From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-20.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F0E2C433E0 for ; Wed, 10 Feb 2021 17:47:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 01E7564E7A for ; Wed, 10 Feb 2021 17:47:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233250AbhBJRr3 (ORCPT ); Wed, 10 Feb 2021 12:47:29 -0500 Received: from Galois.linutronix.de ([193.142.43.55]:33112 "EHLO galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233119AbhBJRqo (ORCPT ); Wed, 10 Feb 2021 12:46:44 -0500 Date: Wed, 10 Feb 2021 17:45:54 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1612979155; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=QhpO4wtRHBVDqOi6Ibrcz7CIBBDNPJaomOUcCEk9Exc=; b=UsmbD4I8PKm2kvJ7BntT1kNAmHPugGfF3Wwk7GLgnq39umWvpZul1/Uv4OtXvHIyxoa9ye DtEEEJj7h32u/NCSvlY5MfsHaRNfB7D7e9HscleDLlO53gE9GId9birbpupvj+hfnhajHY t3430HPQj7a1q2aG4dZnoaqURXSS/ivdOAY7bLANRNJfnpRBMUi6Eu5gBGH2+SBRjWx3PR SGopHbTNRlglHoftbfX5DClF8431+AYad6gXRWaWWI5SaJDstwKWGyVRU4IQEL4U/sJ4yP GQX0fGwVFQ8dbK9dbuFI8Mtj9ombmAONC5CW7HMWLuITv8IRFj6I3YtMpTDM/w== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1612979155; h=from:from:sender:sender:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=QhpO4wtRHBVDqOi6Ibrcz7CIBBDNPJaomOUcCEk9Exc=; b=6Bt0oRgAGt55sT3EPghPHzFgixMTBd9joLmkBPEo9UwuYqJZ5xVZue//DG1sx0qne0fU+e AYDlL4vqxyIICGDQ== From: "tip-bot2 for Andy Lutomirski" Sender: tip-bot2@linutronix.de Reply-to: linux-kernel@vger.kernel.org To: linux-tip-commits@vger.kernel.org Subject: [tip: x86/mm] x86/fault: Don't run fixups for SMAP violations Cc: Andy Lutomirski , Borislav Petkov , x86@kernel.org, linux-kernel@vger.kernel.org In-Reply-To: <66a02343624b1ff46f02a838c497fc05c1a871b3.1612924255.git.luto@kernel.org> References: <66a02343624b1ff46f02a838c497fc05c1a871b3.1612924255.git.luto@kernel.org> MIME-Version: 1.0 Message-ID: <161297915451.23325.5119224707479092069.tip-bot2@tip-bot2> Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The following commit has been merged into the x86/mm branch of tip: Commit-ID: ca247283781d754216395a41c5e8be8ec79a5f1c Gitweb: https://git.kernel.org/tip/ca247283781d754216395a41c5e8be8ec79a5f1c Author: Andy Lutomirski AuthorDate: Tue, 09 Feb 2021 18:33:45 -08:00 Committer: Borislav Petkov CommitterDate: Wed, 10 Feb 2021 16:27:57 +01:00 x86/fault: Don't run fixups for SMAP violations A SMAP-violating kernel access is not a recoverable condition. Imagine kernel code that, outside of a uaccess region, dereferences a pointer to the user range by accident. If SMAP is on, this will reliably generate as an intentional user access. This makes it easy for bugs to be overlooked if code is inadequately tested both with and without SMAP. This was discovered because BPF can generate invalid accesses to user memory, but those warnings only got printed if SMAP was off. Make it so that this type of error will be discovered with SMAP on as well. [ bp: Massage commit message. ] Signed-off-by: Andy Lutomirski Signed-off-by: Borislav Petkov Link: https://lkml.kernel.org/r/66a02343624b1ff46f02a838c497fc05c1a871b3.1612924255.git.luto@kernel.org --- arch/x86/mm/fault.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c index 1a0cfed..1c3054b 100644 --- a/arch/x86/mm/fault.c +++ b/arch/x86/mm/fault.c @@ -1279,9 +1279,12 @@ void do_user_addr_fault(struct pt_regs *regs, */ if (unlikely(cpu_feature_enabled(X86_FEATURE_SMAP) && !(error_code & X86_PF_USER) && - !(regs->flags & X86_EFLAGS_AC))) - { - bad_area_nosemaphore(regs, error_code, address); + !(regs->flags & X86_EFLAGS_AC))) { + /* + * No extable entry here. This was a kernel access to an + * invalid pointer. get_kernel_nofault() will not get here. + */ + page_fault_oops(regs, error_code, address); return; }