• Andy Lutomirski's avatar
    x86/vdso: Disallow vvar access to vclock IO for never-used vclocks · bd902c53
    Andy Lutomirski authored
    It makes me uncomfortable that even modern systems grant every
    process direct read access to the HPET.
    
    While fixing this for real without regressing anything is a mess
    (unmapping the HPET is tricky because we don't adequately track
    all the mappings), we can do almost as well by tracking which
    vclocks have ever been used and only allowing pages associated
    with used vclocks to be faulted in.
    
    This will cause rogue programs that try to peek at the HPET to
    get SIGBUS instead on most systems.
    
    We can't restrict faults to vclock pages that are associated
    with the currently selected vclock due to a race: a process
    could start to access the HPET for the first time and race
    against a switch away from the HPET as the current clocksource.
    We can't segfault the process trying to peek at the HPET in this
    case, even though the process isn't going to do anything useful
    with the data.
    Signed-off-by: default avatarAndy Lutomirski <luto@kernel.org>
    Reviewed-by: default avatarKees Cook <keescook@chromium.org>
    Cc: Andy Lutomirski <luto@amacapital.net>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Oleg Nesterov <oleg@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Quentin Casasnovas <quentin.casasnovas@oracle.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Link: http://lkml.kernel.org/r/e79d06295625c02512277737ab55085a498ac5d8.1451446564.git.luto@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    bd902c53
vsyscall_gtod.c 2.31 KB