[lkml]   [2019]   [Jan]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 1/2] x86/pkeys: properly copy pkey state at fork()

From: Dave Hansen <>

Memory protection key behavior should be the same in a child as it was
in the parent before a fork. But, there is a bug that resets the
state in the child at fork instead of preserving it.

Our creation of new mm's is a bit convoluted. At fork(), the code

1. memcpy() the parent mm to initialize child
2. mm_init() to initalize some select stuff stuff
3. dup_mmap() to create true copies that memcpy()
did not do right.

For pkeys, we need to preserve two bits of state across a fork:
'execute_only_pkey' and 'pkey_allocation_map'. Those are preserved by
the memcpy(), which I thought did the right thing. But, mm_init()
calls init_new_context(), which I thought was *only* for execve()-time
and overwrites 'execute_only_pkey' and 'pkey_allocation_map' with
"new" values. But, alas, init_new_context() is used at execve() and

The result is that, after a fork(), the child's pkey state ends up
looking like it does after an execve(), which is totally wrong. pkeys
that are already allocated can be allocated again, for instance.

To fix this, add code called by dup_mmap() to copy the pkey state from
parent to child explicitly. Also add a comment above init_new_context()
to make it more clear to the next poor sod what this code is used for.

Fixes: e8c24d3a23a ("x86/pkeys: Allocation/free syscalls")
Signed-off-by: Dave Hansen <>
Reviewed-by: Thomas Gleixner <>
Cc: Ingo Molnar <>
Cc: Borislav Petkov <>
Cc: "H. Peter Anvin" <>
Cc: Dave Hansen <>
Cc: Peter Zijlstra <>
Cc: Michael Ellerman <>
Cc: Will Deacon <>
Cc: Andy Lutomirski <>
Cc: Joerg Roedel <>

b/arch/x86/include/asm/mmu_context.h | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)

diff -puN arch/x86/include/asm/mmu_context.h~x86-pkeys-no-init-at-fork arch/x86/include/asm/mmu_context.h
--- a/arch/x86/include/asm/mmu_context.h~x86-pkeys-no-init-at-fork 2019-01-02 13:53:53.217951966 -0800
+++ b/arch/x86/include/asm/mmu_context.h 2019-01-02 13:53:53.221951966 -0800
@@ -178,6 +178,10 @@ static inline void switch_ldt(struct mm_

void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk);

+ * Init a new mm. Used on mm copies, like at fork()
+ * and on mm's that are brand-new, like at execve().
+ */
static inline int init_new_context(struct task_struct *tsk,
struct mm_struct *mm)
@@ -228,8 +232,22 @@ do { \
} while (0)

+static inline void arch_dup_pkeys(struct mm_struct *oldmm,
+ struct mm_struct *mm)
+ if (!cpu_feature_enabled(X86_FEATURE_OSPKE))
+ return;
+ /* Duplicate the oldmm pkey state in mm: */
+ mm->context.pkey_allocation_map = oldmm->context.pkey_allocation_map;
+ mm->context.execute_only_pkey = oldmm->context.execute_only_pkey;
static inline int arch_dup_mmap(struct mm_struct *oldmm, struct mm_struct *mm)
+ arch_dup_pkeys(oldmm, mm);
paravirt_arch_dup_mmap(oldmm, mm);
return ldt_dup_context(oldmm, mm);
 \ /
  Last update: 2019-01-02 23:03    [W:0.117 / U:1.836 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site