From patchwork Tue Dec 6 18:18:59 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Rutland X-Patchwork-Id: 86898 Delivered-To: patch@linaro.org Received: by 10.140.20.101 with SMTP id 92csp2157010qgi; Tue, 6 Dec 2016 10:19:52 -0800 (PST) X-Received: by 10.98.98.66 with SMTP id w63mr65037027pfb.84.1481048392574; Tue, 06 Dec 2016 10:19:52 -0800 (PST) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 92si20406749plc.147.2016.12.06.10.19.52; Tue, 06 Dec 2016 10:19:52 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752630AbcLFSTt (ORCPT + 25 others); Tue, 6 Dec 2016 13:19:49 -0500 Received: from foss.arm.com ([217.140.101.70]:49928 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751598AbcLFSTr (ORCPT ); Tue, 6 Dec 2016 13:19:47 -0500 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 5B4C71597; Tue, 6 Dec 2016 10:19:47 -0800 (PST) Received: from leverpostej (usa-sjc-imap-foss1.foss.arm.com [10.72.51.249]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 1D2963F220; Tue, 6 Dec 2016 10:19:44 -0800 (PST) Date: Tue, 6 Dec 2016 18:18:59 +0000 From: Mark Rutland To: Kees Cook Cc: Laura Abbott , Ard Biesheuvel , Will Deacon , Catalin Marinas , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , "x86@kernel.org" , LKML , Linux-MM , Andrew Morton , Marek Szyprowski , Joonsoo Kim , "linux-arm-kernel@lists.infradead.org" Subject: Re: [PATCHv4 09/10] mm/usercopy: Switch to using lm_alias Message-ID: <20161206181859.GH24177@leverpostej> References: <1480445729-27130-1-git-send-email-labbott@redhat.com> <1480445729-27130-10-git-send-email-labbott@redhat.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Nov 29, 2016 at 11:39:44AM -0800, Kees Cook wrote: > On Tue, Nov 29, 2016 at 10:55 AM, Laura Abbott wrote: > > > > The usercopy checking code currently calls __va(__pa(...)) to check for > > aliases on symbols. Switch to using lm_alias instead. > > > > Signed-off-by: Laura Abbott > > Acked-by: Kees Cook > > I should probably add a corresponding alias test to lkdtm... > > -Kees Something like the below? It uses lm_alias(), so it depends on Laura's patches. We seem to do the right thing, anyhow: root@ribbensteg:/home/nanook# echo USERCOPY_KERNEL_ALIAS > /sys/kernel/debug/provoke-crash/DIRECT [ 44.493400] usercopy: kernel memory exposure attempt detected from ffff80000031a730 () (4096 bytes) [ 44.504263] kernel BUG at mm/usercopy.c:75! Thanks, Mark. ---->8---- Acked-by: Kees Cook diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h index fdf954c..96d8d76 100644 --- a/drivers/misc/lkdtm.h +++ b/drivers/misc/lkdtm.h @@ -56,5 +56,6 @@ void lkdtm_USERCOPY_STACK_FRAME_FROM(void); void lkdtm_USERCOPY_STACK_BEYOND(void); void lkdtm_USERCOPY_KERNEL(void); +void lkdtm_USERCOPY_KERNEL_ALIAS(void); #endif diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index f9154b8..f6bc6d6 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -228,6 +228,7 @@ struct crashtype crashtypes[] = { CRASHTYPE(USERCOPY_STACK_FRAME_FROM), CRASHTYPE(USERCOPY_STACK_BEYOND), CRASHTYPE(USERCOPY_KERNEL), + CRASHTYPE(USERCOPY_KERNEL_ALIAS), }; diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c index 1dd6114..955f2dc 100644 --- a/drivers/misc/lkdtm_usercopy.c +++ b/drivers/misc/lkdtm_usercopy.c @@ -279,9 +279,16 @@ void lkdtm_USERCOPY_STACK_BEYOND(void) do_usercopy_stack(true, false); } -void lkdtm_USERCOPY_KERNEL(void) +static void do_usercopy_kernel(bool use_alias) { unsigned long user_addr; + const void *rodata = test_text; + void *text = vm_mmap; + + if (use_alias) { + rodata = lm_alias(rodata); + text = lm_alias(text); + } user_addr = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, @@ -292,14 +299,14 @@ void lkdtm_USERCOPY_KERNEL(void) } pr_info("attempting good copy_to_user from kernel rodata\n"); - if (copy_to_user((void __user *)user_addr, test_text, + if (copy_to_user((void __user *)user_addr, rodata, unconst + sizeof(test_text))) { pr_warn("copy_to_user failed unexpectedly?!\n"); goto free_user; } pr_info("attempting bad copy_to_user from kernel text\n"); - if (copy_to_user((void __user *)user_addr, vm_mmap, + if (copy_to_user((void __user *)user_addr, text, unconst + PAGE_SIZE)) { pr_warn("copy_to_user failed, but lacked Oops\n"); goto free_user; @@ -309,6 +316,16 @@ void lkdtm_USERCOPY_KERNEL(void) vm_munmap(user_addr, PAGE_SIZE); } +void lkdtm_USERCOPY_KERNEL(void) +{ + do_usercopy_kernel(false); +} + +void lkdtm_USERCOPY_KERNEL_ALIAS(void) +{ + do_usercopy_kernel(true); +} + void __init lkdtm_usercopy_init(void) { /* Prepare cache that lacks SLAB_USERCOPY flag. */