linux-kernel - [PATCH] MIPS: reset all task's asid to 0 after asid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 5 Mar 2017 11:24:20 +0800
From:   Jiwei Sun <jiwei.sun@...driver.com>
To:     <ralf@...ux-mips.org>, <paul.burton@...tec.com>,
        <james.hogan@...tec.com>
CC:     <linux-mips@...ux-mips.org>, <linux-kernel@...r.kernel.org>,
        <jiwei.sun.bj@...com>
Subject: [PATCH] MIPS: reset all task's asid to 0 after asid_cache(cpu) overflows

If asid_cache(cpu) overflows, there may be two tasks with the same
asid. It is a risk that the two different tasks may have the same
address space.

A process will update its asid to newer version only when switch_mm()
is called and matches the following condition:
    if ((cpu_context(cpu, next) ^ asid_cache(cpu))
                    & asid_version_mask(cpu))
            get_new_mmu_context(next, cpu);
If asid_cache(cpu) overflows, cpu_context(cpu,next) and asid_cache(cpu)
will be reset to asid_first_version(cpu), and start a new cycle. It
can result in two tasks that have the same ASID in the process list.

For example, in CONFIG_CPU_MIPS32_R2, task named A's asid on CPU1 is
0x100, and has been sleeping and been not scheduled. After a long period
of time, another running task named B's asid on CPU1 is 0xffffffff, and
asid cached in the CPU1 is 0xffffffff too, next task named C is forked,
when schedule from B to C on CPU1, asid_cache(cpu) will overflow, so C's
asid on CPU1 will be 0x100 according to get_new_mmu_context(). A's asid
is the same as C, if now A is rescheduled on CPU1, A's asid is not able
to renew according to 'if' clause, and the local TLB entry can't be
flushed too, A's address space will be the same as C.

If asid_cache(cpu) overflows, all of user space task's asid on this CPU
are able to set a invalid value (such as 0), it will avoid the risk.

Signed-off-by: Jiwei Sun <jiwei.sun@...driver.com>
---
 arch/mips/include/asm/mmu_context.h | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/arch/mips/include/asm/mmu_context.h b/arch/mips/include/asm/mmu_context.h
index ddd57ad..1f60efc 100644
--- a/arch/mips/include/asm/mmu_context.h
+++ b/arch/mips/include/asm/mmu_context.h
@@ -108,8 +108,15 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
 #else
 		local_flush_tlb_all();	/* start new asid cycle */
 #endif
-		if (!asid)		/* fix version if needed */
+		if (!asid) {		/* fix version if needed */
+			struct task_struct *p;
+
+			for_each_process(p) {
+				if ((p->mm))
+					cpu_context(cpu, p->mm) = 0;
+			}
 			asid = asid_first_version(cpu);
+		}
 	}

 	cpu_context(cpu, mm) = asid_cache(cpu) = asid;
-- 
1.9.1