Home Home > GIT Browse > openSUSE-15.0
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorVlastimil Babka <vbabka@suse.cz>2018-12-07 14:58:25 +0100
committerVlastimil Babka <vbabka@suse.cz>2018-12-07 15:06:49 +0100
commit4dee7df1fa3c3042e5ba994e5814e80a54e07f3c (patch)
treec6090ddf9573fcfc414a89311cc431b9ba672f0f
parentd4fc67969a19e179a9a31b587a8b0f62a0d563f7 (diff)
userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE
vmas (CVE-2018-18397, bsc#1117656).
-rw-r--r--patches.fixes/userfaultfd-shmem-hugetlbfs-only-allow-to-register-vm_maywrite-vmas.patch104
-rw-r--r--series.conf1
2 files changed, 105 insertions, 0 deletions
diff --git a/patches.fixes/userfaultfd-shmem-hugetlbfs-only-allow-to-register-vm_maywrite-vmas.patch b/patches.fixes/userfaultfd-shmem-hugetlbfs-only-allow-to-register-vm_maywrite-vmas.patch
new file mode 100644
index 0000000000..c1ab27b8e8
--- /dev/null
+++ b/patches.fixes/userfaultfd-shmem-hugetlbfs-only-allow-to-register-vm_maywrite-vmas.patch
@@ -0,0 +1,104 @@
+From: Andrea Arcangeli <aarcange@redhat.com>
+Date: Fri, 30 Nov 2018 14:09:32 -0800
+Subject: userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
+Git-commit: 29ec90660d68bbdd69507c1c8b4e33aa299278b1
+Patch-mainline: v4.20-rc5
+References: CVE-2018-18397, bsc#1117656
+
+After the VMA to register the uffd onto is found, check that it has
+VM_MAYWRITE set before allowing registration. This way we inherit all
+common code checks before allowing to fill file holes in shmem and
+hugetlbfs with UFFDIO_COPY.
+
+The userfaultfd memory model is not applicable for readonly files unless
+it's a MAP_PRIVATE.
+
+Link: http://lkml.kernel.org/r/20181126173452.26955-4-aarcange@redhat.com
+Fixes: ff62a3421044 ("hugetlb: implement memfd sealing")
+Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
+Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
+Reviewed-by: Hugh Dickins <hughd@google.com>
+Reported-by: Jann Horn <jannh@google.com>
+Fixes: 4c27fe4c4c84 ("userfaultfd: shmem: add shmem_mcopy_atomic_pte for userfaultfd support")
+Cc: <stable@vger.kernel.org>
+Cc: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
+Cc: Mike Kravetz <mike.kravetz@oracle.com>
+Cc: Peter Xu <peterx@redhat.com>
+Cc: stable@vger.kernel.org
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
+---
+ fs/userfaultfd.c | 15 +++++++++++++++
+ mm/userfaultfd.c | 15 ++++++---------
+ 2 files changed, 21 insertions(+), 9 deletions(-)
+
+--- a/fs/userfaultfd.c
++++ b/fs/userfaultfd.c
+@@ -1324,6 +1324,19 @@ static int userfaultfd_register(struct u
+ ret = -EINVAL;
+ if (!vma_can_userfault(cur))
+ goto out_unlock;
++
++ /*
++ * UFFDIO_COPY will fill file holes even without
++ * PROT_WRITE. This check enforces that if this is a
++ * MAP_SHARED, the process has write permission to the backing
++ * file. If VM_MAYWRITE is set it also enforces that on a
++ * MAP_SHARED vma: there is no F_WRITE_SEAL and no further
++ * F_WRITE_SEAL can be taken until the vma is destroyed.
++ */
++ ret = -EPERM;
++ if (unlikely(!(cur->vm_flags & VM_MAYWRITE)))
++ goto out_unlock;
++
+ /*
+ * If this vma contains ending address, and huge pages
+ * check alignment.
+@@ -1369,6 +1382,7 @@ static int userfaultfd_register(struct u
+ BUG_ON(!vma_can_userfault(vma));
+ BUG_ON(vma->vm_userfaultfd_ctx.ctx &&
+ vma->vm_userfaultfd_ctx.ctx != ctx);
++ WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
+
+ /*
+ * Nothing to do: this vma is already registered into this
+@@ -1515,6 +1529,7 @@ static int userfaultfd_unregister(struct
+ cond_resched();
+
+ BUG_ON(!vma_can_userfault(vma));
++ WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
+
+ /*
+ * Nothing to do: this vma is already registered into this
+--- a/mm/userfaultfd.c
++++ b/mm/userfaultfd.c
+@@ -206,8 +206,9 @@ retry:
+ if (!dst_vma || !is_vm_hugetlb_page(dst_vma))
+ goto out_unlock;
+ /*
+- * Only allow __mcopy_atomic_hugetlb on userfaultfd
+- * registered ranges.
++ * Check the vma is registered in uffd, this is
++ * required to enforce the VM_MAYWRITE check done at
++ * uffd registration time.
+ */
+ if (!dst_vma->vm_userfaultfd_ctx.ctx)
+ goto out_unlock;
+@@ -448,13 +449,9 @@ retry:
+ if (!dst_vma)
+ goto out_unlock;
+ /*
+- * Be strict and only allow __mcopy_atomic on userfaultfd
+- * registered ranges to prevent userland errors going
+- * unnoticed. As far as the VM consistency is concerned, it
+- * would be perfectly safe to remove this check, but there's
+- * no useful usage for __mcopy_atomic ouside of userfaultfd
+- * registered ranges. This is after all why these are ioctls
+- * belonging to the userfaultfd and not syscalls.
++ * Check the vma is registered in uffd, this is required to
++ * enforce the VM_MAYWRITE check done at uffd registration
++ * time.
+ */
+ if (!dst_vma->vm_userfaultfd_ctx.ctx)
+ goto out_unlock;
diff --git a/series.conf b/series.conf
index 12ce76ccf8..14aca0d5da 100644
--- a/series.conf
+++ b/series.conf
@@ -19045,6 +19045,7 @@
patches.fixes/ACPI-IORT-Fix-iort_get_platform_device_domain-uninit.patch
patches.fixes/userfaultfd-use-enoent-instead-of-efault-if-the-atomic-copy-user-fails.patch
patches.fixes/userfaultfd-shmem-allocate-anonymous-memory-for-map_private-shmem.patch
+ patches.fixes/userfaultfd-shmem-hugetlbfs-only-allow-to-register-vm_maywrite-vmas.patch
patches.drivers/pci-imx6-fix-link-training-status-detection-in-link-up-check
patches.fixes/nvme-free-ctrl-device-name-on-init-failure.patch
patches.fixes/0001-xen-x86-add-diagnostic-printout-to-xen_mc_flush-in-c.patch