Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-25 05:32:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

x86/mm changes for v6.10:

Browse Source 
- Fix W^X violation check false-positives in the CPA code when running as a Xen PV guest
 
  - Fix W^X violation warning false-positives in show_fault_oops()
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmZBxSYRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1iv2A/+LgwuuXwnryZ7ze5mANoP1bAokK96Yh1N
 YceqcuUTQSVY1iqief1hk8Y0kOQucMfCUU6hfVb6S/t52G5Z6xpRdJ1UJw/EaAhj
 Y/C5cOK6s4PkFo4/NilBbE4nRknPiXcvZW2mfcMUCMAr3L7+VwrTRiQvhr5SW1Td
 +laDdRQcTP2UaodUrps2+TOmAt+fVOSZTpQWtQZhYvvbPKoz7kywfdGS/2V3Hx1C
 7KM2zpetB1BOzpX7ZNpvr06cZBHhymwMaiuU6bqN/yz9MvF3iqU3D/JE4Q6He7YV
 XF4duFNxniDzACxu0xYUV/eYR7vNJrtz37/qH/VCblSlMSb0bOLnpFB5rklmEmfY
 OfrgkiE9fr8ADKNMytdTnI+ZEQzJ8AjO96pNviopWXhr27n2+X2Pe9INaErERuqq
 mlz1TaptM01T+7bcVjB9FUA5Yu3BkDYhblj3FfrUJJDLNR3geRTSJONaW0jgtxBh
 1FPsBbyRYYd0NkpTDiLll/PtHa0Dy+ZHYJ0yXN66hE+fxYfOFJxa/ym1JCDQ8dYl
 SsrTejKSvvRyaZ7iztMkb4FLkC3+NVoZ8ejQZ0R5UC4yeanuBg56EsetFDbrsqmH
 6mOlve3sUK4eQLXQyBlW368WM422n2vIeXBD4VXQh4tghDc+2Yw+c+RHdhUeg058
 t/syPO/xfZY=
 =iVT5
 -----END PGP SIGNATURE-----

Merge tag 'x86-mm-2024-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 mm updates from Ingo Molnar:

 - Fix W^X violation check false-positives in the CPA code
   when running as a Xen PV guest

 - Fix W^X violation warning false-positives in show_fault_oops()

* tag 'x86-mm-2024-05-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/pat: Fix W^X violation false-positives when running as Xen PV guest
  x86/pat: Restructure _lookup_address_cpa()
  x86/mm: Use lookup_address_in_pgd_attr() in show_fault_oops()
  x86/pat: Introduce lookup_address_in_pgd_attr()
This commit is contained in:
Linus Torvalds 2024-05-13 19:02:49 -07:00
commit eabb6297ab
3 changed files with 60 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
arch/x86/include/asm/pgtable_types.h
View File

@ -567,6 +567,8 @@ static inline void update_page_count(int level, unsigned long pages) { }
extern pte_t *lookup_address(unsigned long address, unsigned int *level);
extern pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
unsigned int *level);
pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
unsigned int *level, bool *nx, bool *rw);
extern pmd_t *lookup_pmd_address(unsigned long address);
extern phys_addr_t slow_virt_to_phys(void *__address);
extern int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn,

7
arch/x86/mm/fault.c
View File

@ -514,18 +514,19 @@ show_fault_oops(struct pt_regs *regs, unsigned long error_code, unsigned long ad
if (error_code & X86_PF_INSTR) {
unsigned int level;
bool nx, rw;
pgd_t *pgd;
pte_t *pte;
pgd = __va(read_cr3_pa());
pgd += pgd_index(address);
pte = lookup_address_in_pgd(pgd, address, &level);
pte = lookup_address_in_pgd_attr(pgd, address, &level, &nx, &rw);
if (pte && pte_present(*pte) && !pte_exec(*pte))
if (pte && pte_present(*pte) && (!pte_exec(*pte) || nx))
pr_crit("kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n",
from_kuid(&init_user_ns, current_uid()));
if (pte && pte_present(*pte) && pte_exec(*pte) &&
if (pte && pte_present(*pte) && pte_exec(*pte) && !nx &&
(pgd_flags(*pgd) & _PAGE_USER) &&
(__read_cr4() & X86_CR4_SMEP))
pr_crit("unable to execute userspace code (SMEP?) (uid: %d)\n",

68
arch/x86/mm/pat/set_memory.c
View File

@ -619,7 +619,8 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long start,
* Validate strict W^X semantics.
*/
static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long start,
unsigned long pfn, unsigned long npg)
unsigned long pfn, unsigned long npg,
bool nx, bool rw)
{
unsigned long end;
@ -641,6 +642,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
if ((pgprot_val(new) & (_PAGE_RW | _PAGE_NX)) != _PAGE_RW)
return new;
/* Non-leaf translation entries can disable writing or execution. */
if (!rw || nx)
return new;
end = start + npg * PAGE_SIZE - 1;
WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
(unsigned long long)pgprot_val(old),
@ -657,20 +662,26 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
/*
* Lookup the page table entry for a virtual address in a specific pgd.
* Return a pointer to the entry and the level of the mapping.
* Return a pointer to the entry, the level of the mapping, and the effective
* NX and RW bits of all page table levels.
*/
pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
unsigned int *level)
pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
unsigned int *level, bool *nx, bool *rw)
{
p4d_t *p4d;
pud_t *pud;
pmd_t *pmd;
*level = PG_LEVEL_NONE;
*nx = false;
*rw = true;
if (pgd_none(*pgd))
return NULL;
*nx |= pgd_flags(*pgd) & _PAGE_NX;
*rw &= pgd_flags(*pgd) & _PAGE_RW;
p4d = p4d_offset(pgd, address);
if (p4d_none(*p4d))
return NULL;
@ -679,6 +690,9 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
if (p4d_leaf(*p4d) || !p4d_present(*p4d))
return (pte_t *)p4d;
*nx |= p4d_flags(*p4d) & _PAGE_NX;
*rw &= p4d_flags(*p4d) & _PAGE_RW;
pud = pud_offset(p4d, address);
if (pud_none(*pud))
return NULL;
@ -687,6 +701,9 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
if (pud_leaf(*pud) || !pud_present(*pud))
return (pte_t *)pud;
*nx |= pud_flags(*pud) & _PAGE_NX;
*rw &= pud_flags(*pud) & _PAGE_RW;
pmd = pmd_offset(pud, address);
if (pmd_none(*pmd))
return NULL;
@ -695,11 +712,26 @@ pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
if (pmd_leaf(*pmd) || !pmd_present(*pmd))
return (pte_t *)pmd;
*nx |= pmd_flags(*pmd) & _PAGE_NX;
*rw &= pmd_flags(*pmd) & _PAGE_RW;
*level = PG_LEVEL_4K;
return pte_offset_kernel(pmd, address);
}
/*
* Lookup the page table entry for a virtual address in a specific pgd.
* Return a pointer to the entry and the level of the mapping.
*/
pte_t *lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
unsigned int *level)
{
bool nx, rw;
return lookup_address_in_pgd_attr(pgd, address, level, &nx, &rw);
}
/*
* Lookup the page table entry for a virtual address. Return a pointer
* to the entry and the level of the mapping.
@ -715,13 +747,16 @@ pte_t *lookup_address(unsigned long address, unsigned int *level)
EXPORT_SYMBOL_GPL(lookup_address);
static pte_t *_lookup_address_cpa(struct cpa_data *cpa, unsigned long address,
unsigned int *level)
unsigned int *level, bool *nx, bool *rw)
{
if (cpa->pgd)
return lookup_address_in_pgd(cpa->pgd + pgd_index(address),
address, level);
pgd_t *pgd;
return lookup_address(address, level);
if (!cpa->pgd)
pgd = pgd_offset_k(address);
else
pgd = cpa->pgd + pgd_index(address);
return lookup_address_in_pgd_attr(pgd, address, level, nx, rw);
}
/*
@ -849,12 +884,13 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
pgprot_t old_prot, new_prot, req_prot, chk_prot;
pte_t new_pte, *tmp;
enum pg_level level;
bool nx, rw;
/*
* Check for races, another CPU might have split this page
* up already:
*/
tmp = _lookup_address_cpa(cpa, address, &level);
tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
if (tmp != kpte)
return 1;
@ -965,7 +1001,8 @@ static int __should_split_large_page(pte_t *kpte, unsigned long address,
new_prot = static_protections(req_prot, lpaddr, old_pfn, numpages,
psize, CPA_DETECT);
new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages);
new_prot = verify_rwx(old_prot, new_prot, lpaddr, old_pfn, numpages,
nx, rw);
/*
* If there is a conflict, split the large page.
@ -1046,6 +1083,7 @@ __split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long address,
pte_t *pbase = (pte_t *)page_address(base);
unsigned int i, level;
pgprot_t ref_prot;
bool nx, rw;
pte_t *tmp;
spin_lock(&pgd_lock);
@ -1053,7 +1091,7 @@ __split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long address,
* Check for races, another CPU might have split this page
* up for us already:
*/
tmp = _lookup_address_cpa(cpa, address, &level);
tmp = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
if (tmp != kpte) {
spin_unlock(&pgd_lock);
return 1;
@ -1594,10 +1632,11 @@ static int __change_page_attr(struct cpa_data *cpa, int primary)
int do_split, err;
unsigned int level;
pte_t *kpte, old_pte;
bool nx, rw;
address = __cpa_addr(cpa, cpa->curpage);
repeat:
kpte = _lookup_address_cpa(cpa, address, &level);
kpte = _lookup_address_cpa(cpa, address, &level, &nx, &rw);
if (!kpte)
return __cpa_process_fault(cpa, address, primary);
@ -1619,7 +1658,8 @@ repeat:
new_prot = static_protections(new_prot, address, pfn, 1, 0,
CPA_PROTECT);
new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1);
new_prot = verify_rwx(old_prot, new_prot, address, pfn, 1,
nx, rw);
new_prot = pgprot_clear_protnone_bits(new_prot);