From patchwork Wed Jul 5 12:33:59 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1803648 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=I7j+9Tjy; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Qwzf80vtwz1yV0 for ; Wed, 5 Jul 2023 22:35:44 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1qH1jP-0003Ss-LI; Wed, 05 Jul 2023 12:35:39 +0000 Received: from smtp-relay-canonical-0.internal ([10.131.114.83] helo=smtp-relay-canonical-0.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1qH1jN-0003S3-RP for kernel-team@lists.ubuntu.com; Wed, 05 Jul 2023 12:35:37 +0000 Received: from localhost.localdomain (1.general.cascardo.us.vpn [10.172.70.58]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-0.canonical.com (Postfix) with ESMTPSA id 7296F41430 for ; Wed, 5 Jul 2023 12:35:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1688560535; bh=yqN6b3A0r5rb9iRQV5wPJvathpu8Yj5wsTJHpM6WjQ8=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=I7j+9TjyDi+hUnwxa9w6wSZ5NaNxIW3/Qh/Fm1Aesgg06SiovHnKvqDDmlDr4Vtqm kNE5Rm98L+TR/4SDx66vDhy7qxApVO1aEJLKyP3WQZFVY8qDdRFNYg0X89LI4uNlEm o/GFs8uKatZfu20e00ah2b3Zddo1R/tcQFMilI0BY+EcfbzTqlFLXRLwPaODg5Bl++ UVUOoBcZL4EUHYkza5nf3lER6OOlEGfGJJ8Mc5Rqx7oNvwQZuBb8+5toBSkNWqH5Nv B256CQndgfKEG5wbs6qemshBJTUaiidC+mlaP2IVPiffQLsJKOMN1MZi5Re8nIjcF0 aLinfucu/NI+w== From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU OEM-6.1 01/14] exec: Remove FOLL_FORCE for stack setup Date: Wed, 5 Jul 2023 09:33:59 -0300 Message-Id: <20230705123425.764300-2-cascardo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230705123425.764300-1-cascardo@canonical.com> References: <20230705123425.764300-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Kees Cook It does not appear that FOLL_FORCE should be needed for setting up the stack pages. They are allocated using the nascent brpm->vma, which was newly created with VM_STACK_FLAGS, which an arch can override, but they all appear to include VM_WRITE | VM_MAYWRITE. Remove FOLL_FORCE. Cc: Eric Biederman Cc: David Hildenbrand Cc: Linus Torvalds Cc: Alexander Viro Cc: linux-fsdevel@vger.kernel.org Cc: linux-mm@kvack.org Link: https://lore.kernel.org/lkml/202211171439.CDE720EAD@keescook/ Signed-off-by: Kees Cook (cherry picked from commit cd57e443831d8eeb083c7165bce195d886e216d4) CVE-2023-3269 Signed-off-by: Thadeu Lima de Souza Cascardo --- fs/exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/exec.c b/fs/exec.c index a0b1f0337a62..19364a5d35ee 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -199,7 +199,7 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, { struct page *page; int ret; - unsigned int gup_flags = FOLL_FORCE; + unsigned int gup_flags = 0; #ifdef CONFIG_STACK_GROWSUP if (write) {