From 61e69ea2ab8dc14dca1b168cd040b835ff221cd7 Mon Sep 17 00:00:00 2001 From: Joerg Roedel Date: Mon, 16 Apr 2018 11:43:57 +0200 Subject: [PATCH] x86/ldt: Fix support_pte_mask filtering in map_ldt_struct() The |= operator will let us end up with an invalid PTE. Use the correct &= instead. [ The bug was also independently reported by Shuah Khan ] Fixes: 3a5484af8fcc ('x86/mm: Do not auto-massage page protections') Acked-by: Andy Lutomirski Acked-by: Dave Hansen Signed-off-by: Joerg Roedel Signed-off-by: Linus Torvalds --- arch/x86/kernel/ldt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c index d41d896481b84..c9b14020f4ddf 100644 --- a/arch/x86/kernel/ldt.c +++ b/arch/x86/kernel/ldt.c @@ -166,7 +166,7 @@ map_ldt_struct(struct mm_struct *mm, struct ldt_struct *ldt, int slot) */ pte_prot = __pgprot(__PAGE_KERNEL_RO & ~_PAGE_GLOBAL); /* Filter out unsuppored __PAGE_KERNEL* bits: */ - pgprot_val(pte_prot) |= __supported_pte_mask; + pgprot_val(pte_prot) &= __supported_pte_mask; pte = pfn_pte(pfn, pte_prot); set_pte_at(mm, va, ptep, pte); pte_unmap_unlock(ptep, ptl); -- 2.39.5