Ensure that a process cannot destroy his stub pages with using MADV_DONTNEED and friends. Reported-by: toralf.foerster@gmx.de Signed-off-by: Richard Weinberger <richard@nod.at>
		
			
				
	
	
		
			178 lines
		
	
	
	
		
			3.6 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			178 lines
		
	
	
	
		
			3.6 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
/*
 | 
						|
 * Copyright (C) 2002 - 2007 Jeff Dike (jdike@{addtoit,linux.intel}.com)
 | 
						|
 * Licensed under the GPL
 | 
						|
 */
 | 
						|
 | 
						|
#include <linux/mm.h>
 | 
						|
#include <linux/sched.h>
 | 
						|
#include <linux/slab.h>
 | 
						|
#include <asm/pgalloc.h>
 | 
						|
#include <asm/pgtable.h>
 | 
						|
#include <as-layout.h>
 | 
						|
#include <os.h>
 | 
						|
#include <skas.h>
 | 
						|
 | 
						|
extern int __syscall_stub_start;
 | 
						|
 | 
						|
static int init_stub_pte(struct mm_struct *mm, unsigned long proc,
 | 
						|
			 unsigned long kernel)
 | 
						|
{
 | 
						|
	pgd_t *pgd;
 | 
						|
	pud_t *pud;
 | 
						|
	pmd_t *pmd;
 | 
						|
	pte_t *pte;
 | 
						|
 | 
						|
	pgd = pgd_offset(mm, proc);
 | 
						|
	pud = pud_alloc(mm, pgd, proc);
 | 
						|
	if (!pud)
 | 
						|
		goto out;
 | 
						|
 | 
						|
	pmd = pmd_alloc(mm, pud, proc);
 | 
						|
	if (!pmd)
 | 
						|
		goto out_pmd;
 | 
						|
 | 
						|
	pte = pte_alloc_map(mm, NULL, pmd, proc);
 | 
						|
	if (!pte)
 | 
						|
		goto out_pte;
 | 
						|
 | 
						|
	*pte = mk_pte(virt_to_page(kernel), __pgprot(_PAGE_PRESENT));
 | 
						|
	*pte = pte_mkread(*pte);
 | 
						|
	return 0;
 | 
						|
 | 
						|
 out_pte:
 | 
						|
	pmd_free(mm, pmd);
 | 
						|
 out_pmd:
 | 
						|
	pud_free(mm, pud);
 | 
						|
 out:
 | 
						|
	return -ENOMEM;
 | 
						|
}
 | 
						|
 | 
						|
int init_new_context(struct task_struct *task, struct mm_struct *mm)
 | 
						|
{
 | 
						|
 	struct mm_context *from_mm = NULL;
 | 
						|
	struct mm_context *to_mm = &mm->context;
 | 
						|
	unsigned long stack = 0;
 | 
						|
	int ret = -ENOMEM;
 | 
						|
 | 
						|
	if (skas_needs_stub) {
 | 
						|
		stack = get_zeroed_page(GFP_KERNEL);
 | 
						|
		if (stack == 0)
 | 
						|
			goto out;
 | 
						|
	}
 | 
						|
 | 
						|
	to_mm->id.stack = stack;
 | 
						|
	if (current->mm != NULL && current->mm != &init_mm)
 | 
						|
		from_mm = ¤t->mm->context;
 | 
						|
 | 
						|
	if (proc_mm) {
 | 
						|
		ret = new_mm(stack);
 | 
						|
		if (ret < 0) {
 | 
						|
			printk(KERN_ERR "init_new_context_skas - "
 | 
						|
			       "new_mm failed, errno = %d\n", ret);
 | 
						|
			goto out_free;
 | 
						|
		}
 | 
						|
		to_mm->id.u.mm_fd = ret;
 | 
						|
	}
 | 
						|
	else {
 | 
						|
		if (from_mm)
 | 
						|
			to_mm->id.u.pid = copy_context_skas0(stack,
 | 
						|
							     from_mm->id.u.pid);
 | 
						|
		else to_mm->id.u.pid = start_userspace(stack);
 | 
						|
 | 
						|
		if (to_mm->id.u.pid < 0) {
 | 
						|
			ret = to_mm->id.u.pid;
 | 
						|
			goto out_free;
 | 
						|
		}
 | 
						|
	}
 | 
						|
 | 
						|
	ret = init_new_ldt(to_mm, from_mm);
 | 
						|
	if (ret < 0) {
 | 
						|
		printk(KERN_ERR "init_new_context_skas - init_ldt"
 | 
						|
		       " failed, errno = %d\n", ret);
 | 
						|
		goto out_free;
 | 
						|
	}
 | 
						|
 | 
						|
	return 0;
 | 
						|
 | 
						|
 out_free:
 | 
						|
	if (to_mm->id.stack != 0)
 | 
						|
		free_page(to_mm->id.stack);
 | 
						|
 out:
 | 
						|
	return ret;
 | 
						|
}
 | 
						|
 | 
						|
void uml_setup_stubs(struct mm_struct *mm)
 | 
						|
{
 | 
						|
	int err, ret;
 | 
						|
 | 
						|
	if (!skas_needs_stub)
 | 
						|
		return;
 | 
						|
 | 
						|
	ret = init_stub_pte(mm, STUB_CODE,
 | 
						|
			    (unsigned long) &__syscall_stub_start);
 | 
						|
	if (ret)
 | 
						|
		goto out;
 | 
						|
 | 
						|
	ret = init_stub_pte(mm, STUB_DATA, mm->context.id.stack);
 | 
						|
	if (ret)
 | 
						|
		goto out;
 | 
						|
 | 
						|
	mm->context.stub_pages[0] = virt_to_page(&__syscall_stub_start);
 | 
						|
	mm->context.stub_pages[1] = virt_to_page(mm->context.id.stack);
 | 
						|
 | 
						|
	/* dup_mmap already holds mmap_sem */
 | 
						|
	err = install_special_mapping(mm, STUB_START, STUB_END - STUB_START,
 | 
						|
				      VM_READ | VM_MAYREAD | VM_EXEC |
 | 
						|
				      VM_MAYEXEC | VM_DONTCOPY | VM_PFNMAP,
 | 
						|
				      mm->context.stub_pages);
 | 
						|
	if (err) {
 | 
						|
		printk(KERN_ERR "install_special_mapping returned %d\n", err);
 | 
						|
		goto out;
 | 
						|
	}
 | 
						|
	return;
 | 
						|
 | 
						|
out:
 | 
						|
	force_sigsegv(SIGSEGV, current);
 | 
						|
}
 | 
						|
 | 
						|
void arch_exit_mmap(struct mm_struct *mm)
 | 
						|
{
 | 
						|
	pte_t *pte;
 | 
						|
 | 
						|
	pte = virt_to_pte(mm, STUB_CODE);
 | 
						|
	if (pte != NULL)
 | 
						|
		pte_clear(mm, STUB_CODE, pte);
 | 
						|
 | 
						|
	pte = virt_to_pte(mm, STUB_DATA);
 | 
						|
	if (pte == NULL)
 | 
						|
		return;
 | 
						|
 | 
						|
	pte_clear(mm, STUB_DATA, pte);
 | 
						|
}
 | 
						|
 | 
						|
void destroy_context(struct mm_struct *mm)
 | 
						|
{
 | 
						|
	struct mm_context *mmu = &mm->context;
 | 
						|
 | 
						|
	if (proc_mm)
 | 
						|
		os_close_file(mmu->id.u.mm_fd);
 | 
						|
	else {
 | 
						|
		/*
 | 
						|
		 * If init_new_context wasn't called, this will be
 | 
						|
		 * zero, resulting in a kill(0), which will result in the
 | 
						|
		 * whole UML suddenly dying.  Also, cover negative and
 | 
						|
		 * 1 cases, since they shouldn't happen either.
 | 
						|
		 */
 | 
						|
		if (mmu->id.u.pid < 2) {
 | 
						|
			printk(KERN_ERR "corrupt mm_context - pid = %d\n",
 | 
						|
			       mmu->id.u.pid);
 | 
						|
			return;
 | 
						|
		}
 | 
						|
		os_kill_ptraced_process(mmu->id.u.pid, 1);
 | 
						|
	}
 | 
						|
 | 
						|
	if (skas_needs_stub)
 | 
						|
		free_page(mmu->id.stack);
 | 
						|
 | 
						|
	free_ldt(mmu);
 | 
						|
}
 |