linuxppc-dev.lists.ozlabs.org archive mirror
 help / color / mirror / Atom feed
From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
To: linuxppc-dev@lists.ozlabs.org
Cc: aneesh.kumar@linux.vnet.ibm.com,
	Benjamin Herrenschmidt <benh@kernel.crashing.org>
Subject: [PATCH 12/24] powerpc/mm: Fix reporting of kernel execute faults
Date: Wed, 19 Jul 2017 14:49:34 +1000	[thread overview]
Message-ID: <20170719044946.22030-12-benh@kernel.crashing.org> (raw)
In-Reply-To: <20170719044946.22030-1-benh@kernel.crashing.org>

We currently test for is_exec and DSISR_PROTFAULT but that doesn't
make sense as this is the wrong error bit to test for an execute
permission failure.

In fact, we had code that would return early if we had an exec
fault in kernel mode so I think that was just dead code anyway.

Finally the location of that test is awkward and prevents further
simplifications.

So instead move that test into a helper along with the existing
early test for kernel exec faults and out of range accesses,
and put it all in a "bad_kernel_fault()" helper. While at it
test the correct error bits.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
 arch/powerpc/mm/fault.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index e8d6acc888c5..aead07cf8a5b 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -180,6 +180,20 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr, int fault)
 	return MM_FAULT_CONTINUE;
 }
 
+/* Is this a bad kernel fault ? */
+static bool bad_kernel_fault(bool is_exec, unsigned long error_code,
+			     unsigned long address)
+{
+	if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT))) {
+		printk_ratelimited(KERN_CRIT "kernel tried to execute"
+				   " exec-protected page (%lx) -"
+				   "exploit attempt? (uid: %d)\n",
+				   address, from_kuid(&init_user_ns,
+						      current_uid()));
+	}
+	return is_exec || (address >= TASK_SIZE);
+}
+
 /*
  * Define the correct "is_write" bit in error_code based
  * on the processor family
@@ -252,7 +266,7 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address,
 	 * The kernel should never take an execute fault nor should it
 	 * take a page fault to a kernel address.
 	 */
-	if (!is_user && (is_exec || (address >= TASK_SIZE)))
+	if (unlikely(!is_user && bad_kernel_fault(is_exec, error_code, address)))
 		return SIGSEGV;
 
 	/* We restore the interrupt state now */
@@ -491,11 +505,6 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address,
 		return 0;
 	}
 
-	if (is_exec && (error_code & DSISR_PROTFAULT))
-		printk_ratelimited(KERN_CRIT "kernel tried to execute NX-protected"
-				   " page (%lx) - exploit attempt? (uid: %d)\n",
-				   address, from_kuid(&init_user_ns, current_uid()));
-
 	return SIGSEGV;
 }
 NOKPROBE_SYMBOL(__do_page_fault);
-- 
2.13.3

  parent reply	other threads:[~2017-07-19  4:58 UTC|newest]

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-07-19  4:49 [PATCH 01/24] powerpc/mm: Move exception_enter/exit to a do_page_fault wrapper Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 02/24] powerpc/mm: Pre-filter SRR1 bits before do_page_fault() Benjamin Herrenschmidt
2017-07-22 16:43   ` LEROY Christophe
2017-07-23  1:10     ` Benjamin Herrenschmidt
2017-07-24 13:48     ` Michael Ellerman
2017-07-19  4:49 ` [PATCH 03/24] powerpc/6xx: Handle DABR match before calling do_page_fault Benjamin Herrenschmidt
2017-08-03  0:19   ` Michael Ellerman
2017-08-03  1:00     ` Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 04/24] powerpc/mm: Update definitions of DSISR bits Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 05/24] powerpc/mm: Update bits used to skip hash_page Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 06/24] powerpc/mm: Use symbolic constants for filtering SRR1 bits on ISIs Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 07/24] powerpc/mm: Move out definition of CPU specific is_write bits Benjamin Herrenschmidt
2017-07-22 16:40   ` LEROY Christophe
2017-07-23  1:06     ` Benjamin Herrenschmidt
2017-07-24 11:58     ` Michael Ellerman
2017-07-19  4:49 ` [PATCH 08/24] powerpc/mm: Move error_code checks for bad faults earlier Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 09/24] powerpc/mm: Overhaul handling of bad page faults Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 10/24] powerpc/mm: Move debugger check to notify_page_fault() Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 11/24] powerpc/mm: Simplify returns from __do_page_fault Benjamin Herrenschmidt
2017-07-19  4:49 ` Benjamin Herrenschmidt [this message]
2018-11-07  8:35   ` [PATCH 12/24] powerpc/mm: Fix reporting of kernel execute faults Christophe LEROY
2018-11-07 10:39     ` Benjamin Herrenschmidt
     [not found]     ` <87zhtr5d1v.fsf@linux.ibm.com>
2018-11-30  6:08       ` Christophe LEROY
2017-07-19  4:49 ` [PATCH 13/24] powerpc/mm: Make bad_area* helper functions Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 14/24] powerpc/mm: Rework mm_fault_error() Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 15/24] powerpc/mm: Move CMO accounting out of do_page_fault into a helper Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 16/24] powerpc/mm: Cosmetic fix to page fault accounting Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 17/24] powerpc/mm: Move the DSISR_PROTFAULT sanity check Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 18/24] powerpc/mm: Move/simplify faulthandler_disabled() and !mm check Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 19/24] powerpc/mm: Add a bunch of (un)likely annotations to do_page_fault Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 20/24] powerpc/mm: Set fault flags earlier Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 21/24] powerpc/mm: Move page fault VMA access checks to a helper Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 22/24] powerpc/mm: Don't lose "major" fault indication on retry Benjamin Herrenschmidt
2017-07-19  4:49 ` [PATCH 23/24] powerpc/mm: Cleanup check for stack expansion Benjamin Herrenschmidt
2017-07-21 16:59   ` LEROY Christophe
2017-07-24 10:47     ` Michael Ellerman
2017-07-24 17:34       ` LEROY Christophe
2017-07-25 11:19         ` Michael Ellerman
2017-07-31 11:37           ` Christophe LEROY
2017-07-19  4:49 ` [PATCH 24/24] powerpc: Remove old unused icswx based coprocessor support Benjamin Herrenschmidt
2017-08-07 10:41 ` [01/24] powerpc/mm: Move exception_enter/exit to a do_page_fault wrapper Michael Ellerman
2017-08-07 16:37   ` Christophe LEROY
2017-08-08  2:16     ` Michael Ellerman
2017-08-08  6:45       ` Christophe LEROY
2017-08-08 10:00         ` Michael Ellerman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170719044946.22030-12-benh@kernel.crashing.org \
    --to=benh@kernel.crashing.org \
    --cc=aneesh.kumar@linux.vnet.ibm.com \
    --cc=linuxppc-dev@lists.ozlabs.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).