On Fri, Nov 23, 2018 at 03:06:17PM +0300, Kirill A. Shutemov wrote:
On Mon, Nov 19, 2018 at 12:24:36PM +0000, gregkh@xxxxxxxxxxxxxxxxxxx wrote:
The patch below does not apply to the 4.14-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@xxxxxxxxxxxxxxx>.
From 4d5b6e1f7425e22ff1ac055e55e15c4f104af4e5 Mon Sep 17 00:00:00 2001
From: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>
Date: Fri, 26 Oct 2018 15:28:55 +0300
Subject: [PATCH 2/2] x86/ldt: Unmap PTEs for the slot before freeing LDT pages
commit a0e6e0831c516860fc7f9be1db6c081fe902ebcf upstream
modify_ldt(2) leaves the old LDT mapped after switching over to the new
one. The old LDT gets freed and the pages can be re-used.
Leaving the mapping in place can have security implications. The mapping is
present in the userspace page tables and Meltdown-like attacks can read
these freed and possibly reused pages.
It's relatively simple to fix: unmap the old LDT and flush TLB before
freeing the old LDT memory.
This further allows to avoid flushing the TLB in map_ldt_struct() as the
slot is unmapped and flushed by unmap_ldt_struct() or has never been mapped
at all.
[ tglx: Massaged changelog and removed the needless line breaks ]
Fixes: f55f0501cbf6 ("x86/pti: Put the LDT in its own PGD if PTI is on")
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx>
Signed-off-by: Thomas Gleixner <tglx@xxxxxxxxxxxxx>
Cc: bp@xxxxxxxxx
Cc: hpa@xxxxxxxxx
Cc: dave.hansen@xxxxxxxxxxxxxxx
Cc: luto@xxxxxxxxxx
Cc: peterz@xxxxxxxxxxxxx
Cc: boris.ostrovsky@xxxxxxxxxx
Cc: jgross@xxxxxxxx
Cc: bhe@xxxxxxxxxx
Cc: willy@xxxxxxxxxxxxx
Cc: linux-mm@xxxxxxxxx
Cc: stable@xxxxxxxxxxxxxxx
Link: https://lkml.kernel.org/r/20181026122856.66224-3-kirill.shutemov@xxxxxxxxxxxxxxx
Queued for 4.14, thank you.
--
Thanks,
Sasha
