Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1537257
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCHv4 09/10] mm/usercopy: Switch to using lm_alias |
| Date | 2016-12-06 21:20 +0100 |
| Message-ID | <sLunv-6LC-5@gated-at.bofh.it> (permalink) |
| References | <sIVNf-3Mq-3@gated-at.bofh.it> <sIVNg-3Mq-37@gated-at.bofh.it> <sIWpZ-4eA-39@gated-at.bofh.it> <sLsvo-5zJ-11@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Tue, Dec 6, 2016 at 10:18 AM, Mark Rutland <mark.rutland@arm.com> wrote:
> On Tue, Nov 29, 2016 at 11:39:44AM -0800, Kees Cook wrote:
>> On Tue, Nov 29, 2016 at 10:55 AM, Laura Abbott <labbott@redhat.com> wrote:
>> >
>> > The usercopy checking code currently calls __va(__pa(...)) to check for
>> > aliases on symbols. Switch to using lm_alias instead.
>> >
>> > Signed-off-by: Laura Abbott <labbott@redhat.com>
>>
>> Acked-by: Kees Cook <keescook@chromium.org>
>>
>> I should probably add a corresponding alias test to lkdtm...
>>
>> -Kees
>
> Something like the below?
>
> It uses lm_alias(), so it depends on Laura's patches. We seem to do the
> right thing, anyhow:
Cool, this looks good. What happens on systems without an alias?
Laura, feel free to add this to your series:
Acked-by: Kees Cook <keescook@chromium.org>
-Kees
>
> root@ribbensteg:/home/nanook# echo USERCOPY_KERNEL_ALIAS > /sys/kernel/debug/provoke-crash/DIRECT
> [ 44.493400] usercopy: kernel memory exposure attempt detected from ffff80000031a730 (<linear kernel text>) (4096 bytes)
> [ 44.504263] kernel BUG at mm/usercopy.c:75!
>
> Thanks,
> Mark.
>
> ---->8----
> diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
> index fdf954c..96d8d76 100644
> --- a/drivers/misc/lkdtm.h
> +++ b/drivers/misc/lkdtm.h
> @@ -56,5 +56,6 @@
> void lkdtm_USERCOPY_STACK_FRAME_FROM(void);
> void lkdtm_USERCOPY_STACK_BEYOND(void);
> void lkdtm_USERCOPY_KERNEL(void);
> +void lkdtm_USERCOPY_KERNEL_ALIAS(void);
>
> #endif
> diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
> index f9154b8..f6bc6d6 100644
> --- a/drivers/misc/lkdtm_core.c
> +++ b/drivers/misc/lkdtm_core.c
> @@ -228,6 +228,7 @@ struct crashtype crashtypes[] = {
> CRASHTYPE(USERCOPY_STACK_FRAME_FROM),
> CRASHTYPE(USERCOPY_STACK_BEYOND),
> CRASHTYPE(USERCOPY_KERNEL),
> + CRASHTYPE(USERCOPY_KERNEL_ALIAS),
> };
>
>
> diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
> index 1dd6114..955f2dc 100644
> --- a/drivers/misc/lkdtm_usercopy.c
> +++ b/drivers/misc/lkdtm_usercopy.c
> @@ -279,9 +279,16 @@ void lkdtm_USERCOPY_STACK_BEYOND(void)
> do_usercopy_stack(true, false);
> }
>
> -void lkdtm_USERCOPY_KERNEL(void)
> +static void do_usercopy_kernel(bool use_alias)
> {
> unsigned long user_addr;
> + const void *rodata = test_text;
> + void *text = vm_mmap;
> +
> + if (use_alias) {
> + rodata = lm_alias(rodata);
> + text = lm_alias(text);
> + }
>
> user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
> PROT_READ | PROT_WRITE | PROT_EXEC,
> @@ -292,14 +299,14 @@ void lkdtm_USERCOPY_KERNEL(void)
> }
>
> pr_info("attempting good copy_to_user from kernel rodata\n");
> - if (copy_to_user((void __user *)user_addr, test_text,
> + if (copy_to_user((void __user *)user_addr, rodata,
> unconst + sizeof(test_text))) {
> pr_warn("copy_to_user failed unexpectedly?!\n");
> goto free_user;
> }
>
> pr_info("attempting bad copy_to_user from kernel text\n");
> - if (copy_to_user((void __user *)user_addr, vm_mmap,
> + if (copy_to_user((void __user *)user_addr, text,
> unconst + PAGE_SIZE)) {
> pr_warn("copy_to_user failed, but lacked Oops\n");
> goto free_user;
> @@ -309,6 +316,16 @@ void lkdtm_USERCOPY_KERNEL(void)
> vm_munmap(user_addr, PAGE_SIZE);
> }
>
> +void lkdtm_USERCOPY_KERNEL(void)
> +{
> + do_usercopy_kernel(false);
> +}
> +
> +void lkdtm_USERCOPY_KERNEL_ALIAS(void)
> +{
> + do_usercopy_kernel(true);
> +}
> +
> void __init lkdtm_usercopy_init(void)
> {
> /* Prepare cache that lacks SLAB_USERCOPY flag. */
--
Kees Cook
Nexus Security
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCHv4 00/10] CONFIG_DEBUG_VIRTUAL for arm64 Laura Abbott <labbott@redhat.com> - 2016-11-29 20:00 +0100
[PATCHv4 09/10] mm/usercopy: Switch to using lm_alias Laura Abbott <labbott@redhat.com> - 2016-11-29 20:00 +0100
Re: [PATCHv4 09/10] mm/usercopy: Switch to using lm_alias Kees Cook <keescook@chromium.org> - 2016-11-29 20:40 +0100
Re: [PATCHv4 09/10] mm/usercopy: Switch to using lm_alias Mark Rutland <mark.rutland@arm.com> - 2016-12-06 19:20 +0100
Re: [PATCHv4 09/10] mm/usercopy: Switch to using lm_alias Kees Cook <keescook@chromium.org> - 2016-12-06 21:20 +0100
Re: [PATCHv4 09/10] mm/usercopy: Switch to using lm_alias Mark Rutland <mark.rutland@arm.com> - 2016-12-07 15:00 +0100
Re: [PATCHv4 09/10] mm/usercopy: Switch to using lm_alias Mark Rutland <mark.rutland@arm.com> - 2016-12-06 19:30 +0100
[PATCHv4 10/10] arm64: Add support for CONFIG_DEBUG_VIRTUAL Laura Abbott <labbott@redhat.com> - 2016-11-29 20:00 +0100
Re: [PATCHv4 10/10] arm64: Add support for CONFIG_DEBUG_VIRTUAL Mark Rutland <mark.rutland@arm.com> - 2016-12-06 20:00 +0100
[PATCHv4 08/10] mm/kasan: Switch to using __pa_symbol and lm_alias Laura Abbott <labbott@redhat.com> - 2016-11-29 20:00 +0100
Re: [PATCHv4 08/10] mm/kasan: Switch to using __pa_symbol and lm_alias Laura Abbott <labbott@redhat.com> - 2016-12-01 20:20 +0100
Re: [PATCHv4 08/10] mm/kasan: Switch to using __pa_symbol and lm_alias Mark Rutland <mark.rutland@arm.com> - 2016-12-06 18:30 +0100
Re: [PATCHv4 08/10] mm/kasan: Switch to using __pa_symbol and lm_alias Mark Rutland <mark.rutland@arm.com> - 2016-12-06 18:50 +0100
Re: [PATCHv4 08/10] mm/kasan: Switch to using __pa_symbol and lm_alias Mark Rutland <mark.rutland@arm.com> - 2016-12-06 20:30 +0100
[PATCHv4 06/10] xen: Switch to using __pa_symbol Laura Abbott <labbott@redhat.com> - 2016-11-29 20:00 +0100
Re: [PATCHv4 06/10] xen: Switch to using __pa_symbol Boris Ostrovsky <boris.ostrovsky@oracle.com> - 2016-11-29 23:30 +0100
Re: [PATCHv4 06/10] xen: Switch to using __pa_symbol Laura Abbott <labbott@redhat.com> - 2016-11-29 23:50 +0100
[PATCH 0/3] ARM: Add support for CONFIG_DEBUG_VIRTUAL Florian Fainelli <f.fainelli@gmail.com> - 2016-12-06 21:00 +0100
[PATCH 3/3] ARM: Add support for CONFIG_DEBUG_VIRTUAL Florian Fainelli <f.fainelli@gmail.com> - 2016-12-06 21:00 +0100
Re: [PATCH 3/3] ARM: Add support for CONFIG_DEBUG_VIRTUAL Florian Fainelli <f.fainelli@gmail.com> - 2016-12-06 21:50 +0100
Re: [PATCH 3/3] ARM: Add support for CONFIG_DEBUG_VIRTUAL Laura Abbott <labbott@redhat.com> - 2016-12-07 03:10 +0100
Re: [PATCH 3/3] ARM: Add support for CONFIG_DEBUG_VIRTUAL Florian Fainelli <f.fainelli@gmail.com> - 2016-12-07 03:30 +0100
[PATCH 2/3] ARM: Utilize __pa_symbol in lieu of __pa Florian Fainelli <f.fainelli@gmail.com> - 2016-12-06 21:00 +0100
[PATCH 1/3] ARM: Define KERNEL_START and KERNEL_END Florian Fainelli <f.fainelli@gmail.com> - 2016-12-06 21:00 +0100
Re: [PATCH 1/3] ARM: Define KERNEL_START and KERNEL_END Florian Fainelli <f.fainelli@gmail.com> - 2016-12-06 23:50 +0100
RE: [PATCH 1/3] ARM: Define KERNEL_START and KERNEL_END Chris Brandt <Chris.Brandt@renesas.com> - 2016-12-06 23:50 +0100
Re: [PATCH 1/3] ARM: Define KERNEL_START and KERNEL_END kbuild test robot <lkp@intel.com> - 2016-12-07 07:20 +0100
csiph-web