linux-kernel - [tip:x86/urgent] x86, smap: smap_violation() is bogus if CONFIG_X86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 13 Feb 2014 08:18:24 -0800
From:	"tip-bot for H. Peter Anvin" <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, hpa@...or.com, mingo@...nel.org,
	tglx@...utronix.de, fengguang.wu@...el.com, hpa@...ux.intel.com
Subject: [tip:x86/urgent] x86, smap: smap_violation()
  is bogus if CONFIG_X86_SMAP is off

Commit-ID:  af0c23df96fbc16089e8eda4b94b7d69b845f81e
Gitweb:     http://git.kernel.org/tip/af0c23df96fbc16089e8eda4b94b7d69b845f81e
Author:     H. Peter Anvin <hpa@...ux.intel.com>
AuthorDate: Thu, 13 Feb 2014 07:46:04 -0800
Committer:  H. Peter Anvin <hpa@...ux.intel.com>
CommitDate: Thu, 13 Feb 2014 08:08:58 -0800

x86, smap: smap_violation() is bogus if CONFIG_X86_SMAP is off

If CONFIG_X86_SMAP is disabled, smap_violation() tests for conditions
which are incorrect (as the AC flag doesn't matter), causing spurious
faults.

The dynamic disabling of SMAP (nosmap on the command line) is fine
because it disables X86_FEATURE_SMAP, therefore causing the
static_cpu_has() to return false.

Found by Fengguang Wu's test system.

[ v2: use IS_ENABLED() instead of #ifdef ]

Reported-by: Fengguang Wu <fengguang.wu@...el.com>
Link: http://lkml.kernel.org/r/20140213124550.GA30497@localhost
Signed-off-by: H. Peter Anvin <hpa@...ux.intel.com>
Cc: <stable@...r.kernel.org> # v3.7+
---
 arch/x86/mm/fault.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9d591c8..824b445 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -1087,7 +1087,7 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code)
 	if (unlikely(error_code & PF_RSVD))
 		pgtable_bad(regs, error_code, address);
 
-	if (static_cpu_has(X86_FEATURE_SMAP)) {
+	if (IS_ENABLED(CONFIG_X86_SMAP) && static_cpu_has(X86_FEATURE_SMAP)) {
 		if (unlikely(smap_violation(error_code, regs))) {
 			bad_area_nosemaphore(regs, error_code, address);
 			return;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/