lkml.org 
[lkml]   [2020]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 259/344] x86/mm: Fix NX bit clearing issue in kernel_map_pages_in_pgd
    Date
    From: Ard Biesheuvel <ardb@kernel.org>

    [ Upstream commit 75fbef0a8b6b4bb19b9a91b5214f846c2dc5139e ]

    The following commit:

    15f003d20782 ("x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()")

    modified kernel_map_pages_in_pgd() to manage writable permissions
    of memory mappings in the EFI page table in a different way, but
    in the process, it removed the ability to clear NX attributes from
    read-only mappings, by clobbering the clear mask if _PAGE_RW is not
    being requested.

    Failure to remove the NX attribute from read-only mappings is
    unlikely to be a security issue, but it does prevent us from
    tightening the permissions in the EFI page tables going forward,
    so let's fix it now.

    Fixes: 15f003d20782 ("x86/mm/pat: Don't implicitly allow _PAGE_RW in kernel_map_pages_in_pgd()
    Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Link: https://lore.kernel.org/r/20200113172245.27925-5-ardb@kernel.org
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    arch/x86/mm/pageattr.c | 8 +-------
    1 file changed, 1 insertion(+), 7 deletions(-)

    diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
    index 0d09cc5aad614..a19a71b4d1850 100644
    --- a/arch/x86/mm/pageattr.c
    +++ b/arch/x86/mm/pageattr.c
    @@ -2215,7 +2215,7 @@ int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
    .pgd = pgd,
    .numpages = numpages,
    .mask_set = __pgprot(0),
    - .mask_clr = __pgprot(0),
    + .mask_clr = __pgprot(~page_flags & (_PAGE_NX|_PAGE_RW)),
    .flags = 0,
    };

    @@ -2224,12 +2224,6 @@ int __init kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
    if (!(__supported_pte_mask & _PAGE_NX))
    goto out;

    - if (!(page_flags & _PAGE_NX))
    - cpa.mask_clr = __pgprot(_PAGE_NX);
    -
    - if (!(page_flags & _PAGE_RW))
    - cpa.mask_clr = __pgprot(_PAGE_RW);
    -
    if (!(page_flags & _PAGE_ENC))
    cpa.mask_clr = pgprot_encrypted(cpa.mask_clr);

    --
    2.20.1


    \
     
     \ /
      Last update: 2020-02-21 09:12    [W:2.725 / U:0.544 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site