leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

powerpc/book3s64/kuap: Restrict access to userspace based on userspace AMR

Browse Source 
If an application has configured address protection such that read/write is
denied using pkey even the kernel should receive a FAULT on accessing the same.

This patch use user AMR value stored in pt_regs.amr to achieve the same.

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
Reviewed-by: Sandipan Das <sandipan@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20201127044424.40686-16-aneesh.kumar@linux.ibm.com
This commit is contained in:
Aneesh Kumar K.V
2020-11-27 10:14:17 +05:30
committed by Michael Ellerman
parent 48a8ab4eeb
commit 4d6c551e9f
1 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
arch/powerpc/include/asm/book3s/64/kup.h
View File

@@ -314,14 +314,20 @@ bad_kuap_fault(struct pt_regs *regs, unsigned long address, bool is_write)
static __always_inline void allow_user_access(void __user *to, const void __user *from, static __always_inline void allow_user_access(void __user *to, const void __user *from,
unsigned long size, unsigned long dir) unsigned long size, unsigned long dir)
{ {
unsigned long thread_amr = 0;
// This is written so we can resolve to a single case at build time // This is written so we can resolve to a single case at build time
BUILD_BUG_ON(!__builtin_constant_p(dir)); BUILD_BUG_ON(!__builtin_constant_p(dir));
if (mmu_has_feature(MMU_FTR_PKEY))
thread_amr = current_thread_amr();
if (dir == KUAP_READ) if (dir == KUAP_READ)
set_kuap(AMR_KUAP_BLOCK_WRITE); set_kuap(thread_amr | AMR_KUAP_BLOCK_WRITE);
else if (dir == KUAP_WRITE) else if (dir == KUAP_WRITE)
set_kuap(AMR_KUAP_BLOCK_READ); set_kuap(thread_amr | AMR_KUAP_BLOCK_READ);
else if (dir == KUAP_READ_WRITE) else if (dir == KUAP_READ_WRITE)
set_kuap(0); set_kuap(thread_amr);
else else
BUILD_BUG(); BUILD_BUG();
} }