From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg0-f71.google.com (mail-pg0-f71.google.com [74.125.83.71]) by kanga.kvack.org (Postfix) with ESMTP id B14566B0069 for ; Tue, 6 Dec 2016 13:19:48 -0500 (EST) Received: by mail-pg0-f71.google.com with SMTP id e9so34233885pgc.5 for ; Tue, 06 Dec 2016 10:19:48 -0800 (PST) Received: from foss.arm.com (foss.arm.com. [217.140.101.70]) by mx.google.com with ESMTP id t184si20349195pgd.119.2016.12.06.10.19.47 for ; Tue, 06 Dec 2016 10:19:47 -0800 (PST) Date: Tue, 6 Dec 2016 18:18:59 +0000 From: Mark Rutland Subject: Re: [PATCHv4 09/10] mm/usercopy: Switch to using lm_alias Message-ID: <20161206181859.GH24177@leverpostej> References: <1480445729-27130-1-git-send-email-labbott@redhat.com> <1480445729-27130-10-git-send-email-labbott@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: owner-linux-mm@kvack.org List-ID: To: Kees Cook Cc: Laura Abbott , Ard Biesheuvel , Will Deacon , Catalin Marinas , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , "x86@kernel.org" , LKML , Linux-MM , Andrew Morton , Marek Szyprowski , Joonsoo Kim , "linux-arm-kernel@lists.infradead.org" On Tue, Nov 29, 2016 at 11:39:44AM -0800, Kees Cook wrote: > On Tue, Nov 29, 2016 at 10:55 AM, Laura Abbott wrote: > > > > The usercopy checking code currently calls __va(__pa(...)) to check for > > aliases on symbols. Switch to using lm_alias instead. > > > > Signed-off-by: Laura Abbott > > Acked-by: Kees Cook > > I should probably add a corresponding alias test to lkdtm... > > -Kees Something like the below? It uses lm_alias(), so it depends on Laura's patches. We seem to do the right thing, anyhow: root@ribbensteg:/home/nanook# echo USERCOPY_KERNEL_ALIAS > /sys/kernel/debug/provoke-crash/DIRECT [ 44.493400] usercopy: kernel memory exposure attempt detected from ffff80000031a730 () (4096 bytes) [ 44.504263] kernel BUG at mm/usercopy.c:75! Thanks, Mark. ---->8---- diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h index fdf954c..96d8d76 100644 --- a/drivers/misc/lkdtm.h +++ b/drivers/misc/lkdtm.h @@ -56,5 +56,6 @@ void lkdtm_USERCOPY_STACK_FRAME_FROM(void); void lkdtm_USERCOPY_STACK_BEYOND(void); void lkdtm_USERCOPY_KERNEL(void); +void lkdtm_USERCOPY_KERNEL_ALIAS(void); #endif diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index f9154b8..f6bc6d6 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -228,6 +228,7 @@ struct crashtype crashtypes[] = { CRASHTYPE(USERCOPY_STACK_FRAME_FROM), CRASHTYPE(USERCOPY_STACK_BEYOND), CRASHTYPE(USERCOPY_KERNEL), + CRASHTYPE(USERCOPY_KERNEL_ALIAS), }; diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c index 1dd6114..955f2dc 100644 --- a/drivers/misc/lkdtm_usercopy.c +++ b/drivers/misc/lkdtm_usercopy.c @@ -279,9 +279,16 @@ void lkdtm_USERCOPY_STACK_BEYOND(void) do_usercopy_stack(true, false); } -void lkdtm_USERCOPY_KERNEL(void) +static void do_usercopy_kernel(bool use_alias) { unsigned long user_addr; + const void *rodata = test_text; + void *text = vm_mmap; + + if (use_alias) { + rodata = lm_alias(rodata); + text = lm_alias(text); + } user_addr = vm_mmap(NULL, 0, PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC, @@ -292,14 +299,14 @@ void lkdtm_USERCOPY_KERNEL(void) } pr_info("attempting good copy_to_user from kernel rodata\n"); - if (copy_to_user((void __user *)user_addr, test_text, + if (copy_to_user((void __user *)user_addr, rodata, unconst + sizeof(test_text))) { pr_warn("copy_to_user failed unexpectedly?!\n"); goto free_user; } pr_info("attempting bad copy_to_user from kernel text\n"); - if (copy_to_user((void __user *)user_addr, vm_mmap, + if (copy_to_user((void __user *)user_addr, text, unconst + PAGE_SIZE)) { pr_warn("copy_to_user failed, but lacked Oops\n"); goto free_user; @@ -309,6 +316,16 @@ void lkdtm_USERCOPY_KERNEL(void) vm_munmap(user_addr, PAGE_SIZE); } +void lkdtm_USERCOPY_KERNEL(void) +{ + do_usercopy_kernel(false); +} + +void lkdtm_USERCOPY_KERNEL_ALIAS(void) +{ + do_usercopy_kernel(true); +} + void __init lkdtm_usercopy_init(void) { /* Prepare cache that lacks SLAB_USERCOPY flag. */ -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org