Commit 81a31a86 authored by Ruihan Li's avatar Ruihan Li Committed by Greg Kroah-Hartman
Browse files

mm: page_table_check: Make it dependent on EXCLUSIVE_SYSTEM_RAM 



Without EXCLUSIVE_SYSTEM_RAM, users are allowed to map arbitrary
physical memory regions into the userspace via /dev/mem. At the same
time, pages may change their properties (e.g., from anonymous pages to
named pages) while they are still being mapped in the userspace, leading
to "corruption" detected by the page table check.

To avoid these false positives, this patch makes PAGE_TABLE_CHECK
depends on EXCLUSIVE_SYSTEM_RAM. This dependency is understandable
because PAGE_TABLE_CHECK is a hardening technique but /dev/mem without
STRICT_DEVMEM (i.e., !EXCLUSIVE_SYSTEM_RAM) is itself a security
problem.

Even with EXCLUSIVE_SYSTEM_RAM, I/O pages may be still allowed to be
mapped via /dev/mem. However, these pages are always considered as named
pages, so they won't break the logic used in the page table check.

Cc: <stable@vger.kernel.org> # 5.17
Signed-off-by: default avatarRuihan Li <lrh2000@pku.edu.cn>
Acked-by: default avatarDavid Hildenbrand <david@redhat.com>
Acked-by: default avatarPasha Tatashin <pasha.tatashin@soleen.com>
Link: https://lore.kernel.org/r/20230515130958.32471-4-lrh2000@pku.edu.cn


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d0b86165

Documentation/mm/page_table_check.rst

+19 −0
Original line number Diff line number Diff line
@@ -52,3 +52,22 @@ Build kernel with: 


Optionally, build kernel with PAGE_TABLE_CHECK_ENFORCED in order to have page

table support without extra kernel parameter.



Implementation notes

====================



We specifically decided not to use VMA information in order to avoid relying on

MM states (except for limited "struct page" info). The page table check is a

separate from Linux-MM state machine that verifies that the user accessible

pages are not falsely shared.



PAGE_TABLE_CHECK depends on EXCLUSIVE_SYSTEM_RAM. The reason is that without

EXCLUSIVE_SYSTEM_RAM, users are allowed to map arbitrary physical memory

regions into the userspace via /dev/mem. At the same time, pages may change

their properties (e.g., from anonymous pages to named pages) while they are

still being mapped in the userspace, leading to "corruption" detected by the

page table check.



Even with EXCLUSIVE_SYSTEM_RAM, I/O pages may be still allowed to be mapped via

/dev/mem. However, these pages are always considered as named pages, so they

won't break the logic used in the page table check.

mm/Kconfig.debug

+1 −0
Original line number Diff line number Diff line
@@ -98,6 +98,7 @@ config PAGE_OWNER 
config PAGE_TABLE_CHECK

	bool "Check for invalid mappings in user page tables"

	depends on ARCH_SUPPORTS_PAGE_TABLE_CHECK

	depends on EXCLUSIVE_SYSTEM_RAM

	select PAGE_EXTENSION

	help

	  Check that anonymous page is not being mapped twice with read write