[RFC PATCH 3/3] Prevent user from writing to IBT bitmap.
From: Yu-cheng Yu <hidden>
Date: 2019-06-28 19:50:35
Also in:
linux-arch, linux-doc, linux-mm, lkml
Subsystem:
the rest, x86 architecture (32-bit and 64-bit), x86 mm · Maintainers:
Linus Torvalds, Thomas Gleixner, Ingo Molnar, Borislav Petkov, Dave Hansen, Andy Lutomirski, Peter Zijlstra
The IBT bitmap is visiable from user-mode, but not writable. Signed-off-by: Yu-cheng Yu <redacted> --- arch/x86/mm/fault.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 59f4f66e4f2e..231196abb62e 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c@@ -1454,6 +1454,13 @@ void do_user_addr_fault(struct pt_regs *regs, * we can handle it.. */ good_area: +#define USER_MODE_WRITE (FAULT_FLAG_WRITE | FAULT_FLAG_USER) + if (((flags & USER_MODE_WRITE) == USER_MODE_WRITE) && + (vma->vm_flags & VM_IBT)) { + bad_area_access_error(regs, hw_error_code, address, vma); + return; + } + if (unlikely(access_error(hw_error_code, vma))) { bad_area_access_error(regs, hw_error_code, address, vma); return;
--
2.17.1