linux-kernel - [PATCH RESEND 0/2] ARM: prctl: Reject PR_SET

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240227013546.15769-4-zev@bewilderbeest.net>
Date: Mon, 26 Feb 2024 17:35:40 -0800
From: Zev Weiss <zev@...ilderbeest.net>
To: Russell King <linux@...linux.org.uk>,
	linux-parisc@...r.kernel.org,
	linux-arm-kernel@...ts.infradead.org,
	Helge Deller <deller@....de>,
	Florent Revest <revest@...omium.org>
Cc: Zev Weiss <zev@...ilderbeest.net>,
	"James E.J. Bottomley" <James.Bottomley@...senPartnership.com>,
	"Borislav Petkov (AMD)" <bp@...en8.de>,
	Yin Fengwei <fengwei.yin@...el.com>,
	"Mike Rapoport (IBM)" <rppt@...nel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Kees Cook <keescook@...omium.org>,
	Yang Shi <yang@...amperecomputing.com>,
	Rick Edgecombe <rick.p.edgecombe@...el.com>,
	Oleg Nesterov <oleg@...hat.com>,
	David Hildenbrand <david@...hat.com>,
	Stefan Roesch <shr@...kernel.io>,
	Josh Triplett <josh@...htriplett.org>,
	Ondrej Mosnacek <omosnace@...hat.com>,
	Miguel Ojeda <ojeda@...nel.org>,
	linux-kernel@...r.kernel.org,
	openbmc@...ts.ozlabs.org,
	Sam James <sam@...too.org>,
	stable@...r.kernel.org
Subject: [PATCH RESEND 0/2] ARM: prctl: Reject PR_SET_MDWE where not supported

[Resending as per Russell's request...]

Hello,

I noticed after a recent kernel update that my ARM926 system started
segfaulting on any execve() after calling prctl(PR_SET_MDWE).  After
some investigation it appears that ARMv5 is incapable of providing the
appropriate protections for MDWE, since any readable memory is also
implicitly executable.

(Note that I'm not an expert in either ARM arch details or the mm
subsystem, so please bear with me if I've botched something in the
above analysis.)

The prctl_set_mdwe() function already had some special-case logic
added disabling it on PARISC (commit 793838138c15, "prctl: Disable
prctl(PR_SET_MDWE) on parisc"); this patch series (1) generalizes that
check to use an arch_*() function, and (2) adds a corresponding
override for ARM to disable MDWE on pre-ARMv6 CPUs.

With the series applied, prctl(PR_SET_MDWE) is rejected on ARMv5 and
subsequent execve() calls (as well as mmap(PROT_READ|PROT_WRITE)) can
succeed instead of unconditionally failing; on ARMv6 the prctl works
as it did previously.

Thanks,
Zev

[0] https://lore.kernel.org/all/2023112456-linked-nape-bf19@gregkh/

Zev Weiss (2):
  prctl: Generalize PR_SET_MDWE support check to be per-arch
  ARM: prctl: Reject PR_SET_MDWE on pre-ARMv6

 arch/arm/include/asm/mman.h    | 14 ++++++++++++++
 arch/parisc/include/asm/mman.h | 14 ++++++++++++++
 include/linux/mman.h           |  8 ++++++++
 kernel/sys.c                   |  7 +++++--
 4 files changed, 41 insertions(+), 2 deletions(-)
 create mode 100644 arch/arm/include/asm/mman.h
 create mode 100644 arch/parisc/include/asm/mman.h

-- 
2.43.2