mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Vivian WangandPaul Walmsley
8d6c8c40e7
In kfence_protect_page(), which kfence_unprotect() calls, we cannot send
IPIs to other CPUs to ask them to flush TLB. This may lead to those CPUs
spuriously faulting on a recently allocated kfence object despite it
being valid, leading to false positive use-after-free reports.
Fix this by calling mark_new_valid_map() so that the page fault handling
code path notices the spurious fault and flushes TLB then retries the
access.
Update the comment in handle_exception to indicate that
new_valid_map_cpus_check also handles kfence_unprotect() spurious
faults.
Note that kfence_protect() has the same stale TLB entries problem, but
that leads to false negatives, which is fine with kfence.
Cc: stable@vger.kernel.org
Reported-by: Yanko Kaneti <yaneti@declera.com>
Fixes: b3431a8bb3 ("riscv: Fix IPIs usage in kfence_protect_page()")
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
Link: https://patch.msgid.link/20260303-handle-kfence-protect-spurious-fault-v2-2-f80d8354d79d@iscas.ac.cn
Signed-off-by: Paul Walmsley <pjw@kernel.org>
36 lines
735 B
C
36 lines
735 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
|
|
#ifndef _ASM_RISCV_KFENCE_H
|
|
#define _ASM_RISCV_KFENCE_H
|
|
|
|
#include <linux/kfence.h>
|
|
#include <linux/pfn.h>
|
|
#include <asm-generic/pgalloc.h>
|
|
#include <asm/cacheflush.h>
|
|
#include <asm/pgtable.h>
|
|
|
|
static inline bool arch_kfence_init_pool(void)
|
|
{
|
|
return true;
|
|
}
|
|
|
|
static inline bool kfence_protect_page(unsigned long addr, bool protect)
|
|
{
|
|
pte_t *pte = virt_to_kpte(addr);
|
|
|
|
if (protect) {
|
|
set_pte(pte, __pte(pte_val(ptep_get(pte)) & ~_PAGE_PRESENT));
|
|
} else {
|
|
set_pte(pte, __pte(pte_val(ptep_get(pte)) | _PAGE_PRESENT));
|
|
mark_new_valid_map();
|
|
}
|
|
|
|
preempt_disable();
|
|
local_flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
|
|
preempt_enable();
|
|
|
|
return true;
|
|
}
|
|
|
|
#endif /* _ASM_RISCV_KFENCE_H */
|