diff for duplicates of <1468032243.13253.59.camel@redhat.com> diff --git a/a/content_digest b/N1/content_digest index fab7471..941667e 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,7 +1,7 @@ "ref\01467843928-29351-1-git-send-email-keescook@chromium.org\0" "ref\0b113b487-acc6-24b8-d58c-425d3c884f4c@redhat.com\0" "From\0Rik van Riel <riel@redhat.com>\0" - "Subject\0[kernel-hardening] Re: [PATCH 0/9] mm: Hardened usercopy\0" + "Subject\0Re: [PATCH 0/9] mm: Hardened usercopy\0" "Date\0Fri, 08 Jul 2016 22:44:03 -0400\0" "To\0Laura Abbott <labbott@redhat.com>" Kees Cook <keescook@chromium.org> @@ -29,16 +29,7 @@ Mathias Krause <minipli@googlemail.com> Jan Kara <jack@suse.cz> Vitaly Wool <vitalywool@gmail.com> - Andrea Arcangeli <aarcange@redhat.com> - Dmitry Vyukov <dvyukov@google.com> - Laura Abbott <labbott@fedoraproject.org> - linux-arm-kernel@lists.infradead.org - linux-ia64@vger.kernel.org - linuxppc-dev@lists.ozlabs.org - sparclinux@vger.kernel.org - linux-arch@vger.kernel.org - linux-mm@kvack.org - " kernel-hardening@lists.openwall.com\0" + " Andrea Arcangeli <aarcange@red>\0" "\01:1\0" "b\0" "On Fri, 2016-07-08 at 19:22 -0700, Laura Abbott wrote:\n" @@ -128,4 +119,4 @@ "=+yIR\n" "-----END PGP SIGNATURE-----\n" -4a1724550c1b22626f3e606726f23b211cd5b26646db81e0e1efae4947e8b8c7 +082158aa4bb2b2dec182a1b30d8f1044d3216120a06900f653c095acec84fddd
diff --git a/a/content_digest b/N2/content_digest index fab7471..3cb204e 100644 --- a/a/content_digest +++ b/N2/content_digest @@ -1,7 +1,7 @@ "ref\01467843928-29351-1-git-send-email-keescook@chromium.org\0" "ref\0b113b487-acc6-24b8-d58c-425d3c884f4c@redhat.com\0" "From\0Rik van Riel <riel@redhat.com>\0" - "Subject\0[kernel-hardening] Re: [PATCH 0/9] mm: Hardened usercopy\0" + "Subject\0Re: [PATCH 0/9] mm: Hardened usercopy\0" "Date\0Fri, 08 Jul 2016 22:44:03 -0400\0" "To\0Laura Abbott <labbott@redhat.com>" Kees Cook <keescook@chromium.org> @@ -128,4 +128,4 @@ "=+yIR\n" "-----END PGP SIGNATURE-----\n" -4a1724550c1b22626f3e606726f23b211cd5b26646db81e0e1efae4947e8b8c7 +5ace2098e194e6a92e5d74901681d67265e52e225bfb8fd684160326a9702578
diff --git a/a/content_digest b/N3/content_digest index fab7471..bffec97 100644 --- a/a/content_digest +++ b/N3/content_digest @@ -1,8 +1,8 @@ "ref\01467843928-29351-1-git-send-email-keescook@chromium.org\0" "ref\0b113b487-acc6-24b8-d58c-425d3c884f4c@redhat.com\0" "From\0Rik van Riel <riel@redhat.com>\0" - "Subject\0[kernel-hardening] Re: [PATCH 0/9] mm: Hardened usercopy\0" - "Date\0Fri, 08 Jul 2016 22:44:03 -0400\0" + "Subject\0Re: [PATCH 0/9] mm: Hardened usercopy\0" + "Date\0Sat, 09 Jul 2016 02:44:03 +0000\0" "To\0Laura Abbott <labbott@redhat.com>" Kees Cook <keescook@chromium.org> " linux-kernel@vger.kernel.org\0" @@ -128,4 +128,4 @@ "=+yIR\n" "-----END PGP SIGNATURE-----\n" -4a1724550c1b22626f3e606726f23b211cd5b26646db81e0e1efae4947e8b8c7 +99500385050e35c7e753db52b18b1157cfd12bb512747dc63fd0c37802dee96e
diff --git a/a/1.txt b/N4/1.txt index cae33cc..9bfed80 100644 --- a/a/1.txt +++ b/N4/1.txt @@ -1,28 +1,28 @@ On Fri, 2016-07-08 at 19:22 -0700, Laura Abbott wrote: -> +>? > Even with the SLUB fixup I'm still seeing this blow up on my arm64 > system. This is a > Fedora rawhide kernel + the patches > -> [ 0.666700] usercopy: kernel memory exposure attempt detected from +> [????0.666700] usercopy: kernel memory exposure attempt detected from > fffffc0008b4dd58 (<kernel text>) (8 bytes) -> [ 0.666720] CPU: 2 PID: 79 Comm: modprobe Tainted: -> G W 4.7.0-0.rc6.git1.1.hardenedusercopy.fc25.aarch64 #1 -> [ 0.666733] Hardware name: AppliedMicro Mustang/Mustang, BIOS +> [????0.666720] CPU: 2 PID: 79 Comm: modprobe Tainted: +> G????????W???????4.7.0-0.rc6.git1.1.hardenedusercopy.fc25.aarch64 #1 +> [????0.666733] Hardware name: AppliedMicro Mustang/Mustang, BIOS > 1.1.0 Nov 24 2015 -> [ 0.666744] Call trace: -> [ 0.666756] [<fffffc0008088a20>] dump_backtrace+0x0/0x1e8 -> [ 0.666765] [<fffffc0008088c2c>] show_stack+0x24/0x30 -> [ 0.666775] [<fffffc0008455344>] dump_stack+0xa4/0xe0 -> [ 0.666785] [<fffffc000828d874>] __check_object_size+0x6c/0x230 -> [ 0.666795] [<fffffc00083a5748>] create_elf_tables+0x74/0x420 -> [ 0.666805] [<fffffc00082fb1f0>] load_elf_binary+0x828/0xb70 -> [ 0.666814] [<fffffc0008298b4c>] search_binary_handler+0xb4/0x240 -> [ 0.666823] [<fffffc0008299864>] do_execveat_common+0x63c/0x950 -> [ 0.666832] [<fffffc0008299bb4>] do_execve+0x3c/0x50 -> [ 0.666841] [<fffffc00080e3720>] +> [????0.666744] Call trace: +> [????0.666756] [<fffffc0008088a20>] dump_backtrace+0x0/0x1e8 +> [????0.666765] [<fffffc0008088c2c>] show_stack+0x24/0x30 +> [????0.666775] [<fffffc0008455344>] dump_stack+0xa4/0xe0 +> [????0.666785] [<fffffc000828d874>] __check_object_size+0x6c/0x230 +> [????0.666795] [<fffffc00083a5748>] create_elf_tables+0x74/0x420 +> [????0.666805] [<fffffc00082fb1f0>] load_elf_binary+0x828/0xb70 +> [????0.666814] [<fffffc0008298b4c>] search_binary_handler+0xb4/0x240 +> [????0.666823] [<fffffc0008299864>] do_execveat_common+0x63c/0x950 +> [????0.666832] [<fffffc0008299bb4>] do_execve+0x3c/0x50 +> [????0.666841] [<fffffc00080e3720>] > call_usermodehelper_exec_async+0xe8/0x148 -> [ 0.666850] [<fffffc0008084a80>] ret_from_fork+0x10/0x50 +> [????0.666850] [<fffffc0008084a80>] ret_from_fork+0x10/0x50 > > This happens on every call to execve. This seems to be the first > copy_to_user in @@ -36,19 +36,19 @@ to userspace. from fs/binfmt_elf.c - const char *k_platform = ELF_PLATFORM; +? ? ? ? const char *k_platform = ELF_PLATFORM; ... - size_t len = strlen(k_platform) + 1; +? ? ? ? ? ? ? ? size_t len = strlen(k_platform) + 1; - u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); - if (__copy_to_user(u_platform, k_platform, len)) - return -EFAULT; +? ? ? ? ? ? ? ? u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len); +????????????????if (__copy_to_user(u_platform, k_platform, len)) +????????????????????????return -EFAULT; from arch/arm/include/asm/elf.h: #define ELF_PLATFORM_SIZE 8 -#define ELF_PLATFORM (elf_platform) +#define ELF_PLATFORM????(elf_platform) extern char elf_platform[]; @@ -59,13 +59,20 @@ EXPORT_SYMBOL(elf_platform); ... - snprintf(elf_platform, ELF_PLATFORM_SIZE, "%s%c", - list->elf_name, ENDIANNESS); +????????snprintf(elf_platform, ELF_PLATFORM_SIZE, "%s%c", +?????????????????list->elf_name, ENDIANNESS); How does that end up in the .text section of the image, instead of in one of the various data sections? What kind of linker oddity is going on with ARM? --- +--? All Rights Reversed. +-------------- next part -------------- +A non-text attachment was scrubbed... +Name: signature.asc +Type: application/pgp-signature +Size: 473 bytes +Desc: This is a digitally signed message part +URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20160708/488a1f5e/attachment.sig> diff --git a/a/2.bin b/a/2.bin deleted file mode 100644 index fe49d97..0000000 --- a/a/2.bin +++ /dev/null @@ -1,11 +0,0 @@ ------BEGIN PGP SIGNATURE----- -Version: GnuPG v2 - -iQEcBAABCAAGBQJXgGT0AAoJEM553pKExN6DH7wH/0znCffUzWBhau8KJMvAnoPK -2C47QOWO1LqeYiuIoC3yiTbqFOhHvoqLSNvBp6YmLJDnSDgYPI8/BYHsu4kLLI0e -yB0Gdczy2FQvfp5C3wvahbLkD8llhl/W4DOKfR7BtU3oUWHlQV00rz4qgV1H5uvf -7mied4PFhk8Eabnl1GDcyIm4YZN93P17xqQzYLDc7IL79I79f5wSysmjLGD/slIN -BP+5skId75PKMBrKkLdvD6y02VIgj0gILZyCsHlJRJ/LRfCmN1c9VXShmwd0FO0r -oWiYUCRSZePuKHGuJh67xJknHH7PVvvUDyCrRRSS0dqNO3I/0AD1v9yuyt2eX2E= -=+yIR ------END PGP SIGNATURE----- diff --git a/a/2.hdr b/a/2.hdr deleted file mode 100644 index da6d245..0000000 --- a/a/2.hdr +++ /dev/null @@ -1,3 +0,0 @@ -Content-Type: application/pgp-signature; name="signature.asc" -Content-Description: This is a digitally signed message part -Content-Transfer-Encoding: 7bit diff --git a/a/content_digest b/N4/content_digest index fab7471..809d020 100644 --- a/a/content_digest +++ b/N4/content_digest @@ -1,71 +1,36 @@ "ref\01467843928-29351-1-git-send-email-keescook@chromium.org\0" "ref\0b113b487-acc6-24b8-d58c-425d3c884f4c@redhat.com\0" - "From\0Rik van Riel <riel@redhat.com>\0" - "Subject\0[kernel-hardening] Re: [PATCH 0/9] mm: Hardened usercopy\0" + "From\0riel@redhat.com (Rik van Riel)\0" + "Subject\0[PATCH 0/9] mm: Hardened usercopy\0" "Date\0Fri, 08 Jul 2016 22:44:03 -0400\0" - "To\0Laura Abbott <labbott@redhat.com>" - Kees Cook <keescook@chromium.org> - " linux-kernel@vger.kernel.org\0" - "Cc\0Casey Schaufler <casey@schaufler-ca.com>" - PaX Team <pageexec@freemail.hu> - Brad Spengler <spender@grsecurity.net> - Russell King <linux@armlinux.org.uk> - Catalin Marinas <catalin.marinas@arm.com> - Will Deacon <will.deacon@arm.com> - Ard Biesheuvel <ard.biesheuvel@linaro.org> - Benjamin Herrenschmidt <benh@kernel.crashing.org> - Michael Ellerman <mpe@ellerman.id.au> - Tony Luck <tony.luck@intel.com> - Fenghua Yu <fenghua.yu@intel.com> - David S. Miller <davem@davemloft.net> - x86@kernel.org - Christoph Lameter <cl@linux.com> - Pekka Enberg <penberg@kernel.org> - David Rientjes <rientjes@google.com> - Joonsoo Kim <iamjoonsoo.kim@lge.com> - Andrew Morton <akpm@linux-foundation.org> - Andy Lutomirski <luto@kernel.org> - Borislav Petkov <bp@suse.de> - Mathias Krause <minipli@googlemail.com> - Jan Kara <jack@suse.cz> - Vitaly Wool <vitalywool@gmail.com> - Andrea Arcangeli <aarcange@redhat.com> - Dmitry Vyukov <dvyukov@google.com> - Laura Abbott <labbott@fedoraproject.org> - linux-arm-kernel@lists.infradead.org - linux-ia64@vger.kernel.org - linuxppc-dev@lists.ozlabs.org - sparclinux@vger.kernel.org - linux-arch@vger.kernel.org - linux-mm@kvack.org - " kernel-hardening@lists.openwall.com\0" - "\01:1\0" + "To\0linux-arm-kernel@lists.infradead.org\0" + "\00:1\0" "b\0" "On Fri, 2016-07-08 at 19:22 -0700, Laura Abbott wrote:\n" - ">\302\240\n" + ">?\n" "> Even with the SLUB fixup I'm still seeing this blow up on my arm64\n" "> system. This is a\n" "> Fedora rawhide kernel + the patches\n" "> \n" - "> [\302\240\302\240\302\240\302\2400.666700] usercopy: kernel memory exposure attempt detected from\n" + "> [????0.666700] usercopy: kernel memory exposure attempt detected from\n" "> fffffc0008b4dd58 (<kernel text>) (8 bytes)\n" - "> [\302\240\302\240\302\240\302\2400.666720] CPU: 2 PID: 79 Comm: modprobe Tainted:\n" - "> G\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240W\302\240\302\240\302\240\302\240\302\240\302\240\302\2404.7.0-0.rc6.git1.1.hardenedusercopy.fc25.aarch64 #1\n" - "> [\302\240\302\240\302\240\302\2400.666733] Hardware name: AppliedMicro Mustang/Mustang, BIOS\n" + "> [????0.666720] CPU: 2 PID: 79 Comm: modprobe Tainted:\n" + "> G????????W???????4.7.0-0.rc6.git1.1.hardenedusercopy.fc25.aarch64 #1\n" + "> [????0.666733] Hardware name: AppliedMicro Mustang/Mustang, BIOS\n" "> 1.1.0 Nov 24 2015\n" - "> [\302\240\302\240\302\240\302\2400.666744] Call trace:\n" - "> [\302\240\302\240\302\240\302\2400.666756] [<fffffc0008088a20>] dump_backtrace+0x0/0x1e8\n" - "> [\302\240\302\240\302\240\302\2400.666765] [<fffffc0008088c2c>] show_stack+0x24/0x30\n" - "> [\302\240\302\240\302\240\302\2400.666775] [<fffffc0008455344>] dump_stack+0xa4/0xe0\n" - "> [\302\240\302\240\302\240\302\2400.666785] [<fffffc000828d874>] __check_object_size+0x6c/0x230\n" - "> [\302\240\302\240\302\240\302\2400.666795] [<fffffc00083a5748>] create_elf_tables+0x74/0x420\n" - "> [\302\240\302\240\302\240\302\2400.666805] [<fffffc00082fb1f0>] load_elf_binary+0x828/0xb70\n" - "> [\302\240\302\240\302\240\302\2400.666814] [<fffffc0008298b4c>] search_binary_handler+0xb4/0x240\n" - "> [\302\240\302\240\302\240\302\2400.666823] [<fffffc0008299864>] do_execveat_common+0x63c/0x950\n" - "> [\302\240\302\240\302\240\302\2400.666832] [<fffffc0008299bb4>] do_execve+0x3c/0x50\n" - "> [\302\240\302\240\302\240\302\2400.666841] [<fffffc00080e3720>]\n" + "> [????0.666744] Call trace:\n" + "> [????0.666756] [<fffffc0008088a20>] dump_backtrace+0x0/0x1e8\n" + "> [????0.666765] [<fffffc0008088c2c>] show_stack+0x24/0x30\n" + "> [????0.666775] [<fffffc0008455344>] dump_stack+0xa4/0xe0\n" + "> [????0.666785] [<fffffc000828d874>] __check_object_size+0x6c/0x230\n" + "> [????0.666795] [<fffffc00083a5748>] create_elf_tables+0x74/0x420\n" + "> [????0.666805] [<fffffc00082fb1f0>] load_elf_binary+0x828/0xb70\n" + "> [????0.666814] [<fffffc0008298b4c>] search_binary_handler+0xb4/0x240\n" + "> [????0.666823] [<fffffc0008299864>] do_execveat_common+0x63c/0x950\n" + "> [????0.666832] [<fffffc0008299bb4>] do_execve+0x3c/0x50\n" + "> [????0.666841] [<fffffc00080e3720>]\n" "> call_usermodehelper_exec_async+0xe8/0x148\n" - "> [\302\240\302\240\302\240\302\2400.666850] [<fffffc0008084a80>] ret_from_fork+0x10/0x50\n" + "> [????0.666850] [<fffffc0008084a80>] ret_from_fork+0x10/0x50\n" "> \n" "> This happens on every call to execve. This seems to be the first\n" "> copy_to_user in\n" @@ -79,19 +44,19 @@ "\n" "from fs/binfmt_elf.c\n" "\n" - "\302\240 \302\240 \302\240 \302\240 const char *k_platform = ELF_PLATFORM;\n" + "? ? ? ? const char *k_platform = ELF_PLATFORM;\n" "\n" "...\n" - "\302\240 \302\240 \302\240 \302\240 \302\240 \302\240 \302\240 \302\240 size_t len = strlen(k_platform) + 1;\n" + "? ? ? ? ? ? ? ? size_t len = strlen(k_platform) + 1;\n" "\t\t\n" - "\302\240 \302\240 \302\240 \302\240 \302\240 \302\240 \302\240 \302\240 u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);\n" - "\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240if (__copy_to_user(u_platform, k_platform, len))\n" - "\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240return -EFAULT;\n" + "? ? ? ? ? ? ? ? u_platform = (elf_addr_t __user *)STACK_ALLOC(p, len);\n" + "????????????????if (__copy_to_user(u_platform, k_platform, len))\n" + "????????????????????????return -EFAULT;\n" "\n" "from arch/arm/include/asm/elf.h:\n" "\n" "#define ELF_PLATFORM_SIZE 8\n" - "#define ELF_PLATFORM\302\240\302\240\302\240\302\240(elf_platform)\n" + "#define ELF_PLATFORM????(elf_platform)\n" "\n" "extern char elf_platform[];\n" "\n" @@ -102,30 +67,22 @@ "\n" "...\n" "\n" - "\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240snprintf(elf_platform, ELF_PLATFORM_SIZE, \"%s%c\",\n" - "\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240\302\240list->elf_name, ENDIANNESS);\n" + "????????snprintf(elf_platform, ELF_PLATFORM_SIZE, \"%s%c\",\n" + "?????????????????list->elf_name, ENDIANNESS);\n" "\n" "How does that end up in the .text section of the\n" "image, instead of in one of the various data sections?\n" "\n" "What kind of linker oddity is going on with ARM?\n" "\n" - "--\302\240\t\t\n" - All Rights Reversed. - "\01:2\0" - "fn\0signature.asc\0" - "d\0This is a digitally signed message part\0" - "b\0" - "-----BEGIN PGP SIGNATURE-----\n" - "Version: GnuPG v2\n" - "\n" - "iQEcBAABCAAGBQJXgGT0AAoJEM553pKExN6DH7wH/0znCffUzWBhau8KJMvAnoPK\n" - "2C47QOWO1LqeYiuIoC3yiTbqFOhHvoqLSNvBp6YmLJDnSDgYPI8/BYHsu4kLLI0e\n" - "yB0Gdczy2FQvfp5C3wvahbLkD8llhl/W4DOKfR7BtU3oUWHlQV00rz4qgV1H5uvf\n" - "7mied4PFhk8Eabnl1GDcyIm4YZN93P17xqQzYLDc7IL79I79f5wSysmjLGD/slIN\n" - "BP+5skId75PKMBrKkLdvD6y02VIgj0gILZyCsHlJRJ/LRfCmN1c9VXShmwd0FO0r\n" - "oWiYUCRSZePuKHGuJh67xJknHH7PVvvUDyCrRRSS0dqNO3I/0AD1v9yuyt2eX2E=\n" - "=+yIR\n" - "-----END PGP SIGNATURE-----\n" + "--?\t\t\n" + "All Rights Reversed.\n" + "-------------- next part --------------\n" + "A non-text attachment was scrubbed...\n" + "Name: signature.asc\n" + "Type: application/pgp-signature\n" + "Size: 473 bytes\n" + "Desc: This is a digitally signed message part\n" + URL: <http://lists.infradead.org/pipermail/linux-arm-kernel/attachments/20160708/488a1f5e/attachment.sig> -4a1724550c1b22626f3e606726f23b211cd5b26646db81e0e1efae4947e8b8c7 +24c9e85afeb12379a5bb55d031c0f30d1d0f674b034a8fc9ebc39437f27f0356
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.