Dan Williams ece3a3337c /dev/mem: Revoke mappings when a driver claims the region ... [ Upstream commit 3234ac664a ] Close the hole of holding a mapping over kernel driver takeover event of a given address range. Commit 90a545e981 ("restrict /dev/mem to idle io memory ranges") introduced CONFIG_IO_STRICT_DEVMEM with the goal of protecting the kernel against scenarios where a /dev/mem user tramples memory that a kernel driver owns. However, this protection only prevents *new* read(), write() and mmap() requests. Established mappings prior to the driver calling request_mem_region() are left alone. Especially with persistent memory, and the core kernel metadata that is stored there, there are plentiful scenarios for a /dev/mem user to violate the expectations of the driver and cause amplified damage. Teach request_mem_region() to find and shoot down active /dev/mem mappings that it believes it has successfully claimed for the exclusive use of the driver. Effectively a driver call to request_mem_region() becomes a hole-punch on the /dev/mem device. The typical usage of unmap_mapping_range() is part of truncate_pagecache() to punch a hole in a file, but in this case the implementation is only doing the "first half" of a hole punch. Namely it is just evacuating current established mappings of the "hole", and it relies on the fact that /dev/mem establishes mappings in terms of absolute physical address offsets. Once existing mmap users are invalidated they can attempt to re-establish the mapping, or attempt to continue issuing read(2) / write(2) to the invalidated extent, but they will then be subject to the CONFIG_IO_STRICT_DEVMEM checking that can block those subsequent accesses. Cc: Arnd Bergmann <arnd@arndb.de> Cc: Ingo Molnar <mingo@redhat.com> Cc: Kees Cook <keescook@chromium.org> Cc: Matthew Wilcox <willy@infradead.org> Cc: Russell King <linux@arm.linux.org.uk> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Fixes: 90a545e981 ("restrict /dev/mem to idle io memory ranges") Signed-off-by: Dan Williams <dan.j.williams@intel.com> Reviewed-by: Kees Cook <keescook@chromium.org> Link: https://lore.kernel.org/r/159009507306.847224.8502634072429766747.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2020-06-24 17:50:35 +02:00
..
acpi	x86: ACPI: fix CPU hotplug deadlock	2020-04-23 10:36:38 +02:00
asm-generic	bpf: Support llvm-objcopy for vmlinux BTF	2020-06-17 16:40:20 +02:00
clocksource
crypto	crypto: algif_skcipher - Use chunksize instead of blocksize	2020-01-17 19:48:46 +01:00
drm	drm/bridge: analogix_dp: Split bind() into probe() and real bind()	2020-05-10 10:31:22 +02:00
dt-bindings	clk: imx8mn: Fix incorrect clock defines	2020-03-18 07:17:55 +01:00
keys	KEYS: Don't write out to userspace while holding key semaphore	2020-04-23 10:36:45 +02:00
kvm
linux	/dev/mem: Revoke mappings when a driver claims the region	2020-06-24 17:50:35 +02:00
math-emu
media	media: rc: add keymap for Videostrong KII Pro	2020-04-17 10:49:59 +02:00
misc
net	bpf: Fix running sk_skb program types with ktls	2020-06-22 09:31:12 +02:00
pcmcia
ras
rdma	RDMA/core: Fix double destruction of uobject	2020-06-03 08:21:25 +02:00
scsi	scsi: Revert "target: iscsi: Wait for all commands to finish before freeing a session"	2020-02-28 17:22:25 +01:00
soc	Char/Misc driver patches for 5.4-rc1	2019-09-18 11:14:31 -07:00
sound	ALSA: hda: Manage concurrent reg access more properly	2020-05-27 17:46:37 +02:00
target	scsi: target: fix hang when multiple threads try to destroy the same iscsi session	2020-04-21 09:05:04 +02:00
trace	rxrpc: Trace discarded ACKs	2020-05-27 17:46:51 +02:00
uapi	/dev/mem: Revoke mappings when a driver claims the region	2020-06-24 17:50:35 +02:00
vdso
video
xen	xen: fixes and cleanups for 5.4-rc2	2019-10-04 11:13:09 -07:00