[linux] 02/02: mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() (CVE-2017-1000405)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch stretch
in repository linux.

commit 468da537ec8299c0d768fc84210527d4c8490bec
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Sat Dec 2 14:32:01 2017 +0100

    mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() (CVE-2017-1000405)
---
 debian/changelog                                   |  2 +
 ...ot-make-page-table-dirty-unconditionally-.patch | 74 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 77 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 8f5c87e..696e1aa 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -736,6 +736,8 @@ linux (4.9.65-1) UNRELEASED; urgency=medium
   [ Salvatore Bonaccorso ]
   * media: cx231xx-cards: fix NULL-deref on missing association descriptor
     (CVE-2017-16536)
+  * mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
+    (CVE-2017-1000405)
 
  -- Ben Hutchings <ben at decadent.org.uk>  Sun, 01 Oct 2017 16:14:43 +0100
 
diff --git a/debian/patches/bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch b/debian/patches/bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch
new file mode 100644
index 0000000..457a996
--- /dev/null
+++ b/debian/patches/bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch
@@ -0,0 +1,74 @@
+From: "Kirill A. Shutemov" <kirill.shutemov at linux.intel.com>
+Date: Mon, 27 Nov 2017 06:21:25 +0300
+Subject: mm, thp: Do not make page table dirty unconditionally in
+ touch_p[mu]d()
+Origin: https://git.kernel.org/linus/a8f97366452ed491d13cf1e44241bc0b5740b1f0
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-1000405
+
+Currently, we unconditionally make page table dirty in touch_pmd().
+It may result in false-positive can_follow_write_pmd().
+
+We may avoid the situation, if we would only make the page table entry
+dirty if caller asks for write access -- FOLL_WRITE.
+
+The patch also changes touch_pud() in the same way.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
+Cc: Michal Hocko <mhocko at suse.com>
+Cc: Hugh Dickins <hughd at google.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+[carnil: backport for 4.9:
+ - Adjust context
+ - Drop specific part for PUD-sized transparent hugepages. Support
+   for PUD-sized transparent hugepages was added in v4.11-rc1
+]
+---
+ mm/huge_memory.c | 36 +++++++++++++-----------------------
+ 1 file changed, 13 insertions(+), 23 deletions(-)
+
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -745,20 +745,15 @@ int vmf_insert_pfn_pmd(struct vm_area_st
+ EXPORT_SYMBOL_GPL(vmf_insert_pfn_pmd);
+ 
+ static void touch_pmd(struct vm_area_struct *vma, unsigned long addr,
+-		pmd_t *pmd)
++		pmd_t *pmd, int flags)
+ {
+ 	pmd_t _pmd;
+ 
+-	/*
+-	 * We should set the dirty bit only for FOLL_WRITE but for now
+-	 * the dirty bit in the pmd is meaningless.  And if the dirty
+-	 * bit will become meaningful and we'll only set it with
+-	 * FOLL_WRITE, an atomic set_bit will be required on the pmd to
+-	 * set the young bit, instead of the current set_pmd_at.
+-	 */
+-	_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
++	_pmd = pmd_mkyoung(*pmd);
++	if (flags & FOLL_WRITE)
++		_pmd = pmd_mkdirty(_pmd);
+ 	if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
+-				pmd, _pmd,  1))
++				pmd, _pmd, flags & FOLL_WRITE))
+ 		update_mmu_cache_pmd(vma, addr, pmd);
+ }
+ 
+@@ -787,7 +782,7 @@ struct page *follow_devmap_pmd(struct vm
+ 		return NULL;
+ 
+ 	if (flags & FOLL_TOUCH)
+-		touch_pmd(vma, addr, pmd);
++		touch_pmd(vma, addr, pmd, flags);
+ 
+ 	/*
+ 	 * device mapped pages can only be returned if the
+@@ -1158,7 +1153,7 @@ struct page *follow_trans_huge_pmd(struc
+ 	page = pmd_page(*pmd);
+ 	VM_BUG_ON_PAGE(!PageHead(page) && !is_zone_device_page(page), page);
+ 	if (flags & FOLL_TOUCH)
+-		touch_pmd(vma, addr, pmd);
++		touch_pmd(vma, addr, pmd, flags);
+ 	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
+ 		/*
+ 		 * We don't mlock() pte-mapped THPs. This way we can avoid
diff --git a/debian/patches/series b/debian/patches/series
index ef8bd55..265c6c0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -135,6 +135,7 @@ debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
 debian/time-mark-timer_stats-as-broken.patch
 bugfix/all/tracing-Use-strlcpy-instead-of-strcpy-in-__trace_fin.patch
 bugfix/all/media-cx231xx-cards-fix-NULL-deref-on-missing-associ.patch
+bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch
 
 # Fix exported symbol versions
 bugfix/ia64/revert-ia64-move-exports-to-definitions.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git