x86/nmi: Fix NMI uaccess race against CR3 switching
authorAndy Lutomirski <[email protected]>
Wed, 29 Aug 2018 15:47:18 +0000 (08:47 -0700)
committerThomas Gleixner <[email protected]>
Fri, 31 Aug 2018 15:08:22 +0000 (17:08 +0200)
commit4012e77a903d114f915fc607d6d2ed54a3d6c9b1
treeaa56d63db999604dd3004855996dca36c293e1cf
parent829fe4aa9ac16417a904ad1de1307de906854bcf
x86/nmi: Fix NMI uaccess race against CR3 switching

A NMI can hit in the middle of context switching or in the middle of
switch_mm_irqs_off().  In either case, CR3 might not match current->mm,
which could cause copy_from_user_nmi() and friends to read the wrong
memory.

Fix it by adding a new nmi_uaccess_okay() helper and checking it in
copy_from_user_nmi() and in __copy_from_user_nmi()'s callers.

Signed-off-by: Andy Lutomirski <[email protected]>
Signed-off-by: Thomas Gleixner <[email protected]>
Reviewed-by: Rik van Riel <[email protected]>
Cc: Nadav Amit <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Jann Horn <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: [email protected]
Link: https://lkml.kernel.org/r/dd956eba16646fd0b15c3c0741269dfd84452dac.1535557289.git.luto@kernel.org
arch/x86/events/core.c
arch/x86/include/asm/tlbflush.h
arch/x86/lib/usercopy.c
arch/x86/mm/tlb.c