diff options
| author | Paolo Bonzini <[email protected]> | 2024-09-14 13:32:13 +0000 |
|---|---|---|
| committer | Paolo Bonzini <[email protected]> | 2024-09-15 06:43:05 +0000 |
| commit | 091b2ecaa3081b8dee90c4fb31e782e8e3107a77 (patch) | |
| tree | e1ceb7ff6545709b26344cba562bb79f7c385d20 /security/selinux/hooks.c | |
| parent | KVM: x86: Use this_cpu_ptr() instead of per_cpu_ptr(smp_processor_id()) (diff) | |
| parent | Merge branch kvm-arm64/visibility-cleanups into kvmarm-master/next (diff) | |
| download | kernel-091b2ecaa3081b8dee90c4fb31e782e8e3107a77.tar.gz kernel-091b2ecaa3081b8dee90c4fb31e782e8e3107a77.zip | |
Merge tag 'kvmarm-6.12' of git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
KVM/arm64 updates for 6.12
* New features:
- Add a Stage-2 page table dumper, reusing the main ptdump
infrastructure, and allowing easier debugging of the our
page-table infrastructure
- Add FP8 support to the KVM/arm64 floating point handling.
- Add NV support for the AT family of instructions, which mostly
results in adding a page table walker that deals with most of the
complexity of the architecture.
* Improvements, fixes and cleanups:
- Add selftest checks for a bunch of timer emulation corner cases
- Fix the multiple of cases where KVM/arm64 doesn't correctly handle
the guest trying to use a GICv3 that isn't advertised
- Remove REG_HIDDEN_USER from the sysreg infrastructure, making
things little more simple
- Prevent MTE tags being restored by userspace if we are actively
logging writes, as that's a recipe for disaster
- Correct the refcount on a page that is not considered for MTE tag
copying (such as a device)
- Relax the synchronisation when walking a page table to split block
mappings, moving it at the end the walk, as there is no need to
perform it on every store.
- Fix boundary check when transfering memory using FFA
- Fix pKVM TLB invalidation, only affecting currently out of tree
code but worth addressing for peace of mind
Diffstat (limited to 'security/selinux/hooks.c')
| -rw-r--r-- | security/selinux/hooks.c | 12 |
1 files changed, 11 insertions, 1 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 55c78c318ccd..bfa61e005aac 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3852,7 +3852,17 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, if (default_noexec && (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) { int rc = 0; - if (vma_is_initial_heap(vma)) { + /* + * We don't use the vma_is_initial_heap() helper as it has + * a history of problems and is currently broken on systems + * where there is no heap, e.g. brk == start_brk. Before + * replacing the conditional below with vma_is_initial_heap(), + * or something similar, please ensure that the logic is the + * same as what we have below or you have tested every possible + * corner case you can think to test. + */ + if (vma->vm_start >= vma->vm_mm->start_brk && + vma->vm_end <= vma->vm_mm->brk) { rc = avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__EXECHEAP, NULL); } else if (!vma->vm_file && (vma_is_initial_stack(vma) || |