pagemap: hide physical addresses from non-privileged users

commit 1c90308e7a77af6742a97d1021cca923b23b7f0d upstream.

This patch makes pagemap readable for normal users and hides physical
addresses from them.  For some use-cases PFN isn't required at all.

See http://lkml.kernel.org/r/1425935472-17949-1-git-send-email-kirill@shutemov.name

Fixes: ab676b7d6fbf ("pagemap: do not leak physical addresses to non-privileged userspace")
Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reviewed-by: Mark Williamson <mwilliamson@undo-software.com>
Tested-by:  Mark Williamson <mwilliamson@undo-software.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
[bwh: Backported to 3.2:
 - Add the same check in the places where we look up a PFN
 - Add struct pagemapread * parameters where necessary
 - Open-code file_ns_capable()
 - Delete pagemap_open() entirely, as it would always return 0]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index d1bd6a9..de404f2 100644 (file)
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c
@@ -11,6 +11,7 @@
 #include <linux/rmap.h>
 #include <linux/swap.h>
 #include <linux/swapops.h>
 #include <linux/rmap.h>
 #include <linux/swap.h>
 #include <linux/swapops.h>

+#include <linux/security.h>

 
 #include <asm/elf.h>
 #include <asm/uaccess.h>
 
 #include <asm/elf.h>
 #include <asm/uaccess.h>


@@ -606,6 +607,7 @@ const struct file_operations proc_clear_refs_operations = {
 struct pagemapread {
        int pos, len;           /* units: PM_ENTRY_BYTES, not bytes */
        u64 *buffer;
 struct pagemapread {
        int pos, len;           /* units: PM_ENTRY_BYTES, not bytes */
        u64 *buffer;

+       bool show_pfn;

 };
 
 #define PM_ENTRY_BYTES      sizeof(u64)
 };
 
 #define PM_ENTRY_BYTES      sizeof(u64)


@@ -654,14 +656,14 @@ static u64 swap_pte_to_pagemap_entry(pte_t pte)
        return swp_type(e) | (swp_offset(e) << MAX_SWAPFILES_SHIFT);
 }
 
        return swp_type(e) | (swp_offset(e) << MAX_SWAPFILES_SHIFT);
 }
 

-static u64 pte_to_pagemap_entry(pte_t pte)
+static u64 pte_to_pagemap_entry(struct pagemapread *pm, pte_t pte)

 {
        u64 pme = 0;
        if (is_swap_pte(pte))
                pme = PM_PFRAME(swap_pte_to_pagemap_entry(pte))
                        | PM_PSHIFT(PAGE_SHIFT) | PM_SWAP;
        else if (pte_present(pte))
 {
        u64 pme = 0;
        if (is_swap_pte(pte))
                pme = PM_PFRAME(swap_pte_to_pagemap_entry(pte))
                        | PM_PSHIFT(PAGE_SHIFT) | PM_SWAP;
        else if (pte_present(pte))

-               pme = PM_PFRAME(pte_pfn(pte))
+               pme = (pm->show_pfn ? PM_PFRAME(pte_pfn(pte)) : 0)

                        | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT;
        return pme;
 }
                        | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT;
        return pme;
 }


@@ -693,7 +695,7 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
                if (vma && (vma->vm_start <= addr) &&
                    !is_vm_hugetlb_page(vma)) {
                        pte = pte_offset_map(pmd, addr);
                if (vma && (vma->vm_start <= addr) &&
                    !is_vm_hugetlb_page(vma)) {
                        pte = pte_offset_map(pmd, addr);

-                       pfn = pte_to_pagemap_entry(*pte);
+                       pfn = pte_to_pagemap_entry(pm, *pte);

                        /* unmap before userspace copy */
                        pte_unmap(pte);
                }
                        /* unmap before userspace copy */
                        pte_unmap(pte);
                }


@@ -708,11 +710,11 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
 }
 
 #ifdef CONFIG_HUGETLB_PAGE
 }
 
 #ifdef CONFIG_HUGETLB_PAGE

-static u64 huge_pte_to_pagemap_entry(pte_t pte, int offset)
+static u64 huge_pte_to_pagemap_entry(struct pagemapread *pm, pte_t pte, int offset)

 {
        u64 pme = 0;
        if (pte_present(pte))
 {
        u64 pme = 0;
        if (pte_present(pte))

-               pme = PM_PFRAME(pte_pfn(pte) + offset)
+               pme = (pm->show_pfn ? PM_PFRAME(pte_pfn(pte) + offset) : 0)

                        | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT;
        return pme;
 }
                        | PM_PSHIFT(PAGE_SHIFT) | PM_PRESENT;
        return pme;
 }


@@ -728,7 +730,7 @@ static int pagemap_hugetlb_range(pte_t *pte, unsigned long hmask,
 
        for (; addr != end; addr += PAGE_SIZE) {
                int offset = (addr & ~hmask) >> PAGE_SHIFT;
 
        for (; addr != end; addr += PAGE_SIZE) {
                int offset = (addr & ~hmask) >> PAGE_SHIFT;

-               pfn = huge_pte_to_pagemap_entry(*pte, offset);
+               pfn = huge_pte_to_pagemap_entry(pm, *pte, offset);

                err = add_to_pagemap(addr, pfn, pm);
                if (err)
                        return err;
                err = add_to_pagemap(addr, pfn, pm);
                if (err)
                        return err;


@@ -792,6 +794,10 @@ static ssize_t pagemap_read(struct file *file, char __user *buf,
        if (!count)
                goto out_task;
 
        if (!count)
                goto out_task;
 

+       /* do not disclose physical addresses: attack vector */
+       pm.show_pfn = !security_capable(&init_user_ns, file->f_cred, 
+                                       CAP_SYS_ADMIN);
+

        pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
        pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_TEMPORARY);
        ret = -ENOMEM;
        pm.len = (PAGEMAP_WALK_SIZE >> PAGE_SHIFT);
        pm.buffer = kmalloc(pm.len * PM_ENTRY_BYTES, GFP_TEMPORARY);
        ret = -ENOMEM;


@@ -864,19 +870,9 @@ out:
        return ret;
 }
 
        return ret;
 }
 

-static int pagemap_open(struct inode *inode, struct file *file)
-{
-       /* do not disclose physical addresses to unprivileged
-          userspace (closes a rowhammer attack vector) */
-       if (!capable(CAP_SYS_ADMIN))
-               return -EPERM;
-       return 0;
-}
-

 const struct file_operations proc_pagemap_operations = {
        .llseek         = mem_lseek, /* borrow this */
        .read           = pagemap_read,
 const struct file_operations proc_pagemap_operations = {
        .llseek         = mem_lseek, /* borrow this */
        .read           = pagemap_read,

-       .open           = pagemap_open,

 };
 #endif /* CONFIG_PROC_PAGE_MONITOR */
 
 };
 #endif /* CONFIG_PROC_PAGE_MONITOR */