-no-auto-massage 2018-04-06 10:47:55.887796124 -0700 +++ b/arch/x86/mm/ident_map.c 2018-04-06 10:47:55.901796124 -0700 @@ -98,6 +98,9 @@ int kernel_ident_mapping_init(struct x86 if (!info->kernpg_flag) info->kernpg_flag = _KERNPG_TABLE; + /* Filter out unsupported __PAGE_KERNEL_* bits: */ + info->kernpg_flag &= __default_kernel_pte_mask; + for (; addr < end; addr = next) { pgd_t *pgd = pgd_page + pgd_index(addr); p4d_t *p4d; diff -puN arch/x86/mm/iomap_32.c~x86-no-auto-massage arch/x86/mm/iomap_32.c --- a/arch/x86/mm/iomap_32.c~x86-no-auto-massage 2018-04-06 10:47:55.888796124 -0700 +++ b/arch/x86/mm/iomap_32.c 2018-04-06 10:47:55.901796124 -0700 @@ -44,6 +44,9 @@ int iomap_create_wc(resource_size_t base return ret; *prot = __pgprot(__PAGE_KERNEL | cachemode2protval(pcm)); + /* Filter out unsupported __PAGE_KERNEL* bits: */ + pgprot_val(*prot) &= __default_kernel_pte_mask; + return 0; } EXPORT_SYMBOL_GPL(iomap_create_wc); @@ -88,6 +91,9 @@ iomap_atomic_prot_pfn(unsigned long pfn, prot = __pgprot(__PAGE_KERNEL | cachemode2protval(_PAGE_CACHE_MODE_UC_MINUS)); + /* Filter out unsupported __PAGE_KERNEL* bits: */ + pgprot_val(prot) &= __default_kernel_pte_mask; + return (void __force __iomem *) kmap_atomic_prot_pfn(pfn, prot); } EXPORT_SYMBOL_GPL(iomap_atomic_prot_pfn); diff -puN arch/x86/mm/ioremap.c~x86-no-auto-massage arch/x86/mm/ioremap.c --- a/arch/x86/mm/ioremap.c~x86-no-auto-massage 2018-04-06 10:47:55.890796124 -0700 +++ b/arch/x86/mm/ioremap.c 2018-04-06 10:47:55.901796124 -0700 @@ -816,6 +816,9 @@ void __init __early_set_fixmap(enum fixe } pte = early_ioremap_pte(addr); + /* Sanitize 'prot' against any unsupported bits: */ + pgprot_val(flags) &= __default_kernel_pte_mask; + if (pgprot_val(flags)) set_pte(pte, pfn_pte(phys >> PAGE_SHIFT, flags)); else diff -puN arch/x86/mm/kasan_init_64.c~x86-no-auto-massage arch/x86/mm/kasan_init_64.c --- a/arch/x86/mm/kasan_init_64.c~x86-no-auto-massage 2018-04-06 10:47:55.892796124 -0700 +++ b/arch/x86/mm/kasan_init_64.c 2018-04-06 10:47:55.901796124 -0700 @@ -269,6 +269,12 @@ void __init kasan_early_init(void) pudval_t pud_val = __pa_nodebug(kasan_zero_pmd) | _KERNPG_TABLE; p4dval_t p4d_val = __pa_nodebug(kasan_zero_pud) | _KERNPG_TABLE; + /* Mask out unsupported __PAGE_KERNEL bits: */ + pte_val &= __default_kernel_pte_mask; + pmd_val &= __default_kernel_pte_mask; + pud_val &= __default_kernel_pte_mask; + p4d_val &= __default_kernel_pte_mask; + for (i = 0; i < PTRS_PER_PTE; i++) kasan_zero_pte[i] = __pte(pte_val); @@ -371,7 +377,13 @@ void __init kasan_init(void) */ memset(kasan_zero_page, 0, PAGE_SIZE); for (i = 0; i < PTRS_PER_PTE; i++) { - pte_t pte = __pte(__pa(kasan_zero_page) | __PAGE_KERNEL_RO | _PAGE_ENC); + pte_t pte; + pgprot_t prot; + + prot = __pgprot(__PAGE_KERNEL_RO | _PAGE_ENC); + pgprot_val(prot) &= __default_kernel_pte_mask; + + pte = __pte(__pa(kasan_zero_page) | pgprot_val(prot)); set_pte(&kasan_zero_pte[i], pte); } /* Flush TLBs again to be sure that write protection applied. */ diff -puN arch/x86/mm/pgtable.c~x86-no-auto-massage arch/x86/mm/pgtable.c --- a/arch/x86/mm/pgtable.c~x86-no-auto-massage 2018-04-06 10:47:55.894796124 -0700 +++ b/arch/x86/mm/pgtable.c 2018-04-06 10:47:55.902796124 -0700 @@ -583,6 +583,9 @@ void __native_set_fixmap(enum fixed_addr void native_set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t flags) { + /* Sanitize 'prot' against any unsupported bits: */ + pgprot_val(flags) &= __default_kernel_pte_mask; + __native_set_fixmap(idx, pfn_pte(phys >> PAGE_SHIFT, flags)); } diff -puN arch/x86/power/hibernate_64.c~x86-no-auto-massage arch/x86/power/hibernate_64.c --- a/arch/x86/power/hibernate_64.c~x86-no-auto-massage 2018-04-06 10:47:55.896796124 -0700 +++ b/arch/x86/power/hibernate_64.c 2018-04-06 10:47:55.902796124 -0700 @@ -51,6 +51,12 @@ static int set_up_temporary_text_mapping pmd_t *pmd; pud_t *pud; p4d_t *p4d = NULL; + pgprot_t pgtable_prot = __pgprot(_KERNPG_TABLE); + pgprot_t pmd_text_prot = __pgprot(__PAGE_KERNEL_LARGE_EXEC); + + /* Filter out unsupported __PAGE_KERNEL* bits: */ + pgprot_val(pmd_text_prot) &= __default_kernel_pte_mask; + pgprot_val(pgtable_prot) &= __default_kernel_pte_mask; /* * The new mapping only has to cover the page containing the image @@ -81,15 +87,19 @@ static int set_up_temporary_text_mapping return -ENOMEM; set_pmd(pmd + pmd_index(restore_jump_address), - __pmd((jump_address_phys & PMD_MASK) | __PAGE_KERNEL_LARGE_EXEC)); + __pmd((jump_address_phys & PMD_MASK) | pgprot_val(pmd_text_prot))); set_pud(pud + pud_index(restore_jump_address), - __pud(__pa(pmd) | _KERNPG_TABLE)); + __pud(__pa(pmd) | pgprot_val(pgtable_prot))); if (p4d) { - set_p4d(p4d + p4d_index(restore_jump_address), __p4d(__pa(pud) | _KERNPG_TABLE)); - set_pgd(pgd + pgd_index(restore_jump_address), __pgd(__pa(p4d) | _KERNPG_TABLE)); + p4d_t new_p4d = __p4d(__pa(pud) | pgprot_val(pgtable_prot)); + pgd_t new_pgd = __pgd(__pa(p4d) | pgprot_val(pgtable_prot)); + + set_p4d(p4d + p4d_index(restore_jump_address), new_p4d); + set_pgd(pgd + pgd_index(restore_jump_address), new_pgd); } else { /* No p4d for 4-level paging: point the pgd to the pud page table */ - set_pgd(pgd + pgd_index(restore_jump_address), __pgd(__pa(pud) | _KERNPG_TABLE)); + pgd_t new_pgd = __pgd(__pa(p4d) | pgprot_val(pgtable_prot)); + set_pgd(pgd + pgd_index(restore_jump_address), new_pgd); } return 0; _