From: Kees Cook <keescook@chromium.org>
To: linux-kernel@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Arnd Bergmann <arnd@arndb.de>
Subject: [PATCH 01/12] lkdtm: add usercopy test for blocking kernel text
Date: Wed, 6 Jul 2016 15:33:20 -0700 [thread overview]
Message-ID: <1467844411-32373-2-git-send-email-keescook@chromium.org> (raw)
In-Reply-To: <1467844411-32373-1-git-send-email-keescook@chromium.org>
The upcoming HARDENED_USERCOPY checks will also block access to the
kernel text, so provide a test for this as well.
Signed-off-by: Kees Cook <keescook@chromium.org>
---
drivers/misc/lkdtm_core.c | 35 +++++++++++++++++++++++++++++++++++
1 file changed, 35 insertions(+)
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index a595a6f2615a..23d222a6c77d 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -47,6 +47,7 @@
#include <linux/vmalloc.h>
#include <linux/mman.h>
#include <asm/cacheflush.h>
+#include <asm/sections.h>
#ifdef CONFIG_IDE
#include <linux/ide.h>
@@ -120,6 +121,7 @@ enum ctype {
CT_USERCOPY_STACK_FRAME_TO,
CT_USERCOPY_STACK_FRAME_FROM,
CT_USERCOPY_STACK_BEYOND,
+ CT_USERCOPY_KERNEL,
};
static char* cp_name[] = {
@@ -171,6 +173,7 @@ static char* cp_type[] = {
"USERCOPY_STACK_FRAME_TO",
"USERCOPY_STACK_FRAME_FROM",
"USERCOPY_STACK_BEYOND",
+ "USERCOPY_KERNEL",
};
static struct jprobe lkdtm;
@@ -495,6 +498,35 @@ free_user:
vm_munmap(user_addr, PAGE_SIZE);
}
+static void do_usercopy_kernel(void)
+{
+ unsigned long user_addr;
+
+ user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
+ PROT_READ | PROT_WRITE | PROT_EXEC,
+ MAP_ANONYMOUS | MAP_PRIVATE, 0);
+ if (user_addr >= TASK_SIZE) {
+ pr_warn("Failed to allocate user memory\n");
+ return;
+ }
+
+ pr_info("attempting good copy_to_user from kernel rodata\n");
+ if (copy_to_user((void __user *)user_addr, test_text,
+ sizeof(test_text))) {
+ pr_warn("copy_to_user failed unexpectedly?!\n");
+ goto free_user;
+ }
+
+ pr_info("attempting bad copy_to_user from kernel text\n");
+ if (copy_to_user((void __user *)user_addr, _stext, PAGE_SIZE)) {
+ pr_warn("copy_to_user failed, but lacked Oops\n");
+ goto free_user;
+ }
+
+free_user:
+ vm_munmap(user_addr, PAGE_SIZE);
+}
+
static void do_usercopy_heap_size(bool to_user)
{
unsigned long user_addr;
@@ -957,6 +989,9 @@ static void lkdtm_do_action(enum ctype which)
case CT_USERCOPY_STACK_BEYOND:
do_usercopy_stack(true, false);
break;
+ case CT_USERCOPY_KERNEL:
+ do_usercopy_kernel();
+ break;
case CT_NONE:
default:
break;
--
2.7.4
next prev parent reply other threads:[~2016-07-06 22:36 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-06 22:33 [PATCH 00/12] lkdtm: use struct arrays instead of enums Kees Cook
2016-07-06 22:33 ` Kees Cook [this message]
2016-07-06 22:33 ` [PATCH 02/12] lkdtm: drop "alloc_size" parameter Kees Cook
2016-07-06 22:33 ` [PATCH 03/12] lkdtm: split usercopy tests to separate file Kees Cook
2016-07-06 22:33 ` [PATCH 04/12] lkdtm: split memory permissions " Kees Cook
2016-07-06 22:33 ` [PATCH 05/12] lkdtm: split heap corruption " Kees Cook
2016-07-06 22:33 ` [PATCH 06/12] lkdtm: split remaining logic bug " Kees Cook
2016-07-06 22:33 ` [PATCH 07/12] lkdtm: remove intentional off-by-one array access Kees Cook
2016-07-06 22:33 ` [PATCH 08/12] lkdtm: rename "count" to "crash_count" Kees Cook
2016-07-06 22:33 ` [PATCH 09/12] lkdtm: rename globals for clarity Kees Cook
2016-07-06 22:33 ` [PATCH 10/12] lkdtm: reorganize module paramaters Kees Cook
2016-07-06 22:33 ` [PATCH 11/12] lkdtm: move jprobe entry points to start of source Kees Cook
2016-07-06 22:33 ` [PATCH 12/12] lkdtm: use struct arrays instead of enums Kees Cook
2016-07-15 11:35 ` [PATCH] lkdtm: hide unused functions Arnd Bergmann
2016-07-15 22:54 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1467844411-32373-2-git-send-email-keescook@chromium.org \
--to=keescook@chromium.org \
--cc=arnd@arndb.de \
--cc=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox