Kevin Darbyshire-Bryant 8f4841462c kernel: MIPS: math-emu Write-protect delay slot emulation pages ... Backport https://git.kernel.org/pub/scm/linux/kernel/git/mips/linux.git/commit/?id=adcc81f148d733b7e8e641300c5590a2cdc13bf3 "Mapping the delay slot emulation page as both writeable & executable presents a security risk, in that if an exploit can write to & jump into the page then it can be used as an easy way to execute arbitrary code. Prevent this by mapping the page read-only for userland, and using access_process_vm() with the FOLL_FORCE flag to write to it from mips_dsemul(). This will likely be less efficient due to copy_to_user_page() performing cache maintenance on a whole page, rather than a single line as in the previous use of flush_cache_sigtramp(). However this delay slot emulation code ought not to be running in any performance critical paths anyway so this isn't really a problem, and we can probably do better in copy_to_user_page() anyway in future. A major advantage of this approach is that the fix is small & simple to backport to stable kernels. Reported-by: Andy Lutomirski <luto@kernel.org> Signed-off-by: Paul Burton <paul.burton@mips.com> Fixes: 432c6bacbd0c ("MIPS: Use per-mm page to execute branch delay slot instructions")" Without patch: cat /proc/self/maps 00400000-0047a000 r-xp 00000000 1f:03 1823 /bin/busybox 00489000-0048a000 r-xp 00079000 1f:03 1823 /bin/busybox 0048a000-0048b000 rwxp 0007a000 1f:03 1823 /bin/busybox 77ec8000-77eed000 r-xp 00000000 1f:03 2296 /lib/libgcc_s.so.1 77eed000-77eee000 rwxp 00015000 1f:03 2296 /lib/libgcc_s.so.1 77eee000-77f81000 r-xp 00000000 1f:03 2470 /lib/libc.so 77f90000-77f92000 rwxp 00092000 1f:03 2470 /lib/libc.so 77f92000-77f94000 rwxp 00000000 00:00 0 7f946000-7f967000 rw-p 00000000 00:00 0 [stack] 7fefb000-7fefc000 rwxp 00000000 00:00 0 7ffac000-7ffad000 r--p 00000000 00:00 0 [vvar] 7ffad000-7ffae000 r-xp 00000000 00:00 0 [vdso] Patch applied: cat /proc/self/maps 00400000-0047a000 r-xp 00000000 1f:03 1825 /bin/busybox 00489000-0048a000 r-xp 00079000 1f:03 1825 /bin/busybox 0048a000-0048b000 rwxp 0007a000 1f:03 1825 /bin/busybox 77ed0000-77ef5000 r-xp 00000000 1f:03 2298 /lib/libgcc_s.so.1 77ef5000-77ef6000 rwxp 00015000 1f:03 2298 /lib/libgcc_s.so.1 77ef6000-77f89000 r-xp 00000000 1f:03 2474 /lib/libc.so 77f98000-77f9a000 rwxp 00092000 1f:03 2474 /lib/libc.so 77f9a000-77f9c000 rwxp 00000000 00:00 0 7fbed000-7fc0e000 rw-p 00000000 00:00 0 [stack] 7fefb000-7fefc000 r-xp 00000000 00:00 0 7fff6000-7fff7000 r--p 00000000 00:00 0 [vvar] 7fff7000-7fff8000 r-xp 00000000 00:00 0 [vdso] Note lack of write permission to 7fefb000-7fefc000 Signed-off-by: Kevin Darbyshire-Bryant <ldir@darbyshire-bryant.me.uk>		2018-12-24 21:52:08 +00:00
..
010-Kbuild-don-t-hardcode-path-to-awk-in-scripts-ld-vers.patch	…
011-kbuild-export-SUBARCH.patch	kernel: bump 4.9 to 4.9.85	2018-03-03 12:58:55 +01:00
012-kbuild-add-macro-for-controlling-warnings-to-linux-c.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
013-disable-Wattribute-alias-warning-for-SYSCALL_DEFINEx.patch	kernel: backport fixes for GCC 8 errors in syscall definitions	2018-07-22 17:16:30 +02:00
020-backport_netfilter_rtcache.patch	…
021-bridge-multicast-to-unicast.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
022-net-add-devm-version-of-alloc_etherdev_mqs-function.patch	…
023-1-smsc95xx-Use-skb_cow_head-to-deal-with-cloned-skbs.patch	kernel: bump 4.9 to 4.9.143	2018-12-10 11:48:44 +01:00
023-6-ch9200-use-skb_cow_head-to-deal-with-cloned-skbs.patch	…
023-7-kaweth-use-skb_cow_head-to-deal-with-cloned-skbs.patch	…
024-1-tcp-tsq-add-tsq_flags-tsq_enum.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
024-2-tcp-tsq-remove-one-locked-operation-in-tcp_wfree.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
024-3-tcp-tsq-add-shortcut-in-tcp_tasklet_func.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
024-4-tcp-tsq-avoid-one-atomic-in-tcp_wfree.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
024-5-tcp-tsq-add-a-shortcut-in-tcp_small_queue_check.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
024-6-tcp-tcp_mtu_probe-is-likely-to-exit-early.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
024-7-net-reorganize-struct-sock-for-better-data-locality.patch	generic: net: tcp: backport tcp tx performance patches	2017-10-08 15:19:07 +03:00
024-8-tcp-tsq-move-tsq_flags-close-to-sk_wmem_alloc.patch	kernel: bump 4.9 to 4.9.146	2018-12-18 14:24:57 +01:00
024-9-tcp-add-a-missing-barrier-in-tcp_tasklet_func.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
025-tcp-allow-drivers-to-tweak-TSQ-logic.patch	kernel: bump 4.9 to 4.9.116	2018-08-01 09:46:59 +02:00
030-01-ubifs-Drop-softlimit-and-delta-fields-from-struct-ub.patch	…
030-02-ubifs-Use-dirty_writeback_interval-value-for-wbuf-ti.patch	…
040-mm-add-support-for-releasing-multiple-instances-of-a.patch	kernel: bump 4.9 to 4.9.145	2018-12-14 13:01:45 +01:00
041-mm-rename-__alloc_page_frag-to-page_frag_alloc-and-_.patch	kernel: bump 4.9 to 4.9.145	2018-12-14 13:01:45 +01:00
042-mm-rename-__page_frag-functions-to-__page_frag_cache.patch	kernel: bump 4.9 to 4.9.145	2018-12-14 13:01:45 +01:00
050-usb-dwc2-Remove-unnecessary-kfree.patch	kernel: bump 4.9 to 4.9.117	2018-08-03 16:10:38 +02:00
060-0002-mtd-bcm47xxsflash-use-platform_-set-get-_drvdata.patch	…
060-0003-mtd-bcm47xxsflash-support-reading-flash-out-of-mappi.patch	…
060-0004-mtd-bcm47xxpart-move-TRX-parsing-code-to-separated-f.patch	…
060-0005-mtd-bcm47xxpart-support-layouts-with-multiple-TRX-pa.patch	…
061-v4.10-0001-mtd-spi-nor-add-Macronix-mx25u25635f-to-list-of-know.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
061-v4.10-0002-mtd-spi-nor-fix-spansion-quad-enable.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
061-v4.10-0003-mtd-spi-nor-fix-flags-for-s25fl128s.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
061-v4.10-0004-mtd-spi-nor-add-support-for-s25fl208k.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
061-v4.10-0005-mtd-spi-nor-Add-at25df321-spi-nor-flash-support.patch	…
061-v4.10-0006-mtd-spi-nor-Add-support-for-N25Q016A.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
061-v4.10-0007-mtd-spi-nor-Add-support-for-mr25h40.patch	…
062-v4.11-0001-mtd-spi-nor-Add-support-for-S3AN-spi-nor-devices.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
062-v4.11-0002-mtd-spi-nor-improve-macronix_quad_enable.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
062-v4.11-0003-mtd-spi-nor-remove-WARN_ONCE-message-in-spi_nor_writ.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
062-v4.11-0004-mtd-spi-nor-rename-SPINOR_OP_-macros-of-the-4-byte-a.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
062-v4.11-0005-mtd-spi-nor-add-a-stateless-method-to-support-memory.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
062-v4.11-0006-mtd-spi-nor-Add-lock-unlock-support-for-f25l32pa.patch	…
062-v4.11-0007-mtd-spi-nor-Fix-S3AN-addressing-calculation.patch	…
062-v4.11-0008-mtd-spi-nor-Add-support-for-gd25q16.patch	…
063-v4.11-0001-mtd-nand-Add-Winbond-manufacturer-id.patch	kernel: order mtd backported patches by kernel release	2018-02-19 15:28:47 +01:00
063-v4.11-0002-mtd-introduce-function-max_bad_blocks.patch	kernel: order mtd backported patches by kernel release	2018-02-19 15:28:47 +01:00
063-v4.11-0003-mtd-Add-partition-device-node-to-mtd-partition-devic.patch	kernel: order mtd backported patches by kernel release	2018-02-19 15:28:47 +01:00
064-v4.12-mtd-spi-nor-enable-stateless-4b-op-codes-for-mx25u25.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
065-v4.13-0001-mtd-handle-partitioning-on-devices-with-0-erasesize.patch	…
065-v4.13-0002-mtd-partitions-factor-out-code-calling-parser.patch	…
065-v4.13-0003-mtd-partitions-add-helper-for-deleting-partition.patch	…
065-v4.13-0004-mtd-partitions-remove-sysfs-files-when-deleting-all-.patch	…
065-v4.13-0005-mtd-partitions-rename-master-to-the-parent-where-app.patch	…
065-v4.13-0006-mtd-partitions-add-support-for-subpartitions.patch	…
065-v4.13-0007-mtd-partitions-add-support-for-partition-parsers.patch	…
065-v4.13-0008-mtd-extract-TRX-parser-out-of-bcm47xxpart-into-a-sep.patch	…
066-v4.17-0001-mtd-move-code-adding-master-MTD-out-of-mtd_add_devic.patch	kernel: backport patches simplifying mtd_device_parse_register code	2018-02-19 16:01:44 +01:00
066-v4.17-0002-mtd-get-rid-of-the-mtd_add_device_partitions.patch	kernel: backport patches simplifying mtd_device_parse_register code	2018-02-19 16:01:44 +01:00
067-v4.17-0001-mtd-partitions-add-of_match_table-parser-matching-fo.patch	kernel: use accepted mtd patchset adding support for "compatible" string	2018-04-09 07:16:48 +02:00
067-v4.17-0002-mtd-rename-ofpart-parser-to-fixed-partitions-as-it-f.patch	kernel: use accepted mtd patchset adding support for "compatible" string	2018-04-09 07:16:48 +02:00
067-v4.17-0003-mtd-ofpart-add-of_match_table-with-fixed-partitions.patch	kernel: use accepted mtd patchset adding support for "compatible" string	2018-04-09 07:16:48 +02:00
068-v4.18-0001-mtd-move-code-adding-registering-partitions-to-the-p.patch	kernel: backport mtd patch for minor partitioning cleanup	2018-05-12 23:14:07 +02:00
069-v4.18-mtd-bcm47xxpart-improve-handling-TRX-partition-size.patch	kernel: use accepted version of bcm47xxpart fix commit	2018-05-12 23:53:44 +02:00
070-bcma-from-4.11.patch	…
071-v4.10-0001-net-bgmac-allocate-struct-bgmac-just-once-don-t-copy.patch	kernel: bump to 4.9.105	2018-06-01 08:25:14 +02:00
071-v4.10-0002-net-bgmac-drop-struct-bcma_mdio-we-don-t-need-anymor.patch	kernel: update kernel 4.9 to version 4.9.91	2018-03-31 16:31:26 +02:00
071-v4.10-0003-net-bgmac-use-PHY-subsystem-for-initializing-PHY.patch	…
071-v4.15-0001-net-bgmac-enable-master-mode-for-BCM54210E-and-B5021.patch	kernel: update kernel 4.9 to version 4.9.91	2018-03-31 16:31:26 +02:00
072-bcma-from-4.12.patch	…
075-v4.10-0001-net-phy-broadcom-Update-Auxiliary-Control-Register-m.patch	…
075-v4.10-0002-net-phy-broadcom-Add-support-for-BCM54612E.patch	…
075-v4.10-0003-net-phy-broadcom-add-bcm54xx_auxctl_read.patch	…
075-v4.10-0004-net-phy-broadcom-Add-BCM54810-PHY-entry.patch	…
075-v4.10-0005-net-phy-broadcom-Move-bcm54xx_auxctl_-read-write-to-.patch	kernel: bump 4.9 to 4.9.108	2018-06-18 07:10:19 +02:00
076-v4.11-0001-net-phy-broadcom-Allow-enabling-or-disabling-of-EEE.patch	kernel: bump 4.9 to 4.9.108	2018-06-18 07:10:19 +02:00
076-v4.11-0002-net-phy-broadcom-Add-support-code-for-reading-PHY-co.patch	kernel: bump 4.9 to 4.9.108	2018-06-18 07:10:19 +02:00
076-v4.11-0003-net-phy-bcm7xxx-Add-entry-for-BCM7278.patch	…
076-v4.11-0004-net-phy-bcm7xxx-Implement-EGPHY-workaround-for-7278.patch	…
076-v4.11-0005-net-phy-broadcom-use-auxctl-reading-helper-in-BCM546.patch	…
076-v4.11-0006-net-phy-broadcom-add-support-for-BCM54210E.patch	…
076-v4.11-0007-net-phy-broadcom-rehook-BCM54612E-specific-init.patch	…
076-v4.15-0001-net-phy-broadcom-support-new-device-flag-for-setting.patch	kernel: add fix for bgmac with B50212E B1 PHY	2017-10-13 13:54:22 +02:00
080-0001-leds-core-add-OF-variants-of-LED-registering-functio.patch	…
080-0002-leds-gpio-use-OF-variant-of-LED-registering-function.patch	…
081-0001-thermal-bcm2835-add-thermal-driver-for-bcm2835-SoC.patch	…
081-0002-thermal-broadcom-add-Northstar-thermal-driver.patch	…
082-0001-usb-core-read-USB-ports-from-DT-in-the-usbport-LED-t.patch	…
085-v4.16-0001-i2c-gpio-Enable-working-over-slow-can_sleep-GPIOs.patch	kernel: backport i2c-gpio working over slow can_sleep GPIOs	2018-09-10 09:28:55 +02:00
087-regmap-make-LZO-cache-optional.patch	…
090-net-generalize-napi_complete_done.patch	kernel: bump 4.9 to 4.9.145	2018-12-14 13:01:45 +01:00
092-netfilter-nf_tables-fix-mismatch-in-big-endian-syste.patch	kernel: backport fix for nftables on big Endian	2018-01-20 20:22:01 +01:00
094-v4.12-0001-ip6_tunnel-Fix-missing-tunnel-encapsulation-limit-op.patch	kernel: bump 4.9 to 4.9.137	2018-11-14 16:27:43 +01:00
094-v4.12-0002-ipv6-Need-to-export-ipv6_push_frag_opts-for-tunnelin.patch	kernel: re-add export ipv6_push_frag_opts for tunneling now patch	2018-06-01 14:08:42 +02:00
095-Allow-class-e-address-assignment-via-ifconfig-ioctl.patch	kernel: backport ifconfig ioctl support for class e addresses	2018-12-17 10:40:20 +00:00
095-v4.13-0001-rtc-ds1307-add-ds1308-variant.patch	kernel: backport rtc ds1308 support to 4.9	2018-09-10 09:19:44 +02:00
096-mips-math-emu-Write-protect-delay-slot-emulation-pages.patch	kernel: MIPS: math-emu Write-protect delay slot emulation pages	2018-12-24 21:52:08 +00:00
096-v4.20-netfilter-ipv6-Preserve-link-scope-traffic-original-.patch	kernel: preserve oif of IPv6 link scope packets	2018-12-17 21:42:23 +01:00
100-arm-cns3xxx-fix-writing-to-wrong-PCI-registers-after.patch	cns3xxx: fix writing to wrong PCI registers	2018-12-18 14:24:57 +01:00
272-uapi-if_ether.h-prevent-redefinition-of-struct-ethhd.patch	kernel: bump to 4.9.105	2018-06-01 08:25:14 +02:00
400-v4.16-leds-trigger-Introduce-a-NETDEV-trigger.patch	kernel: Replace ledtrig-netdev with upstream backport	2018-12-15 12:50:06 +01:00
400-v4.18-mtd-bcm47xxpart-add-of_match_table-with-a-new-DT-bin.patch	kernel: backport mtd patches with Broadcom of_match_table-s	2018-07-27 15:55:01 +02:00
401-v4.19-mtd-parsers-trx-add-of_match_table-with-the-new-DT-b.patch	kernel: backport mtd patches with Broadcom of_match_table-s	2018-07-27 15:55:01 +02:00
402-v4.19-mtd-partitions-use-DT-info-for-parsing-partitions-wi.patch	kernel: backport mtd support for subpartitions in DT	2018-07-27 22:16:24 +02:00
424-v4.20-net-dsa-fix-88e6060-roaming.patch	kernel: mv88e6060: disable hardware level MAC learning	2018-12-16 00:57:20 +01:00