kernel-hardening - Re: [PATCH] mm: Prevent mapping slab pages to userspace

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87bm3xpsqx.fsf@concordia.ellerman.id.au>
Date: Thu, 31 Jan 2019 11:37:10 +1100
From: Michael Ellerman <mpe@...erman.id.au>
To: Matthew Wilcox <willy@...radead.org>, Andrew Morton <akpm@...ux-foundation.org>
Cc: Matthew Wilcox <willy@...radead.org>, linux-mm@...ck.org, linux-kernel@...r.kernel.org, Rik van Riel <riel@...riel.com>, Christoph Lameter <cl@...ux.com>, Pekka Enberg <penberg@...nel.org>, David Rientjes <rientjes@...gle.com>, Joonsoo Kim <iamjoonsoo.kim@....com>, kernel-hardening@...ts.openwall.com, Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH] mm: Prevent mapping slab pages to userspace

Matthew Wilcox <willy@...radead.org> writes:

> It's never appropriate to map a page allocated by SLAB into userspace.
> A buggy device driver might try this, or an attacker might be able to
> find a way to make it happen.
>
> Signed-off-by: Matthew Wilcox <willy@...radead.org>
> ---
>  mm/memory.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/mm/memory.c b/mm/memory.c
> index e11ca9dd823f..ce8c90b752be 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -1451,7 +1451,7 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr,
>  	spinlock_t *ptl;
>  
>  	retval = -EINVAL;
> -	if (PageAnon(page))
> +	if (PageAnon(page) || PageSlab(page))
>  		goto out;
>  	retval = -ENOMEM;
>  	flush_dcache_page(page);


Thanks for turning this into an actual patch.

cheers

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.