From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D21CC43381 for ; Fri, 12 Mar 2021 10:14:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1DA4D64FFD for ; Fri, 12 Mar 2021 10:14:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233287AbhCLKOH (ORCPT ); Fri, 12 Mar 2021 05:14:07 -0500 Received: from mail.kernel.org ([198.145.29.99]:56874 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233241AbhCLKNm (ORCPT ); Fri, 12 Mar 2021 05:13:42 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 97A3764FE0; Fri, 12 Mar 2021 10:03:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1615543392; bh=CXYKx7axsfKXw2XBYeApFSKwoY/rOIiGq6qs42H2XdI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=vnnGNkrII1WysOM8poKSTCBYj60kbz3yq1rn7CYyUxeK/lkqEKf5YcdyGLwKSDp0G bj05gpqdtZkRK4eOkQws3TCQHG0n7Nb8E7t0BPSaPuYwVmow7zyJNp5fu0jh13bRz/ d/lAqUBbjuLMFORpWAcJ4qQolA8SgR2kPSLSIVog= Date: Fri, 12 Mar 2021 11:03:09 +0100 From: Greg KH To: Christophe Leroy Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Subject: Re: [PATCH] [backport for 5.10] powerpc/603: Fix protection of user pages mapped with PROT_NONE Message-ID: References: <656520fecf792b8842dc54beec2da3bc29d0133c.1615486986.git.christophe.leroy@csgroup.eu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <656520fecf792b8842dc54beec2da3bc29d0133c.1615486986.git.christophe.leroy@csgroup.eu> Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Mar 11, 2021 at 06:24:30PM +0000, Christophe Leroy wrote: > (cherry picked from commit c119565a15a628efdfa51352f9f6c5186e506a1c) > > On book3s/32, page protection is defined by the PP bits in the PTE > which provide the following protection depending on the access > keys defined in the matching segment register: > - PP 00 means RW with key 0 and N/A with key 1. > - PP 01 means RW with key 0 and RO with key 1. > - PP 10 means RW with both key 0 and key 1. > - PP 11 means RO with both key 0 and key 1. > > Since the implementation of kernel userspace access protection, > PP bits have been set as follows: > - PP00 for pages without _PAGE_USER > - PP01 for pages with _PAGE_USER and _PAGE_RW > - PP11 for pages with _PAGE_USER and without _PAGE_RW > > For kernelspace segments, kernel accesses are performed with key 0 > and user accesses are performed with key 1. As PP00 is used for > non _PAGE_USER pages, user can't access kernel pages not flagged > _PAGE_USER while kernel can. > > For userspace segments, both kernel and user accesses are performed > with key 0, therefore pages not flagged _PAGE_USER are still > accessible to the user. > > This shouldn't be an issue, because userspace is expected to be > accessible to the user. But unlike most other architectures, powerpc > implements PROT_NONE protection by removing _PAGE_USER flag instead of > flagging the page as not valid. This means that pages in userspace > that are not flagged _PAGE_USER shall remain inaccessible. > > To get the expected behaviour, just mimic other architectures in the > TLB miss handler by checking _PAGE_USER permission on userspace > accesses as if it was the _PAGE_PRESENT bit. > > Note that this problem only is only for 603 cores. The 604+ have > an hash table, and hash_page() function already implement the > verification of _PAGE_USER permission on userspace pages. > > Fixes: f342adca3afc ("powerpc/32s: Prepare Kernel Userspace Access Protection") > Change-Id: I68bc5e5ff4542bdfcdcd12923fa96a5811707475 > Cc: stable@vger.kernel.org # v5.2+ > Reported-by: Christoph Plattner > Signed-off-by: Christophe Leroy > Signed-off-by: Michael Ellerman > Link: https://lore.kernel.org/r/4a0c6e3bb8f0c162457bf54d9bc6fd8d7b55129f.1612160907.git.christophe.leroy@csgroup.eu > --- > arch/powerpc/kernel/head_book3s_32.S | 9 ++++++--- > 1 file changed, 6 insertions(+), 3 deletions(-) Both backports applied, thanks. greg k-h