diff options
| author | Paul Mackerras <paulus@ozlabs.org> | 2016-09-02 21:47:59 +1000 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2016-10-05 22:40:20 -0400 |
| commit | 029a0cab4ef671ac1a5c4bfe7e4c39a2ddaff10d (patch) | |
| tree | a8ef6b14018db465e741557aa9c3c119a11a722f | |
| parent | 87af205b4c7ab1611a0fe915abcf178a2ba10a5d (diff) | |
| download | lwn-029a0cab4ef671ac1a5c4bfe7e4c39a2ddaff10d.tar.gz lwn-029a0cab4ef671ac1a5c4bfe7e4c39a2ddaff10d.zip | |
powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET
[ Upstream commit f077aaf0754bcba0fffdbd925bc12f09cd1e38aa ]
In commit c60ac5693c47 ("powerpc: Update kernel VSID range", 2013-03-13)
we lost a check on the region number (the top four bits of the effective
address) for addresses below PAGE_OFFSET. That commit replaced a check
that the top 18 bits were all zero with a check that bits 46 - 59 were
zero (performed for all addresses, not just user addresses).
This means that userspace can access an address like 0x1000_0xxx_xxxx_xxxx
and we will insert a valid SLB entry for it. The VSID used will be the
same as if the top 4 bits were 0, but the page size will be some random
value obtained by indexing beyond the end of the mm_ctx_high_slices_psize
array in the paca. If that page size is the same as would be used for
region 0, then userspace just has an alias of the region 0 space. If the
page size is different, then no HPTE will be found for the access, and
the process will get a SIGSEGV (since hash_page_mm() will refuse to create
a HPTE for the bogus address).
The access beyond the end of the mm_ctx_high_slices_psize can be at most
5.5MB past the array, and so will be in RAM somewhere. Since the access
is a load performed in real mode, it won't fault or crash the kernel.
At most this bug could perhaps leak a little bit of information about
blocks of 32 bytes of memory located at offsets of i * 512kB past the
paca->mm_ctx_high_slices_psize array, for 1 <= i <= 11.
Fixes: c60ac5693c47 ("powerpc: Update kernel VSID range")
Cc: stable@vger.kernel.org # v3.9+
Signed-off-by: Paul Mackerras <paulus@ozlabs.org>
Reviewed-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
| -rw-r--r-- | arch/powerpc/mm/slb_low.S | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S index 736d18b3cefd..4c48b487698c 100644 --- a/arch/powerpc/mm/slb_low.S +++ b/arch/powerpc/mm/slb_low.S @@ -113,7 +113,12 @@ BEGIN_FTR_SECTION END_MMU_FTR_SECTION_IFCLR(MMU_FTR_1T_SEGMENT) b slb_finish_load_1T -0: +0: /* + * For userspace addresses, make sure this is region 0. + */ + cmpdi r9, 0 + bne 8f + /* when using slices, we extract the psize off the slice bitmaps * and then we need to get the sllp encoding off the mmu_psize_defs * array. |