From mboxrd@z Thu Jan 1 00:00:00 1970 From: Borislav Petkov Subject: Re: [PATCH v4 08/29] dma-api: Teach the "DMA-from-stack" check about vmapped stacks Date: Thu, 30 Jun 2016 21:37:23 +0200 Message-ID: <20160630193723.GE3932@pd.tnic> References: Reply-To: kernel-hardening@lists.openwall.com Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: Content-Disposition: inline In-Reply-To: To: Andy Lutomirski Cc: x86@kernel.org, linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org, Nadav Amit , Kees Cook , Brian Gerst , "kernel-hardening@lists.openwall.com" , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens , Andrew Morton , Arnd Bergmann List-Id: linux-arch.vger.kernel.org On Sun, Jun 26, 2016 at 02:55:30PM -0700, Andy Lutomirski wrote: > If we're using CONFIG_VMAP_STACK and we manage to point an sg entry > at the stack, then either the sg page will be in highmem or sg_virt > will return the direct-map alias. In neither case will the existing > check_for_stack() implementation realize that it's a stack page. > > Fix it by explicitly checking for stack pages. > > This has no effect by itself. It's broken out for ease of review. > > Cc: Andrew Morton > Cc: Arnd Bergmann > Signed-off-by: Andy Lutomirski > --- > lib/dma-debug.c | 39 +++++++++++++++++++++++++++++++++------ > 1 file changed, 33 insertions(+), 6 deletions(-) > > diff --git a/lib/dma-debug.c b/lib/dma-debug.c > index 51a76af25c66..5b2e63cba90e 100644 > --- a/lib/dma-debug.c > +++ b/lib/dma-debug.c > @@ -22,6 +22,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -1162,11 +1163,35 @@ static void check_unmap(struct dma_debug_entry *ref) > put_hash_bucket(bucket, &flags); > } > > -static void check_for_stack(struct device *dev, void *addr) > +static void check_for_stack(struct device *dev, > + struct page *page, size_t offset) > { > - if (object_is_on_stack(addr)) > - err_printk(dev, NULL, "DMA-API: device driver maps memory from " > - "stack [addr=%p]\n", addr); > + void *addr; > + struct vm_struct *stack_vm_area = task_stack_vm_area(current); lib/dma-debug.c: In function ‘check_for_stack’: lib/dma-debug.c:1170:36: error: implicit declaration of function ‘task_stack_vm_area’ [-Werror=implicit-function-declaration] struct vm_struct *stack_vm_area = task_stack_vm_area(current); ^ lib/dma-debug.c:1170:36: warning: initialization makes pointer from integer without a cast [-Wint-conversion] cc1: some warnings being treated as errors make[1]: *** [lib/dma-debug.o] Error 1 make: *** [lib] Error 2 make: *** Waiting for unfinished jobs.... Probably reorder pieces from patch 9 to earlier ones... -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.skyhub.de ([78.46.96.112]:35318 "EHLO mail.skyhub.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752648AbcF3Th2 (ORCPT ); Thu, 30 Jun 2016 15:37:28 -0400 Date: Thu, 30 Jun 2016 21:37:23 +0200 From: Borislav Petkov Subject: Re: [PATCH v4 08/29] dma-api: Teach the "DMA-from-stack" check about vmapped stacks Message-ID: <20160630193723.GE3932@pd.tnic> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: Sender: linux-arch-owner@vger.kernel.org List-ID: To: Andy Lutomirski Cc: x86@kernel.org, linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org, Nadav Amit , Kees Cook , Brian Gerst , "kernel-hardening@lists.openwall.com" , Linus Torvalds , Josh Poimboeuf , Jann Horn , Heiko Carstens , Andrew Morton , Arnd Bergmann Message-ID: <20160630193723.fVavkDW6hXyE7cESKSciso8T89AhbV6xw4CKQtqLg6k@z> On Sun, Jun 26, 2016 at 02:55:30PM -0700, Andy Lutomirski wrote: > If we're using CONFIG_VMAP_STACK and we manage to point an sg entry > at the stack, then either the sg page will be in highmem or sg_virt > will return the direct-map alias. In neither case will the existing > check_for_stack() implementation realize that it's a stack page. > > Fix it by explicitly checking for stack pages. > > This has no effect by itself. It's broken out for ease of review. > > Cc: Andrew Morton > Cc: Arnd Bergmann > Signed-off-by: Andy Lutomirski > --- > lib/dma-debug.c | 39 +++++++++++++++++++++++++++++++++------ > 1 file changed, 33 insertions(+), 6 deletions(-) > > diff --git a/lib/dma-debug.c b/lib/dma-debug.c > index 51a76af25c66..5b2e63cba90e 100644 > --- a/lib/dma-debug.c > +++ b/lib/dma-debug.c > @@ -22,6 +22,7 @@ > #include > #include > #include > +#include > #include > #include > #include > @@ -1162,11 +1163,35 @@ static void check_unmap(struct dma_debug_entry *ref) > put_hash_bucket(bucket, &flags); > } > > -static void check_for_stack(struct device *dev, void *addr) > +static void check_for_stack(struct device *dev, > + struct page *page, size_t offset) > { > - if (object_is_on_stack(addr)) > - err_printk(dev, NULL, "DMA-API: device driver maps memory from " > - "stack [addr=%p]\n", addr); > + void *addr; > + struct vm_struct *stack_vm_area = task_stack_vm_area(current); lib/dma-debug.c: In function ‘check_for_stack’: lib/dma-debug.c:1170:36: error: implicit declaration of function ‘task_stack_vm_area’ [-Werror=implicit-function-declaration] struct vm_struct *stack_vm_area = task_stack_vm_area(current); ^ lib/dma-debug.c:1170:36: warning: initialization makes pointer from integer without a cast [-Wint-conversion] cc1: some warnings being treated as errors make[1]: *** [lib/dma-debug.o] Error 1 make: *** [lib] Error 2 make: *** Waiting for unfinished jobs.... Probably reorder pieces from patch 9 to earlier ones... -- Regards/Gruss, Boris. ECO tip #101: Trim your mails when you reply.