Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1437990

[PATCH 01/12] lkdtm: add usercopy test for blocking kernel text

Show all headers | View raw

The upcoming HARDENED_USERCOPY checks will also block access to the
kernel text, so provide a test for this as well.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
 drivers/misc/lkdtm_core.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index a595a6f2615a..23d222a6c77d 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -47,6 +47,7 @@
 #include <linux/vmalloc.h>
 #include <linux/mman.h>
 #include <asm/cacheflush.h>
+#include <asm/sections.h>
 
 #ifdef CONFIG_IDE
 #include <linux/ide.h>
@@ -120,6 +121,7 @@ enum ctype {
 	CT_USERCOPY_STACK_FRAME_TO,
 	CT_USERCOPY_STACK_FRAME_FROM,
 	CT_USERCOPY_STACK_BEYOND,
+	CT_USERCOPY_KERNEL,
 };
 
 static char* cp_name[] = {
@@ -171,6 +173,7 @@ static char* cp_type[] = {
 	"USERCOPY_STACK_FRAME_TO",
 	"USERCOPY_STACK_FRAME_FROM",
 	"USERCOPY_STACK_BEYOND",
+	"USERCOPY_KERNEL",
 };
 
 static struct jprobe lkdtm;
@@ -495,6 +498,35 @@ free_user:
 	vm_munmap(user_addr, PAGE_SIZE);
 }
 
+static void do_usercopy_kernel(void)
+{
+	unsigned long user_addr;
+
+	user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
+			    PROT_READ | PROT_WRITE | PROT_EXEC,
+			    MAP_ANONYMOUS | MAP_PRIVATE, 0);
+	if (user_addr >= TASK_SIZE) {
+		pr_warn("Failed to allocate user memory\n");
+		return;
+	}
+
+	pr_info("attempting good copy_to_user from kernel rodata\n");
+	if (copy_to_user((void __user *)user_addr, test_text,
+			 sizeof(test_text))) {
+		pr_warn("copy_to_user failed unexpectedly?!\n");
+		goto free_user;
+	}
+
+	pr_info("attempting bad copy_to_user from kernel text\n");
+	if (copy_to_user((void __user *)user_addr, _stext, PAGE_SIZE)) {
+		pr_warn("copy_to_user failed, but lacked Oops\n");
+		goto free_user;
+	}
+
+free_user:
+	vm_munmap(user_addr, PAGE_SIZE);
+}
+
 static void do_usercopy_heap_size(bool to_user)
 {
 	unsigned long user_addr;
@@ -957,6 +989,9 @@ static void lkdtm_do_action(enum ctype which)
 	case CT_USERCOPY_STACK_BEYOND:
 		do_usercopy_stack(true, false);
 		break;
+	case CT_USERCOPY_KERNEL:
+		do_usercopy_kernel();
+		break;
 	case CT_NONE:
 	default:
 		break;
-- 
2.7.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 00/12] lkdtm: use struct arrays instead of enums Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 07/12] lkdtm: remove intentional off-by-one array access Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 09/12] lkdtm: rename globals for clarity Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 05/12] lkdtm: split heap corruption tests to separate file Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 04/12] lkdtm: split memory permissions tests to separate file Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 08/12] lkdtm: rename "count" to "crash_count" Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 03/12] lkdtm: split usercopy tests to separate file Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 06/12] lkdtm: split remaining logic bug tests to separate file Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 01/12] lkdtm: add usercopy test for blocking kernel text Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 11/12] lkdtm: move jprobe entry points to start of source Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 10/12] lkdtm: reorganize module paramaters Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 02/12] lkdtm: drop "alloc_size" parameter Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200
  [PATCH 12/12] lkdtm: use struct arrays instead of enums Kees Cook <keescook@chromium.org> - 2016-07-07 00:40 +0200

csiph-web