linux-kernel - [PATCH] mm/migrate: properly preserve write attribute in special migrate entry

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180402023506.12180-1-jglisse@redhat.com>
Date:   Sun,  1 Apr 2018 22:35:06 -0400
From:   jglisse@...hat.com
To:     linux-mm@...ck.org
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        linux-kernel@...r.kernel.org,
        Ralph Campbell <rcampbell@...dia.com>,
        Jérôme Glisse <jglisse@...hat.com>
Subject: [PATCH] mm/migrate: properly preserve write attribute in special migrate entry

From: Ralph Campbell <rcampbell@...dia.com>

Use of pte_write(pte) is only valid for present pte, the common code
which set the migration entry can be reach for both valid present
pte and special swap entry (for device memory). Fix the code to use
the mpfn value which properly handle both cases.

On x86 this did not have any bad side effect because pte write bit
is below PAGE_BIT_GLOBAL and thus special swap entry have it set to
0 which in turn means we were always creating read only special
migration entry.

So once migration did finish we always write protected the CPU page
table entry (moreover this is only an issue when migrating from device
memory to system memory). End effect is that CPU write access would
fault again and restore write permission.

Signed-off-by: Ralph Campbell <rcampbell@...dia.com>
Signed-off-by: Jérôme Glisse <jglisse@...hat.com>
---
 mm/migrate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/migrate.c b/mm/migrate.c
index 5d0dc7b85f90..a5c559d8e0e7 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -2269,7 +2269,8 @@ static int migrate_vma_collect_pmd(pmd_t *pmdp,
 			ptep_get_and_clear(mm, addr, ptep);

 			/* Setup special migration page table entry */
-			entry = make_migration_entry(page, pte_write(pte));
+			entry = make_migration_entry(page, mpfn &
+						     MIGRATE_PFN_WRITE);
 			swp_pte = swp_entry_to_pte(entry);
 			if (pte_soft_dirty(pte))
 				swp_pte = pte_swp_mksoft_dirty(swp_pte);
-- 
2.14.3