linux-kernel - [PATCH] powerpc/vdso: Fix VDSO unmap check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201103171336.98883-1-ldufour@linux.ibm.com>
Date:   Tue,  3 Nov 2020 18:13:36 +0100
From:   Laurent Dufour <ldufour@...ux.ibm.com>
To:     linuxppc-dev@...ts.ozlabs.org
Cc:     linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>,
        Christophe Leroy <christophe.leroy@...roup.eu>,
        Michael Ellerman <mpe@...erman.id.au>,
        Benjamin Herrenschmidt <benh@...nel.crashing.org>,
        Paul Mackerras <paulus@...ba.org>
Subject: [PATCH] powerpc/vdso: Fix VDSO unmap check

The check introduced by the commit 83d3f0e90c6c ("powerpc/mm: tracking vDSO
remap") is wrong and is missing some partial unmaps of the VDSO.

To be complete the check needs the base and end address of the
VDSO. Currently only the base is available in the mm_context of a task, but
the end address can easily be computed because the size of VDSO is
constant. However, there are 2 sizes for 32 or 64 bits task and they are
stored in static variables in arch/powerpc/kernel/vdso.c.

Exporting a new function called vdso_pages() to get the number of pages of
the VDSO based on the static variables from arch/powerpc/kernel/vdso.c.

Fixes: 83d3f0e90c6c ("powerpc/mm: tracking vDSO remap")

Signed-off-by: Laurent Dufour <ldufour@...ux.ibm.com>
Reported-by: Thomas Gleixner <tglx@...utronix.de>
Suggested-by: Christophe Leroy <christophe.leroy@...roup.eu>
Cc: Michael Ellerman <mpe@...erman.id.au>
Cc: Benjamin Herrenschmidt <benh@...nel.crashing.org>
Cc: Paul Mackerras <paulus@...ba.org>
---
 arch/powerpc/include/asm/mmu_context.h | 18 ++++++++++++++++--
 arch/powerpc/kernel/vdso.c             | 14 ++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h
index e02aa793420b..ced80897b7a1 100644
--- a/arch/powerpc/include/asm/mmu_context.h
+++ b/arch/powerpc/include/asm/mmu_context.h
@@ -259,11 +259,25 @@ static inline void enter_lazy_tlb(struct mm_struct *mm,
 
 extern void arch_exit_mmap(struct mm_struct *mm);
 
+extern int vdso_pages(void);
 static inline void arch_unmap(struct mm_struct *mm,
 			      unsigned long start, unsigned long end)
 {
-	if (start <= mm->context.vdso_base && mm->context.vdso_base < end)
-		mm->context.vdso_base = 0;
+	unsigned long vdso_end;
+
+	if (mm->context.vdso_base) {
+		/*
+		 * case 1   >  |     VDSO    |  <
+		 * case 2   >  |           < |
+		 * case 3      |  >        < |
+		 * case 4      |  >          |  <
+		 */
+		vdso_end = mm->context.vdso_base;
+		vdso_end += vdso_pages() << PAGE_SHIFT;
+
+		if (start < vdso_end && mm->context.vdso_base < end)
+			mm->context.vdso_base = 0;
+	}
 }
 
 #ifdef CONFIG_PPC_MEM_KEYS
diff --git a/arch/powerpc/kernel/vdso.c b/arch/powerpc/kernel/vdso.c
index 8dad44262e75..9defa35a1eba 100644
--- a/arch/powerpc/kernel/vdso.c
+++ b/arch/powerpc/kernel/vdso.c
@@ -117,6 +117,20 @@ struct lib64_elfinfo
 	unsigned long	text;
 };
 
+/*
+ * Return the number of pages of the VDSO for the current task.
+ */
+int vdso_pages(void)
+{
+	int vdso_pages = vdso32_pages;
+
+#ifdef CONFIG_PPC64
+	if (!is_32bit_task())
+		vdso_pages = vdso64_pages;
+#endif
+
+	return vdso_pages + 1; /* Add the data page */
+}
 
 /*
  * This is called from binfmt_elf, we create the special vma for the
-- 
2.29.2