From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Will Deacon <will@kernel.org>,
Catalin Marinas <catalin.marinas@arm.com>,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 4.14 46/74] arm64: Revert support for execute-only user mappings
Date: Tue, 7 Jan 2020 21:55:11 +0100 [thread overview]
Message-ID: <20200107205211.833006339@linuxfoundation.org> (raw)
In-Reply-To: <20200107205135.369001641@linuxfoundation.org>
From: Catalin Marinas <catalin.marinas@arm.com>
commit 24cecc37746393432d994c0dbc251fb9ac7c5d72 upstream.
The ARMv8 64-bit architecture supports execute-only user permissions by
clearing the PTE_USER and PTE_UXN bits, practically making it a mostly
privileged mapping but from which user running at EL0 can still execute.
The downside, however, is that the kernel at EL1 inadvertently reading
such mapping would not trip over the PAN (privileged access never)
protection.
Revert the relevant bits from commit cab15ce604e5 ("arm64: Introduce
execute-only page access permissions") so that PROT_EXEC implies
PROT_READ (and therefore PTE_USER) until the architecture gains proper
support for execute-only user mappings.
Fixes: cab15ce604e5 ("arm64: Introduce execute-only page access permissions")
Cc: <stable@vger.kernel.org> # 4.9.x-
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/pgtable-prot.h | 5 ++---
arch/arm64/include/asm/pgtable.h | 10 +++-------
arch/arm64/mm/fault.c | 2 +-
mm/mmap.c | 6 ------
4 files changed, 6 insertions(+), 17 deletions(-)
--- a/arch/arm64/include/asm/pgtable-prot.h
+++ b/arch/arm64/include/asm/pgtable-prot.h
@@ -76,13 +76,12 @@
#define PAGE_SHARED_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_WRITE)
#define PAGE_READONLY __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN | PTE_UXN)
#define PAGE_READONLY_EXEC __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_RDONLY | PTE_NG | PTE_PXN)
-#define PAGE_EXECONLY __pgprot(_PAGE_DEFAULT | PTE_RDONLY | PTE_NG | PTE_PXN)
#define __P000 PAGE_NONE
#define __P001 PAGE_READONLY
#define __P010 PAGE_READONLY
#define __P011 PAGE_READONLY
-#define __P100 PAGE_EXECONLY
+#define __P100 PAGE_READONLY_EXEC
#define __P101 PAGE_READONLY_EXEC
#define __P110 PAGE_READONLY_EXEC
#define __P111 PAGE_READONLY_EXEC
@@ -91,7 +90,7 @@
#define __S001 PAGE_READONLY
#define __S010 PAGE_SHARED
#define __S011 PAGE_SHARED
-#define __S100 PAGE_EXECONLY
+#define __S100 PAGE_READONLY_EXEC
#define __S101 PAGE_READONLY_EXEC
#define __S110 PAGE_SHARED_EXEC
#define __S111 PAGE_SHARED_EXEC
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -90,12 +90,8 @@ extern unsigned long empty_zero_page[PAG
#define pte_dirty(pte) (pte_sw_dirty(pte) || pte_hw_dirty(pte))
#define pte_valid(pte) (!!(pte_val(pte) & PTE_VALID))
-/*
- * Execute-only user mappings do not have the PTE_USER bit set. All valid
- * kernel mappings have the PTE_UXN bit set.
- */
#define pte_valid_not_user(pte) \
- ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == (PTE_VALID | PTE_UXN))
+ ((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID)
#define pte_valid_young(pte) \
((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
#define pte_valid_user(pte) \
@@ -111,8 +107,8 @@ extern unsigned long empty_zero_page[PAG
/*
* p??_access_permitted() is true for valid user mappings (subject to the
- * write permission check) other than user execute-only which do not have the
- * PTE_USER bit set. PROT_NONE mappings do not have the PTE_VALID bit set.
+ * write permission check). PROT_NONE mappings do not have the PTE_VALID bit
+ * set.
*/
#define pte_access_permitted(pte, write) \
(pte_valid_user(pte) && (!(write) || pte_write(pte)))
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -400,7 +400,7 @@ static int __kprobes do_page_fault(unsig
struct task_struct *tsk;
struct mm_struct *mm;
int fault, sig, code, major = 0;
- unsigned long vm_flags = VM_READ | VM_WRITE;
+ unsigned long vm_flags = VM_READ | VM_WRITE | VM_EXEC;
unsigned int mm_flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
if (notify_page_fault(regs, esr))
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -89,12 +89,6 @@ static void unmap_region(struct mm_struc
* MAP_PRIVATE r: (no) no r: (yes) yes r: (no) yes r: (no) yes
* w: (no) no w: (no) no w: (copy) copy w: (no) no
* x: (no) no x: (no) yes x: (no) yes x: (yes) yes
- *
- * On arm64, PROT_EXEC has the following behaviour for both MAP_SHARED and
- * MAP_PRIVATE:
- * r: (no) no
- * w: (no) no
- * x: (yes) yes
*/
pgprot_t protection_map[16] __ro_after_init = {
__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
next prev parent reply other threads:[~2020-01-07 21:13 UTC|newest]
Thread overview: 82+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-07 20:54 [PATCH 4.14 00/74] 4.14.163-stable review Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 01/74] nvme_fc: add module to ops template to allow module references Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 02/74] iio: adc: max9611: Fix too short conversion time delay Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 03/74] PM / devfreq: Dont fail devfreq_dev_release if not in list Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 04/74] RDMA/cma: add missed unregister_pernet_subsys in init failure Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 05/74] rxe: correctly calculate iCRC for unaligned payloads Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 06/74] scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 07/74] scsi: qla2xxx: Dont call qlt_async_event twice Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 08/74] scsi: iscsi: qla4xxx: fix double free in probe Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 09/74] scsi: libsas: stop discovering if oob mode is disconnected Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 10/74] drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 11/74] usb: gadget: fix wrong endpoint desc Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 12/74] net: make socket read/write_iter() honor IOCB_NOWAIT Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 13/74] md: raid1: check rdev before reference in raid1_sync_request func Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 14/74] s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 15/74] s390/cpum_sf: Avoid SBD overflow condition in irq handler Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 16/74] IB/mlx4: Follow mirror sequence of device add during device removal Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 17/74] xen-blkback: prevent premature module unload Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 18/74] xen/balloon: fix ballooned page accounting without hotplug enabled Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 19/74] PM / hibernate: memory_bm_find_bit(): Tighten node optimisation Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 20/74] xfs: fix mount failure crash on invalid iclog memory access Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 21/74] taskstats: fix data-race Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 22/74] drm: limit to INT_MAX in create_blob ioctl Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 23/74] ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 24/74] drm/sun4i: hdmi: Remove duplicate cleanup calls Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 25/74] MIPS: Avoid VDSO ABI breakage due to global register variable Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 26/74] media: pulse8-cec: fix lost cec_transmit_attempt_done() call Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 27/74] media: cec: CEC 2.0-only bcast messages were ignored Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 28/74] media: cec: avoid decrementing transmit_queue_sz if it is 0 Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 29/74] mm/zsmalloc.c: fix the migrated zspage statistics Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 30/74] memcg: account security cred as well to kmemcg Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 31/74] pstore/ram: Write new dumps to start of recycled zones Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 32/74] locks: print unsigned ino in /proc/locks Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 33/74] dmaengine: Fix access to uninitialized dma_slave_caps Greg Kroah-Hartman
2020-01-07 20:54 ` [PATCH 4.14 34/74] compat_ioctl: block: handle Persistent Reservations Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 35/74] compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 36/74] ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys() Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 37/74] ata: ahci_brcm: Allow optional reset controller to be used Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 38/74] ata: ahci_brcm: Fix AHCI resources management Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 39/74] gpiolib: fix up emulated open drain outputs Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 40/74] tracing: Fix lock inversion in trace_event_enable_tgid_record() Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 41/74] tracing: Have the histogram compare functions convert to u64 first Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 42/74] ALSA: cs4236: fix error return comparison of an unsigned integer Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 43/74] ALSA: firewire-motu: Correct a typo in the clock proc string Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 44/74] exit: panic before exit_mm() on global init exit Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 45/74] ftrace: Avoid potential division by zero in function profiler Greg Kroah-Hartman
2020-01-07 20:55 ` Greg Kroah-Hartman [this message]
2020-01-07 20:55 ` [PATCH 4.14 47/74] PM / devfreq: Check NULL governor in available_governors_show Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 48/74] nfsd4: fix up replay_matches_cache() Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 49/74] scsi: qla2xxx: Drop superfluous INIT_WORK of del_work Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 50/74] xfs: dont check for AG deadlock for realtime files in bunmapi Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 51/74] platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 52/74] Bluetooth: btusb: fix PM leak in error case of setup Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 53/74] Bluetooth: delete a stray unlock Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 54/74] Bluetooth: Fix memory leak in hci_connect_le_scan Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 55/74] media: flexcop-usb: ensure -EIO is returned on error condition Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 56/74] regulator: ab8500: Remove AB8505 USB regulator Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 57/74] media: usb: fix memory leak in af9005_identify_state Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 58/74] dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 59/74] tty: serial: msm_serial: Fix lockup for sysrq and oops Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 60/74] fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 61/74] scsi: qedf: Do not retry ELS request if qedf_alloc_cmd fails Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 62/74] drm/mst: Fix MST sideband up-reply failure handling Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 63/74] powerpc/pseries/hvconsole: Fix stack overread via udbg Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 64/74] selftests: rtnetlink: add addresses with fixed life time Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 65/74] coresight: tmc-etf: Do not call smp_processor_id from preemptible Greg Kroah-Hartman
2020-01-07 23:08 ` Nathan Chancellor
2020-01-08 6:51 ` Greg Kroah-Hartman
2020-01-08 9:28 ` Suzuki Kuruppassery Poulose
2020-01-07 20:55 ` [PATCH 4.14 66/74] coresight: etb10: " Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 67/74] rxrpc: Fix possible NULL pointer access in ICMP handling Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 68/74] ath9k_htc: Modify byte order for an error message Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 69/74] ath9k_htc: Discard undersized packets Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 70/74] arm64: dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed warning Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 71/74] net: add annotations on hh->hh_len lockless accesses Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 72/74] s390/smp: fix physical to logical CPU map for SMT Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 73/74] xen/blkback: Avoid unmapping unmapped grant pages Greg Kroah-Hartman
2020-01-07 20:55 ` [PATCH 4.14 74/74] perf/x86/intel/bts: Fix the use of page_private() Greg Kroah-Hartman
2020-01-08 2:44 ` [PATCH 4.14 00/74] 4.14.163-stable review shuah
2020-01-08 15:43 ` Guenter Roeck
2020-01-08 16:22 ` Jon Hunter
2020-01-08 16:36 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200107205211.833006339@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=catalin.marinas@arm.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).