Skip to contentSkip to conversation

Patch "ARM: 8721/1: mm: dump: check hardware RO bit for LPAE" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Nov 27, 2017

Subsystems (2)
Stable branch Arm (32-bit)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ARM: 8721/1: mm: dump: check hardware RO bit for LPAE

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:

     arm-8721-1-mm-dump-check-hardware-ro-bit-for-lpae.patch

and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From 3b0c0c922ff4be275a8beb87ce5657d16f355b54 Mon Sep 17 00:00:00 2001

From: Philip Derrin <[email protected]>
Date: Tue, 14 Nov 2017 00:55:26 +0100
Subject: ARM: 8721/1: mm: dump: check hardware RO bit for LPAE

From: Philip Derrin <[email protected]>

commit 3b0c0c922ff4be275a8beb87ce5657d16f355b54 upstream.

When CONFIG_ARM_LPAE is set, the PMD dump relies on the software read-only bit to determine whether a page is writable. This concealed a bug which left the kernel text section writable (AP2=0) while marked read-only in the software bit.

In a kernel with the AP2 bug, the dump looks like this:

    ---[ Kernel Mapping ]---
    0xc0000000-0xc0200000           2M RW NX SHD
    0xc0200000-0xc0600000           4M ro x  SHD
    0xc0600000-0xc0800000           2M ro NX SHD
    0xc0800000-0xc4800000          64M RW NX SHD

The fix is to check that the software and hardware bits are both set before displaying "ro". The dump then shows the true perms:

    ---[ Kernel Mapping ]---
    0xc0000000-0xc0200000           2M RW NX SHD
    0xc0200000-0xc0600000           4M RW x  SHD
    0xc0600000-0xc0800000           2M RW NX SHD
    0xc0800000-0xc4800000          64M RW NX SHD
Fixes ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write logic for LPAE")
Signed-off-by Philip Derrin <[email protected]>
Tested-by Neil Dick <[email protected]>
Reviewed-by Kees Cook <[email protected]>
Signed-off-by Russell King <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 arch/arm/mm/dump.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
arch/arm/mm/dump.c +2 -2
@@ -126,8 +126,8 @@ static const struct prot_bits section_bi
 		.val	= PMD_SECT_USER,
 		.set	= "USR",
 	}, {
-		.mask	= L_PMD_SECT_RDONLY,
-		.val	= L_PMD_SECT_RDONLY,
+		.mask	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+		.val	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
 		.set	= "ro",
 		.clear	= "RW",
 #elif __LINUX_ARM_ARCH__ >= 6

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/arm-8722-1-mm-make-strict_kernel_rwx-effective-for-lpae.patch queue-4.9/arm-8721-1-mm-dump-check-hardware-ro-bit-for-lpae.patch