Patch "powerpc/pseries: Whitelist dtl slub object for copying to userspace" has been added to the 5.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    powerpc/pseries: Whitelist dtl slub object for copying to userspace

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     powerpc-pseries-whitelist-dtl-slub-object-for-copyin.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 057cfadf565777a7781bc68f00bc5055cab8a8e5
Author: Anjali K <anjalik@xxxxxxxxxxxxx>
Date:   Fri Jun 14 23:08:44 2024 +0530

    powerpc/pseries: Whitelist dtl slub object for copying to userspace
    
    [ Upstream commit 1a14150e1656f7a332a943154fc486504db4d586 ]
    
    Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-*
    results in a BUG() when the config CONFIG_HARDENED_USERCOPY is enabled as
    shown below.
    
        kernel BUG at mm/usercopy.c:102!
        Oops: Exception in kernel mode, sig: 5 [#1]
        LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
        Modules linked in: xfs libcrc32c dm_service_time sd_mod t10_pi sg ibmvfc
        scsi_transport_fc ibmveth pseries_wdt dm_multipath dm_mirror dm_region_hash dm_log dm_mod fuse
        CPU: 27 PID: 1815 Comm: python3 Not tainted 6.10.0-rc3 #85
        Hardware name: IBM,9040-MRX POWER10 (raw) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_042) hv:phyp pSeries
        NIP:  c0000000005d23d4 LR: c0000000005d23d0 CTR: 00000000006ee6f8
        REGS: c000000120c078c0 TRAP: 0700   Not tainted  (6.10.0-rc3)
        MSR:  8000000000029033 <SF,EE,ME,IR,DR,RI,LE>  CR: 2828220f  XER: 0000000e
        CFAR: c0000000001fdc80 IRQMASK: 0
        [ ... GPRs omitted ... ]
        NIP [c0000000005d23d4] usercopy_abort+0x78/0xb0
        LR [c0000000005d23d0] usercopy_abort+0x74/0xb0
        Call Trace:
         usercopy_abort+0x74/0xb0 (unreliable)
         __check_heap_object+0xf8/0x120
         check_heap_object+0x218/0x240
         __check_object_size+0x84/0x1a4
         dtl_file_read+0x17c/0x2c4
         full_proxy_read+0x8c/0x110
         vfs_read+0xdc/0x3a0
         ksys_read+0x84/0x144
         system_call_exception+0x124/0x330
         system_call_vectored_common+0x15c/0x2ec
        --- interrupt: 3000 at 0x7fff81f3ab34
    
    Commit 6d07d1cd300f ("usercopy: Restrict non-usercopy caches to size 0")
    requires that only whitelisted areas in slab/slub objects can be copied to
    userspace when usercopy hardening is enabled using CONFIG_HARDENED_USERCOPY.
    Dtl contains hypervisor dispatch events which are expected to be read by
    privileged users. Hence mark this safe for user access.
    Specify useroffset=0 and usersize=DISPATCH_LOG_BYTES to whitelist the
    entire object.
    
    Co-developed-by: Vishal Chourasia <vishalc@xxxxxxxxxxxxx>
    Signed-off-by: Vishal Chourasia <vishalc@xxxxxxxxxxxxx>
    Signed-off-by: Anjali K <anjalik@xxxxxxxxxxxxx>
    Reviewed-by: Srikar Dronamraju <srikar@xxxxxxxxxxxxx>
    Signed-off-by: Michael Ellerman <mpe@xxxxxxxxxxxxxx>
    Link: https://msgid.link/20240614173844.746818-1-anjalik@xxxxxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index d5abb25865e36..bc1a4e024529b 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -305,8 +305,8 @@ static int alloc_dispatch_log_kmem_cache(void)
 {
 	void (*ctor)(void *) = get_dtl_cache_ctor();
 
-	dtl_cache = kmem_cache_create("dtl", DISPATCH_LOG_BYTES,
-						DISPATCH_LOG_BYTES, 0, ctor);
+	dtl_cache = kmem_cache_create_usercopy("dtl", DISPATCH_LOG_BYTES,
+						DISPATCH_LOG_BYTES, 0, 0, DISPATCH_LOG_BYTES, ctor);
 	if (!dtl_cache) {
 		pr_warn("Failed to create dispatch trace log buffer cache\n");
 		pr_warn("Stolen time statistics will be unreliable\n");




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux