From: Greg Kroah-Hartman Date: Sat, 3 Nov 2018 06:44:24 +0000 (+0100) Subject: 3.18-stable patches X-Git-Tag: v4.19.1~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=0aebdd838f38df1a3bff49f02a4b0734b5341733;p=thirdparty%2Fkernel%2Fstable-queue.git 3.18-stable patches added patches: mremap-properly-flush-tlb-before-releasing-the-page.patch proc-iomem-only-expose-physical-resource-addresses-to-privileged-users.patch --- diff --git a/queue-3.18/mremap-properly-flush-tlb-before-releasing-the-page.patch b/queue-3.18/mremap-properly-flush-tlb-before-releasing-the-page.patch new file mode 100644 index 00000000000..19bd4e2cfa6 --- /dev/null +++ b/queue-3.18/mremap-properly-flush-tlb-before-releasing-the-page.patch @@ -0,0 +1,145 @@ +From ghackmann@android.com Sat Nov 3 07:42:58 2018 +From: Greg Hackmann +Date: Fri, 2 Nov 2018 12:40:55 -0700 +Subject: mremap: properly flush TLB before releasing the page +To: stable@vger.kernel.org +Cc: Linus Torvalds , Jann Horn , Will Deacon , Ingo Molnar , Peter Zijlstra , Greg Kroah-Hartman , Greg Hackmann +Message-ID: <20181102194055.103988-1-ghackmann@google.com> + +From: Linus Torvalds + +Commit eb66ae030829605d61fbef1909ce310e29f78821 upstream. + +This is a backport to stable 3.18.y, based on Will Deacon's 4.4.y +backport. + +Jann Horn points out that our TLB flushing was subtly wrong for the +mremap() case. What makes mremap() special is that we don't follow the +usual "add page to list of pages to be freed, then flush tlb, and then +free pages". No, mremap() obviously just _moves_ the page from one page +table location to another. + +That matters, because mremap() thus doesn't directly control the +lifetime of the moved page with a freelist: instead, the lifetime of the +page is controlled by the page table locking, that serializes access to +the entry. + +As a result, we need to flush the TLB not just before releasing the lock +for the source location (to avoid any concurrent accesses to the entry), +but also before we release the destination page table lock (to avoid the +TLB being flushed after somebody else has already done something to that +page). + +This also makes the whole "need_flush" logic unnecessary, since we now +always end up flushing the TLB for every valid entry. + +Reported-and-tested-by: Jann Horn +Acked-by: Will Deacon +Tested-by: Ingo Molnar +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Linus Torvalds +[will: backport to 4.4 stable] +Signed-off-by: Will Deacon +[ghackmann@google.com: adjust context] +Signed-off-by: Greg Hackmann +Signed-off-by: Greg Kroah-Hartman + +--- + mm/huge_memory.c | 6 +++++- + mm/mremap.c | 21 ++++++++++++++++----- + 2 files changed, 21 insertions(+), 6 deletions(-) + +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -1462,7 +1462,7 @@ int move_huge_pmd(struct vm_area_struct + spinlock_t *old_ptl, *new_ptl; + int ret = 0; + pmd_t pmd; +- ++ bool force_flush = false; + struct mm_struct *mm = vma->vm_mm; + + if ((old_addr & ~HPAGE_PMD_MASK) || +@@ -1490,6 +1490,8 @@ int move_huge_pmd(struct vm_area_struct + if (new_ptl != old_ptl) + spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING); + pmd = pmdp_get_and_clear(mm, old_addr, old_pmd); ++ if (pmd_present(pmd)) ++ force_flush = true; + VM_BUG_ON(!pmd_none(*new_pmd)); + + if (pmd_move_must_withdraw(new_ptl, old_ptl)) { +@@ -1498,6 +1500,8 @@ int move_huge_pmd(struct vm_area_struct + pgtable_trans_huge_deposit(mm, new_pmd, pgtable); + } + set_pmd_at(mm, new_addr, new_pmd, pmd_mksoft_dirty(pmd)); ++ if (force_flush) ++ flush_tlb_range(vma, old_addr, old_addr + PMD_SIZE); + if (new_ptl != old_ptl) + spin_unlock(new_ptl); + spin_unlock(old_ptl); +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -97,6 +97,8 @@ static void move_ptes(struct vm_area_str + struct mm_struct *mm = vma->vm_mm; + pte_t *old_pte, *new_pte, pte; + spinlock_t *old_ptl, *new_ptl; ++ bool force_flush = false; ++ unsigned long len = old_end - old_addr; + + /* + * When need_rmap_locks is true, we take the i_mmap_mutex and anon_vma +@@ -143,12 +145,26 @@ static void move_ptes(struct vm_area_str + if (pte_none(*old_pte)) + continue; + pte = ptep_get_and_clear(mm, old_addr, old_pte); ++ /* ++ * If we are remapping a valid PTE, make sure ++ * to flush TLB before we drop the PTL for the PTE. ++ * ++ * NOTE! Both old and new PTL matter: the old one ++ * for racing with page_mkclean(), the new one to ++ * make sure the physical page stays valid until ++ * the TLB entry for the old mapping has been ++ * flushed. ++ */ ++ if (pte_present(pte)) ++ force_flush = true; + pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr); + pte = move_soft_dirty_pte(pte); + set_pte_at(mm, new_addr, new_pte, pte); + } + + arch_leave_lazy_mmu_mode(); ++ if (force_flush) ++ flush_tlb_range(vma, old_end - len, old_end); + if (new_ptl != old_ptl) + spin_unlock(new_ptl); + pte_unmap(new_pte - 1); +@@ -168,7 +184,6 @@ unsigned long move_page_tables(struct vm + { + unsigned long extent, next, old_end; + pmd_t *old_pmd, *new_pmd; +- bool need_flush = false; + unsigned long mmun_start; /* For mmu_notifiers */ + unsigned long mmun_end; /* For mmu_notifiers */ + +@@ -207,7 +222,6 @@ unsigned long move_page_tables(struct vm + anon_vma_unlock_write(vma->anon_vma); + } + if (err > 0) { +- need_flush = true; + continue; + } else if (!err) { + split_huge_page_pmd(vma, old_addr, old_pmd); +@@ -224,10 +238,7 @@ unsigned long move_page_tables(struct vm + extent = LATENCY_LIMIT; + move_ptes(vma, old_pmd, old_addr, old_addr + extent, + new_vma, new_pmd, new_addr, need_rmap_locks); +- need_flush = true; + } +- if (likely(need_flush)) +- flush_tlb_range(vma, old_end-len, old_addr); + + mmu_notifier_invalidate_range_end(vma->vm_mm, mmun_start, mmun_end); + diff --git a/queue-3.18/proc-iomem-only-expose-physical-resource-addresses-to-privileged-users.patch b/queue-3.18/proc-iomem-only-expose-physical-resource-addresses-to-privileged-users.patch new file mode 100644 index 00000000000..bb14387e1f8 --- /dev/null +++ b/queue-3.18/proc-iomem-only-expose-physical-resource-addresses-to-privileged-users.patch @@ -0,0 +1,54 @@ +From 51d7b120418e99d6b3bf8df9eb3cc31e8171dee4 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Thu, 14 Apr 2016 12:05:37 -0700 +Subject: /proc/iomem: only expose physical resource addresses to privileged users + +From: Linus Torvalds + +commit 51d7b120418e99d6b3bf8df9eb3cc31e8171dee4 upstream. + +In commit c4004b02f8e5b ("x86: remove the kernel code/data/bss resources +from /proc/iomem") I was hoping to remove the phyiscal kernel address +data from /proc/iomem entirely, but that had to be reverted because some +system programs actually use it. + +This limits all the detailed resource information to properly +credentialed users instead. + +Signed-off-by: Linus Torvalds +Signed-off-by: Mark Salyzyn +Signed-off-by: Greg Kroah-Hartman +--- + kernel/resource.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/kernel/resource.c ++++ b/kernel/resource.c +@@ -104,16 +104,25 @@ static int r_show(struct seq_file *m, vo + { + struct resource *root = m->private; + struct resource *r = v, *p; ++ unsigned long long start, end; + int width = root->end < 0x10000 ? 4 : 8; + int depth; + + for (depth = 0, p = r; depth < MAX_IORES_LEVEL; depth++, p = p->parent) + if (p->parent == root) + break; ++ ++ if (file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) { ++ start = r->start; ++ end = r->end; ++ } else { ++ start = end = 0; ++ } ++ + seq_printf(m, "%*s%0*llx-%0*llx : %s\n", + depth * 2, "", +- width, (unsigned long long) r->start, +- width, (unsigned long long) r->end, ++ width, start, ++ width, end, + r->name ? r->name : ""); + return 0; + } diff --git a/queue-3.18/series b/queue-3.18/series index 93f432eb75b..e354b079990 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -128,3 +128,5 @@ x86-pci-mark-broadwell-ep-home-agent-1-as-having-non.patch unix-correctly-track-in-flight-fds-in-sending-proces.patch fs-fat-fatent.c-add-cond_resched-to-fat_count_free_c.patch perf-tools-disable-parallelism-for-make-clean.patch +proc-iomem-only-expose-physical-resource-addresses-to-privileged-users.patch +mremap-properly-flush-tlb-before-releasing-the-page.patch