* [PATCH][RFC] fix long long cast in pte macro
@ 2006-08-30 6:27 Willy Tarreau
2006-08-31 16:35 ` Ralf Baechle
0 siblings, 1 reply; 3+ messages in thread
From: Willy Tarreau @ 2006-08-30 6:27 UTC (permalink / raw)
To: linux-kernel; +Cc: mingo, ralf, pageexec
Hi,
PaX Team sent me this patch, which I think is valid. It fixes a long long
cast in the pte macro for i386 and mips. If nobody has any objections, I
will apply it to 2.4. I'd also like someone to check whether it's needed
for 2.6 and to forward port it if needed.
Thanks,
Willy
--
the current idiom used for initializing a structure of two unsigned longs
from unsigned long long is wrong, it effectively loses the upper 32 bits
which in this particular case could turn a non-executable PTE into an
executable one on NX capable i386 (i.e., it's a potential security bug).
fortunately the in-tree users in 2.4 (drivers/char/drm-4.0/ffb_drv.c
and arch/mips/baget/baget.c) are not affected.
diff -u linux-2.4.33-pax/include/asm-i386/page.h linux-2.4.33-pax/include/asm-i386/page.h
--- linux-2.4.33-pax/include/asm-i386/page.h 2006-08-16 15:18:16.000000000 +0200
+++ linux-2.4.33-pax/include/asm-i386/page.h 2006-08-20 13:48:17.000000000 +0200
@@ -41,11 +41,13 @@
typedef struct { unsigned long long pmd; } pmd_t;
typedef struct { unsigned long long pgd; } pgd_t;
#define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
+#define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
#else
typedef struct { unsigned long pte_low; } pte_t;
typedef struct { unsigned long pmd; } pmd_t;
typedef struct { unsigned long pgd; } pgd_t;
#define pte_val(x) ((x).pte_low)
+#define __pte(x) ((pte_t) { (x) } )
#endif
#define PTE_MASK PAGE_MASK
@@ -55,7 +57,6 @@
#define pgd_val(x) ((x).pgd)
#define pgprot_val(x) ((x).pgprot)
-#define __pte(x) ((pte_t) { (x) } )
#define __pmd(x) ((pmd_t) { (x) } )
#define __pgd(x) ((pgd_t) { (x) } )
#define __pgprot(x) ((pgprot_t) { (x) } )
diff -u linux-2.4.33-pax/include/asm-mips/page.h linux-2.4.33-pax/include/asm-mips/page.h
--- linux-2.4.33-pax/include/asm-mips/page.h 2006-08-13 00:03:26.000000000 +0200
+++ linux-2.4.33-pax/include/asm-mips/page.h 2006-08-20 13:51:58.000000000 +0200
@@ -77,13 +77,16 @@
#ifdef CONFIG_CPU_MIPS32
typedef struct { unsigned long pte_low, pte_high; } pte_t;
#define pte_val(x) ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
+ #define __pte(x) ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
#else
typedef struct { unsigned long long pte_low; } pte_t;
#define pte_val(x) ((x).pte_low)
+ #define __pte(x) ((pte_t) { (x) } )
#endif
#else
typedef struct { unsigned long pte_low; } pte_t;
#define pte_val(x) ((x).pte_low)
+#define __pte(x) ((pte_t) { (x) } )
#endif
typedef struct { unsigned long pmd; } pmd_t;
@@ -96,7 +99,6 @@
#define ptep_buddy(x) ((pte_t *)((unsigned long)(x) ^ sizeof(pte_t)))
-#define __pte(x) ((pte_t) { (x) } )
#define __pmd(x) ((pmd_t) { (x) } )
#define __pgd(x) ((pgd_t) { (x) } )
#define __pgprot(x) ((pgprot_t) { (x) } )
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH][RFC] fix long long cast in pte macro
2006-08-30 6:27 [PATCH][RFC] fix long long cast in pte macro Willy Tarreau
@ 2006-08-31 16:35 ` Ralf Baechle
2006-08-31 16:58 ` Willy Tarreau
0 siblings, 1 reply; 3+ messages in thread
From: Ralf Baechle @ 2006-08-31 16:35 UTC (permalink / raw)
To: Willy Tarreau; +Cc: linux-kernel, mingo, pageexec
On Wed, Aug 30, 2006 at 08:27:18AM +0200, Willy Tarreau wrote:
> PaX Team sent me this patch, which I think is valid. It fixes a long long
> cast in the pte macro for i386 and mips. If nobody has any objections, I
> will apply it to 2.4. I'd also like someone to check whether it's needed
> for 2.6 and to forward port it if needed.
Yes, a similar 2.6 patch is needed as well, I'll care of that. For the
MIPS segment of your 2.4 patch:
Acked-by: Ralf Baechle <ralf@linux-mips.org>
Ralf
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH][RFC] fix long long cast in pte macro
2006-08-31 16:35 ` Ralf Baechle
@ 2006-08-31 16:58 ` Willy Tarreau
0 siblings, 0 replies; 3+ messages in thread
From: Willy Tarreau @ 2006-08-31 16:58 UTC (permalink / raw)
To: Ralf Baechle; +Cc: linux-kernel, mingo, pageexec
On Thu, Aug 31, 2006 at 05:35:01PM +0100, Ralf Baechle wrote:
> On Wed, Aug 30, 2006 at 08:27:18AM +0200, Willy Tarreau wrote:
>
> > PaX Team sent me this patch, which I think is valid. It fixes a long long
> > cast in the pte macro for i386 and mips. If nobody has any objections, I
> > will apply it to 2.4. I'd also like someone to check whether it's needed
> > for 2.6 and to forward port it if needed.
>
> Yes, a similar 2.6 patch is needed as well, I'll care of that. For the
> MIPS segment of your 2.4 patch:
>
> Acked-by: Ralf Baechle <ralf@linux-mips.org>
>
> Ralf
Thanks Ralf,
Willy
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2006-08-31 16:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2006-08-30 6:27 [PATCH][RFC] fix long long cast in pte macro Willy Tarreau
2006-08-31 16:35 ` Ralf Baechle
2006-08-31 16:58 ` Willy Tarreau
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).