• Dave Hansen's avatar
    x86/pkeys: Do not special case protection key 0 · 2fa9d1cf
    Dave Hansen authored
    mm_pkey_is_allocated() treats pkey 0 as unallocated.  That is
    inconsistent with the manpages, and also inconsistent with
    mm->context.pkey_allocation_map.  Stop special casing it and only
    disallow values that are actually bad (< 0).
    
    The end-user visible effect of this is that you can now use
    mprotect_pkey() to set pkey=0.
    
    This is a bit nicer than what Ram proposed[1] because it is simpler
    and removes special-casing for pkey 0.  On the other hand, it does
    allow applications to pkey_free() pkey-0, but that's just a silly
    thing to do, so we are not going to protect against it.
    
    The scenario that could happen is similar to what happens if you free
    any other pkey that is in use: it might get reallocated later and used
    to protect some other data.  The most likely scenario is that pkey-0
    comes back from pkey_alloc(), an access-disable or write-disable bit
    is set in PKRU for it, and the next stack access will SIGSEGV.  It's
    not horribly different from if you mprotect()'d your stack or heap to
    be unreadable or unwritable, which is generally very foolish, but also
    not explicitly prevented by the kernel.
    
    1. http://lkml.kernel.org/r/1522112702-27853-1-git-send-email-linuxram@us.ibm.comSigned-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>p
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Michael Ellermen <mpe@ellerman.id.au>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Ram Pai <linuxram@us.ibm.com>
    Cc: Shuah Khan <shuah@kernel.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: linux-mm@kvack.org
    Cc: stable@vger.kernel.org
    Fixes: 58ab9a08 ("x86/pkeys: Check against max pkey to avoid overflows")
    Link: http://lkml.kernel.org/r/20180509171358.47FD785E@viggo.jf.intel.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    2fa9d1cf
mmu_context.h 9.85 KB