lkml.org 
[lkml]   [2022]   [Sep]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v2 22/39] mm: Don't allow write GUPs to shadow stack memory
    Date
    Shadow stack memory is writable only in very specific, controlled ways.
    However, since it is writable, the kernel treats it as such. As a result
    there remain many ways for userspace to trigger the kernel to write to
    shadow stack's via get_user_pages(, FOLL_WRITE) operations. To make this a
    little less exposed, block writable GUPs for shadow stack VMAs.

    Still allow FOLL_FORCE to write through shadow stack protections, as it
    does for read-only protections.

    Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
    ---

    v2:
    - New patch

    arch/x86/include/asm/pgtable.h | 3 +++
    mm/gup.c | 2 +-
    2 files changed, 4 insertions(+), 1 deletion(-)

    diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
    index 7a769c4dbc1c..2e6a5ee70034 100644
    --- a/arch/x86/include/asm/pgtable.h
    +++ b/arch/x86/include/asm/pgtable.h
    @@ -1633,6 +1633,9 @@ static inline bool __pte_access_permitted(unsigned long pteval, bool write)
    {
    unsigned long need_pte_bits = _PAGE_PRESENT|_PAGE_USER;

    + if (write && (pteval & (_PAGE_RW | _PAGE_DIRTY)) == _PAGE_DIRTY)
    + return 0;
    +
    if (write)
    need_pte_bits |= _PAGE_RW;

    diff --git a/mm/gup.c b/mm/gup.c
    index 5abdaf487460..56da98f3335c 100644
    --- a/mm/gup.c
    +++ b/mm/gup.c
    @@ -1043,7 +1043,7 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags)
    return -EFAULT;

    if (write) {
    - if (!(vm_flags & VM_WRITE)) {
    + if (!(vm_flags & VM_WRITE) || (vm_flags & VM_SHADOW_STACK)) {
    if (!(gup_flags & FOLL_FORCE))
    return -EFAULT;
    /*
    --
    2.17.1
    \
     
     \ /
      Last update: 2022-09-30 00:35    [W:3.208 / U:0.028 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site