linux-kernel - Re: [PATCH] MIPS: math-emu: Write-protect delay slot emulation pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <MWHPR2201MB1277DFE826A1F2A351D29CC7C1BA0@MWHPR2201MB1277.namprd22.prod.outlook.com>
Date:   Sun, 23 Dec 2018 16:16:24 +0000
From:   Paul Burton <paul.burton@...s.com>
To:     Paul Burton <pburton@...ecomp.com>
CC:     "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Rich Felker <dalias@...c.org>,
        David Daney <david.daney@...ium.com>,
        Paul Burton <pburton@...ecomp.com>,
        Andy Lutomirski <luto@...nel.org>,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>
Subject: Re: [PATCH] MIPS: math-emu: Write-protect delay slot emulation pages

Hello,

Paul Burton wrote:
> Mapping the delay slot emulation page as both writeable & executable
> presents a security risk, in that if an exploit can write to & jump into
> the page then it can be used as an easy way to execute arbitrary code.
> 
> Prevent this by mapping the page read-only for userland, and using
> access_process_vm() with the FOLL_FORCE flag to write to it from
> mips_dsemul().
> 
> This will likely be less efficient due to copy_to_user_page() performing
> cache maintenance on a whole page, rather than a single line as in the
> previous use of flush_cache_sigtramp(). However this delay slot
> emulation code ought not to be running in any performance critical paths
> anyway so this isn't really a problem, and we can probably do better in
> copy_to_user_page() anyway in future.
> 
> A major advantage of this approach is that the fix is small & simple to
> backport to stable kernels.
> 
> Reported-by: Andy Lutomirski <luto@...nel.org>
> Signed-off-by: Paul Burton <paul.burton@...s.com>
> Fixes: 432c6bacbd0c ("MIPS: Use per-mm page to execute branch delay slot instructions")
> Cc: stable@...r.kernel.org # v4.8+

Applied to mips-fixes.

Thanks,
    Paul

[ This message was auto-generated; if you believe anything is incorrect
  then please email paul.burton@...s.com to report it. ]