3.2.72-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Konstantin Khlebnikov <khlebnikov@xxxxxxxxxxxxxx> commit 1c90308e7a77af6742a97d1021cca923b23b7f0d upstream. This patch makes pagemap readable for normal users and hides physical addresses from them. For some use-cases PFN isn't required at all. See http://lkml.kernel.org/r/1425935472-17949-1-git-send-email-kirill@xxxxxxxxxxxxx Fixes: ab676b7d6fbf ("pagemap: do not leak physical addresses to non-privileged userspace") Signed-off-by: Konstantin Khlebnikov <khlebnikov@xxxxxxxxxxxxxx> Cc: Naoya Horiguchi <n-horiguchi@xxxxxxxxxxxxx> Reviewed-by: Mark Williamson <mwilliamson@xxxxxxxxxxxxxxxxx> Tested-by: Mark Williamson <mwilliamson@xxxxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Signed-off-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> [bwh: Backported to 3.2: - Add the same check in the places where we look up a PFN - Add struct pagemapread * parameters where necessary - Open-code file_ns_capable() - Delete pagemap_open() entirely, as it would always return 0] Signed-off-by: Ben Hutchings <ben@xxxxxxxxxxxxxxx> --- fs/proc/task_mmu.c | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c @@ -11,6 +11,7 @@ #include <linux/rmap.h> #include <linux/swap.h> #include <linux/swapops.h> +#include <linux/security.h> #include <asm/elf.h> #include <asm/uaccess.h> @@ -606,6 +607,7 @@ const struct file_operations proc_clear_ struct pagemapread { int pos, len; /* units: PM_ENTRY_BYTES, not bytes */ u64 *buffer; + bool show_pfn; }; #define PM_ENTRY_BYTES sizeof(u64) @@ -654,14 +656,14 @@ static u64 swap_pte_to_pagemap_entry(pte return swp_type(e) | (swp_offset(e) << MAX_SWAPFILES_SHIFT); } -static u64 pte_to_pagemap_entry(pte_t pte) +static u64 pte_to_pagemap_entry(struct pagemapread *pm, pte_t pte) { u64 pme = 0; if (is_swap_pte(pte)) pme = PM_PFRAME(swap_pte_to_pagemap_entry(pte)) | PM_PSHIFT(PAGE_SHIFT) | PM_SWAP; else if (pte_present(pte)) - pme = PM_PFRAME(pte_pfn(pte)) + pme = (pm->show_pfn ? PM_PFRAME(pte_pfn(pte)) : 0) | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT; return pme; } @@ -693,7 +695,7 @@ static int pagemap_pte_range(pmd_t *pmd, if (vma && (vma->vm_start <= addr) && !is_vm_hugetlb_page(vma)) { pte = pte_offset_map(pmd, addr); - pfn = pte_to_pagemap_entry(*pte); + pfn = pte_to_pagemap_entry(pm, *pte); /* unmap before userspace copy */ pte_unmap(pte); } @@ -708,11 +710,11 @@ static int pagemap_pte_range(pmd_t *pmd, } #ifdef CONFIG_HUGETLB_PAGE -static u64 huge_pte_to_pagemap_entry(pte_t pte, int offset) +static u64 huge_pte_to_pagemap_entry(struct pagemapread *pm, pte_t pte, int offset) { u64 pme = 0; if (pte_present(pte)) - pme = PM_PFRAME(pte_pfn(pte) + offset) + pme = (pm->show_pfn ? PM_PFRAME(pte_pfn(pte) + offset) : 0) | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT; return pme; } @@ -728,7 +730,7 @@ static int pagemap_hugetlb_range(pte_t * for (; addr != end; addr += PAGE_SIZE) { int offset = (addr & ~hmask) >> PAGE_SHIFT; - pfn = huge_pte_to_pagemap_entry(*pte, offset); + pfn = huge_pte_to_pagemap_entry(pm, *pte, offset); err = add_to_pagemap(addr, pfn, pm); if (err) return err; @@ -792,6 +794,10 @@ static ssize_t pagemap_read(struct file if (!count) goto out_task; + /* do not disclose physical addresses: attack vector */ + pm.show_pfn = !security_capable(&init_user_ns, file->f_cred, + CAP_SYS_ADMIN); + pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT); pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_TEMPORARY); ret = -ENOMEM; @@ -864,19 +870,9 @@ out: return ret; } -static int pagemap_open(struct inode *inode, struct file *file) -{ - /* do not disclose physical addresses to unprivileged - userspace (closes a rowhammer attack vector) */ - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; - return 0; -} - const struct file_operations proc_pagemap_operations = { .llseek = mem_lseek, /* borrow this */ .read = pagemap_read, - .open = pagemap_open, }; #endif /* CONFIG_PROC_PAGE_MONITOR */ -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html