From patchwork Fri Jan 25 17:38:27 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Wilcox X-Patchwork-Id: 10781745 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9F190746 for ; Fri, 25 Jan 2019 17:38:49 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 81A9F2908C for ; Fri, 25 Jan 2019 17:38:49 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6CFFC286D4; Fri, 25 Jan 2019 17:38:49 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=2.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D527F28913 for ; Fri, 25 Jan 2019 17:38:48 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id B24928E00E1; Fri, 25 Jan 2019 12:38:47 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id AF9CB8E00DF; Fri, 25 Jan 2019 12:38:47 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A11028E00E1; Fri, 25 Jan 2019 12:38:47 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) by kanga.kvack.org (Postfix) with ESMTP id 5CF978E00DF for ; Fri, 25 Jan 2019 12:38:47 -0500 (EST) Received: by mail-pg1-f197.google.com with SMTP id a2so6752971pgt.11 for ; Fri, 25 Jan 2019 09:38:47 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:dkim-signature:from:to:cc:subject:date :message-id; bh=5fm7+VQclmc9hs1XdDfzoo0+kGTLRUZeg8UOcg8q+Z4=; b=DwvcYVom2zd7ee+/ExEhv6nbJ1GyeOE4zfBOjjaWPZZfEm1oMKQ+pk+qvLE37iG0mF zLx0PMxgiPrAxVbkUR72cPIGHYgKm/l3b9f6/FqW2jqNNiMF9jI+w9eQm3vv+3KMiUFS fmlxv2YCWp4sgGFQ0BSMnGzld2kPuO+S/fBZy3KtciXYUqU+iuoKA3c/o6gUUGOkBEko B6nAd8TFlZO6p3o52vEKmaxFlZQCH5Debh+7EIaCl7JjieayZtG207EBzGVU5CsL5C/1 Qw/rw3GmncoRrl06Rj3cG6HHrcW6oGVv4vCY/rsVJ02473yJDiZDlnh60Mh1RckFE8J6 sEEg== X-Gm-Message-State: AJcUukdVHw0bg45F9nBriW54qedogKLubbnxoxVyXXZuOryv1EPHH3mo WjjwZefwLG8zUYIX07CKwRv+XRQOgEoWHp//IdfmixbfSS+v0WvmdZTCBYfDIuK+ivW/RhDlJ/I knr+6AR/aQK5P/h7zckYDvzcHlWSifRdWeP4DnIDZIN18IwuwqCypMev3u40hkyxBzQ== X-Received: by 2002:a17:902:9691:: with SMTP id n17mr12232489plp.9.1548437926806; Fri, 25 Jan 2019 09:38:46 -0800 (PST) X-Google-Smtp-Source: ALg8bN43pjlsNQL8VCQ3Ce+hO7FnyyFCV4swseH7e7EAqM8x42SC+H2n5y5BtATNZmVxdTYw/VjR X-Received: by 2002:a17:902:9691:: with SMTP id n17mr12232456plp.9.1548437926096; Fri, 25 Jan 2019 09:38:46 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1548437926; cv=none; d=google.com; s=arc-20160816; b=ZIhs1VazcJSFRDPwhZp6qWYfv0BHIkfvm67PJ1TnOhBSDIUngEv91BiEiS/KoyHTWi fyrFkiLVCWZqsaLE7ZIy3auZ4pXoCauwD5/FJH/QU9q0+NgN8giTNdRk7d0Xaqvwc/qZ kdqZHjn1E/tJ96/mpjDZxnXa5Vw0Eu96rpKvlOgbEHWVNSwStQ6GgNkxP//NYzOc8mAQ /zdgoqBvqzry2SC+yAMJ6WVcXo9NdEB0K/92C569/l/XEZouFF7PVKBRG+c8j5lkqeQ/ OGshKkToGUpM0RUXE7S7D+Co7Bnv0YEuCJG82S8G6fckiroL0Nkp3r1ORnpIOVSwXLte 5Cig== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=message-id:date:subject:cc:to:from:dkim-signature; bh=5fm7+VQclmc9hs1XdDfzoo0+kGTLRUZeg8UOcg8q+Z4=; b=erBUFgZV81xn6izYHXWH7c7RBFKD8+OQisYZH4hjgIjj2ptHt4VK0WHfVyx/UywCoc 5hD0SZeG47XF1wkeaofKQQSgn67HN1/+1gnNGZrFeDXZj42UaQ4uu7F4xQIqGUVgXftB kOabUTmTAIRcKb6fyZ92NdoGItG3GlaPddsfkYQJghWTiWGFSAba10xfLoO06jD1yilP ZSqSjq1kftUL8A/3V5v6e10jUHRMW01lNEsLLBev+CXAfVePeZ32xF6PN/ZHM+ez2pOW vpY2tXVOMc9bzHls/9/oF9pN7Ar7MA/G3SmoNz4ResE/n5GYAqIbv0kisW3AEDcY1X5L 0fRA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@infradead.org header.s=bombadil.20170209 header.b=nf8Bb+7W; spf=pass (google.com: best guess record for domain of willy@infradead.org designates 2607:7c80:54:e::133 as permitted sender) smtp.mailfrom=willy@infradead.org Received: from bombadil.infradead.org (bombadil.infradead.org. [2607:7c80:54:e::133]) by mx.google.com with ESMTPS id m64si25262468pfb.224.2019.01.25.09.38.44 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 25 Jan 2019 09:38:44 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of willy@infradead.org designates 2607:7c80:54:e::133 as permitted sender) client-ip=2607:7c80:54:e::133; Authentication-Results: mx.google.com; dkim=pass header.i=@infradead.org header.s=bombadil.20170209 header.b=nf8Bb+7W; spf=pass (google.com: best guess record for domain of willy@infradead.org designates 2607:7c80:54:e::133 as permitted sender) smtp.mailfrom=willy@infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20170209; h=Message-Id:Date:Subject:Cc:To:From: Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=5fm7+VQclmc9hs1XdDfzoo0+kGTLRUZeg8UOcg8q+Z4=; b=nf8Bb+7W8x8wxgblLvy6oWMic d652mU0FzZk0JJee7uTAu8bH38PuCNnOgXPoWfLnj6NvmVvMVGjnWFKC+RDBigMq35LO4lvc7D7dn rkSem+D3vPoXfBabKSOPe+i9kSlzYTl2Lay6bBxCfYHkojLqgj3vawCoDKa9BbKQ4kYWJdGX0iNUC HdjdIt518XQF7vHcGAI2CShiycADvgCzYmkWMrvXwq4giB+5GXJPlzdqeL4br4whw8XZp0nVtlG62 cCL2HclCSzKdzKjbuibSwZTUrnauEnJ7RfLH3cMctor6SHckglSa9UgEI145lPqlCPIHzgqNhDHcz EJkl3+VbQ==; Received: from willy by bombadil.infradead.org with local (Exim 4.90_1 #2 (Red Hat Linux)) id 1gn5R9-0000hr-Ei; Fri, 25 Jan 2019 17:38:39 +0000 From: Matthew Wilcox To: Andrew Morton Cc: Matthew Wilcox , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Rik van Riel , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , kernel-hardening@lists.openwall.com, Kees Cook , Michael Ellerman Subject: [PATCH] mm: Prevent mapping slab pages to userspace Date: Fri, 25 Jan 2019 09:38:27 -0800 Message-Id: <20190125173827.2658-1-willy@infradead.org> X-Mailer: git-send-email 2.14.5 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP It's never appropriate to map a page allocated by SLAB into userspace. A buggy device driver might try this, or an attacker might be able to find a way to make it happen. Signed-off-by: Matthew Wilcox Reviewed-by: Kees Cook Acked-by: Pekka Enberg --- mm/memory.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/memory.c b/mm/memory.c index e11ca9dd823f..ce8c90b752be 100644 --- a/mm/memory.c +++ b/mm/memory.c @@ -1451,7 +1451,7 @@ static int insert_page(struct vm_area_struct *vma, unsigned long addr, spinlock_t *ptl; retval = -EINVAL; - if (PageAnon(page)) + if (PageAnon(page) || PageSlab(page)) goto out; retval = -ENOMEM; flush_dcache_page(page);