Messages in this thread | | | From | Paul Burton <> | Subject | Re: [PATCH] MIPS: math-emu: Write-protect delay slot emulation pages | Date | Sun, 23 Dec 2018 16:16:24 +0000 |
| |
Hello,
Paul Burton wrote: > Mapping the delay slot emulation page as both writeable & executable > presents a security risk, in that if an exploit can write to & jump into > the page then it can be used as an easy way to execute arbitrary code. > > Prevent this by mapping the page read-only for userland, and using > access_process_vm() with the FOLL_FORCE flag to write to it from > mips_dsemul(). > > This will likely be less efficient due to copy_to_user_page() performing > cache maintenance on a whole page, rather than a single line as in the > previous use of flush_cache_sigtramp(). However this delay slot > emulation code ought not to be running in any performance critical paths > anyway so this isn't really a problem, and we can probably do better in > copy_to_user_page() anyway in future. > > A major advantage of this approach is that the fix is small & simple to > backport to stable kernels. > > Reported-by: Andy Lutomirski <luto@kernel.org> > Signed-off-by: Paul Burton <paul.burton@mips.com> > Fixes: 432c6bacbd0c ("MIPS: Use per-mm page to execute branch delay slot instructions") > Cc: stable@vger.kernel.org # v4.8+
Applied to mips-fixes.
Thanks, Paul
[ This message was auto-generated; if you believe anything is incorrect then please email paul.burton@mips.com to report it. ]
| |