[linux] 04/04: mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() (CVE-2017-1000405)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

benh pushed a commit to branch jessie
in repository linux.

commit 8475bc950606fb18cc6f1da1d3fb31fb0b4076c0
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Sat Dec 2 16:01:54 2017 +0100

    mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d() (CVE-2017-1000405)
---
 debian/changelog                                   |  2 +
 ...ot-make-page-table-dirty-unconditionally-.patch | 52 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 55 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index 1c703c9..d623dfc 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -421,6 +421,8 @@ linux (3.16.51-1) UNRELEASED; urgency=medium
 
   [ Salvatore Bonaccorso ]
   * KEYS: Simplify KEYRING_SEARCH_{NO,DO}_STATE_CHECK flags (Closes: #877760)
+  * mm, thp: Do not make page table dirty unconditionally in touch_p[mu]d()
+    (CVE-2017-1000405)
 
   [ Ben Hutchings ]
   * [s390*] qeth: Ignore ABI changes
diff --git a/debian/patches/bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch b/debian/patches/bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch
new file mode 100644
index 0000000..f0477f5
--- /dev/null
+++ b/debian/patches/bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch
@@ -0,0 +1,52 @@
+From: "Kirill A. Shutemov" <kirill.shutemov at linux.intel.com>
+Date: Mon, 27 Nov 2017 06:21:25 +0300
+Subject: mm, thp: Do not make page table dirty unconditionally in
+ touch_p[mu]d()
+Origin: https://git.kernel.org/linus/a8f97366452ed491d13cf1e44241bc0b5740b1f0
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-1000405
+
+Currently, we unconditionally make page table dirty in touch_pmd().
+It may result in false-positive can_follow_write_pmd().
+
+We may avoid the situation, if we would only make the page table entry
+dirty if caller asks for write access -- FOLL_WRITE.
+
+The patch also changes touch_pud() in the same way.
+
+Signed-off-by: Kirill A. Shutemov <kirill.shutemov at linux.intel.com>
+Cc: Michal Hocko <mhocko at suse.com>
+Cc: Hugh Dickins <hughd at google.com>
+Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
+[carnil: backport for 3.16:
+ - Adjust context
+ - Drop specific part for PUD-sized transparent hugepages. Support
+   for PUD-sized transparent hugepages was added in v4.11-rc1
+]
+---
+ mm/huge_memory.c | 36 +++++++++++++-----------------------
+ 1 file changed, 13 insertions(+), 23 deletions(-)
+
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1230,17 +1230,11 @@ struct page *follow_trans_huge_pmd(struc
+ 
+ 	if (flags & FOLL_TOUCH) {
+ 		pmd_t _pmd;
+-		/*
+-		 * We should set the dirty bit only for FOLL_WRITE but
+-		 * for now the dirty bit in the pmd is meaningless.
+-		 * And if the dirty bit will become meaningful and
+-		 * we'll only set it with FOLL_WRITE, an atomic
+-		 * set_bit will be required on the pmd to set the
+-		 * young bit, instead of the current set_pmd_at.
+-		 */
+-		_pmd = pmd_mkyoung(pmd_mkdirty(*pmd));
++		_pmd = pmd_mkyoung(*pmd);
++		if (flags & FOLL_WRITE)
++			_pmd = pmd_mkdirty(_pmd);
+ 		if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK,
+-					  pmd, _pmd,  1))
++					  pmd, _pmd, flags & FOLL_WRITE))
+ 			update_mmu_cache_pmd(vma, addr, pmd);
+ 	}
+ 	if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
diff --git a/debian/patches/series b/debian/patches/series
index bde22bf..8a61baf 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -683,6 +683,7 @@ bugfix/all/pie-aslr/mm-revert-x86_64-and-arm64-elf_et_dyn_base-base-chan.patch
 # Security fixes
 bugfix/all/timer-restrict-timer_stats-to-initial-pid-namespace.patch
 bugfix/all/mbcache-reschedule-before-restarting-iteration-in-mb_cache_entry_alloc.patch
+bugfix/all/mm-thp-Do-not-make-page-table-dirty-unconditionally-.patch
 
 # Fix ABI changes
 debian/of-fix-abi-changes.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git