| From 3b0c0c922ff4be275a8beb87ce5657d16f355b54 Mon Sep 17 00:00:00 2001 |
| From: Philip Derrin <philip@cog.systems> |
| Date: Tue, 14 Nov 2017 00:55:26 +0100 |
| Subject: ARM: 8721/1: mm: dump: check hardware RO bit for LPAE |
| |
| From: Philip Derrin <philip@cog.systems> |
| |
| commit 3b0c0c922ff4be275a8beb87ce5657d16f355b54 upstream. |
| |
| When CONFIG_ARM_LPAE is set, the PMD dump relies on the software |
| read-only bit to determine whether a page is writable. This |
| concealed a bug which left the kernel text section writable |
| (AP2=0) while marked read-only in the software bit. |
| |
| In a kernel with the AP2 bug, the dump looks like this: |
| |
| ---[ Kernel Mapping ]--- |
| 0xc0000000-0xc0200000 2M RW NX SHD |
| 0xc0200000-0xc0600000 4M ro x SHD |
| 0xc0600000-0xc0800000 2M ro NX SHD |
| 0xc0800000-0xc4800000 64M RW NX SHD |
| |
| The fix is to check that the software and hardware bits are both |
| set before displaying "ro". The dump then shows the true perms: |
| |
| ---[ Kernel Mapping ]--- |
| 0xc0000000-0xc0200000 2M RW NX SHD |
| 0xc0200000-0xc0600000 4M RW x SHD |
| 0xc0600000-0xc0800000 2M RW NX SHD |
| 0xc0800000-0xc4800000 64M RW NX SHD |
| |
| Fixes: ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write logic for LPAE") |
| Signed-off-by: Philip Derrin <philip@cog.systems> |
| Tested-by: Neil Dick <neil@cog.systems> |
| Reviewed-by: Kees Cook <keescook@chromium.org> |
| Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| arch/arm/mm/dump.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/arch/arm/mm/dump.c |
| +++ b/arch/arm/mm/dump.c |
| @@ -126,8 +126,8 @@ static const struct prot_bits section_bi |
| .val = PMD_SECT_USER, |
| .set = "USR", |
| }, { |
| - .mask = L_PMD_SECT_RDONLY, |
| - .val = L_PMD_SECT_RDONLY, |
| + .mask = L_PMD_SECT_RDONLY | PMD_SECT_AP2, |
| + .val = L_PMD_SECT_RDONLY | PMD_SECT_AP2, |
| .set = "ro", |
| .clear = "RW", |
| #elif __LINUX_ARM_ARCH__ >= 6 |
