mm: remove gup_flags FOLL_WRITE games from __get_user_pages() (CVE-2016-5195)
This commit is contained in:
parent
bcfd608039
commit
c5c7172244
|
@ -158,6 +158,8 @@ linux (4.7.8-1) UNRELEASED; urgency=medium
|
|||
|
||||
[ Salvatore Bonaccorso ]
|
||||
* KEYS: Fix short sprintf buffer in /proc/keys show function (CVE-2016-7042)
|
||||
* mm: remove gup_flags FOLL_WRITE games from __get_user_pages()
|
||||
(CVE-2016-5195)
|
||||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Tue, 11 Oct 2016 22:43:14 +0100
|
||||
|
||||
|
|
83
debian/patches/bugfix/all/mm-remove-gup_flags-FOLL_WRITE-games-from-__get_user.patch
vendored
Normal file
83
debian/patches/bugfix/all/mm-remove-gup_flags-FOLL_WRITE-games-from-__get_user.patch
vendored
Normal file
|
@ -0,0 +1,83 @@
|
|||
From bd2f56577e4066fcd61eab60d817e86ae8d4c6bf Mon Sep 17 00:00:00 2001
|
||||
From: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
Date: Thu, 13 Oct 2016 13:07:36 -0700
|
||||
Subject: [PATCH 01/11] mm: remove gup_flags FOLL_WRITE games from
|
||||
__get_user_pages()
|
||||
|
||||
This is an ancient bug that was actually already fixed once (badly) by
|
||||
me eleven years ago in commit 4ceb5db9757a ("Fix get_user_pages() race
|
||||
for write access") but that was then undone due to problems on s390 by
|
||||
commit f33ea7f404e5 ("fix get_user_pages bug").
|
||||
|
||||
In the meantime, the s390 situation has long been fixed, and we can once
|
||||
more try to fix it by checking the pte_dirty() bit properly (and do it
|
||||
better). We introduce a new internal FOLL_COW flag to mark the "yes, we
|
||||
already did a COW" rather than play racy games with FOLL_WRITE that is
|
||||
very fundamental.
|
||||
|
||||
Reported-and-tested-by: Phil "not Paul" Oester <kernel@linuxace.com>
|
||||
Cc: Andy Lutomirski <luto@amacapital.net>
|
||||
Cc: Kees Cook <keescook@chromium.org>
|
||||
Cc: Oleg Nesterov <oleg@redhat.com>
|
||||
Cc: Willy Tarreau <w@1wt.eu>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||||
---
|
||||
include/linux/mm.h | 1 +
|
||||
mm/gup.c | 14 ++++++++++++--
|
||||
2 files changed, 13 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/include/linux/mm.h b/include/linux/mm.h
|
||||
index e9caec6a51e9..ed85879f47f5 100644
|
||||
--- a/include/linux/mm.h
|
||||
+++ b/include/linux/mm.h
|
||||
@@ -2232,6 +2232,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
|
||||
#define FOLL_TRIED 0x800 /* a retry, previous pass started an IO */
|
||||
#define FOLL_MLOCK 0x1000 /* lock present pages */
|
||||
#define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */
|
||||
+#define FOLL_COW 0x4000 /* internal GUP flag */
|
||||
|
||||
typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
|
||||
void *data);
|
||||
diff --git a/mm/gup.c b/mm/gup.c
|
||||
index 96b2b2fd0fbd..22cc22e7432f 100644
|
||||
--- a/mm/gup.c
|
||||
+++ b/mm/gup.c
|
||||
@@ -60,6 +60,16 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
|
||||
return -EEXIST;
|
||||
}
|
||||
|
||||
+/*
|
||||
+ * FOLL_FORCE can write to even unwritable pte's, but only
|
||||
+ * after we've gone through a COW cycle and they are dirty.
|
||||
+ */
|
||||
+static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
|
||||
+{
|
||||
+ return pte_write(pte) ||
|
||||
+ ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
|
||||
+}
|
||||
+
|
||||
static struct page *follow_page_pte(struct vm_area_struct *vma,
|
||||
unsigned long address, pmd_t *pmd, unsigned int flags)
|
||||
{
|
||||
@@ -95,7 +105,7 @@ static struct page *follow_page_pte(struct vm_area_struct *vma,
|
||||
}
|
||||
if ((flags & FOLL_NUMA) && pte_protnone(pte))
|
||||
goto no_page;
|
||||
- if ((flags & FOLL_WRITE) && !pte_write(pte)) {
|
||||
+ if ((flags & FOLL_WRITE) && !can_follow_write_pte(pte, flags)) {
|
||||
pte_unmap_unlock(ptep, ptl);
|
||||
return NULL;
|
||||
}
|
||||
@@ -412,7 +422,7 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma,
|
||||
* reCOWed by userspace write).
|
||||
*/
|
||||
if ((ret & VM_FAULT_WRITE) && !(vma->vm_flags & VM_WRITE))
|
||||
- *flags &= ~FOLL_WRITE;
|
||||
+ *flags |= FOLL_COW;
|
||||
return 0;
|
||||
}
|
||||
|
||||
--
|
||||
2.10.1.562.ge11b675.dirty
|
||||
|
|
@ -118,6 +118,7 @@ bugfix/all/net-add-recursion-limit-to-gro.patch
|
|||
bugfix/all/posix_acl-clear-sgid-bit-when-setting-file-permissio.patch
|
||||
bugfix/all/scsi-arcmsr-buffer-overflow-in-arcmsr_iop_message_xf.patch
|
||||
bugfix/all/KEYS-Fix-short-sprintf-buffer-in-proc-keys-show-func.patch
|
||||
bugfix/all/mm-remove-gup_flags-FOLL_WRITE-games-from-__get_user.patch
|
||||
|
||||
# ABI maintenance
|
||||
debian/i8042-revert-abi-break-in-4.7.3.patch
|
||||
|
|
Loading…
Reference in New Issue