From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753508AbbI3N7c (ORCPT ); Wed, 30 Sep 2015 09:59:32 -0400 Received: from mail-wi0-f177.google.com ([209.85.212.177]:37792 "EHLO mail-wi0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753237AbbI3N7Y (ORCPT ); Wed, 30 Sep 2015 09:59:24 -0400 Date: Wed, 30 Sep 2015 15:59:17 +0200 From: Ingo Molnar To: Thomas Gleixner Cc: Andy Lutomirski , Kees Cook , Dmitry Vyukov , Andrey Ryabinin , Ingo Molnar , "H. Peter Anvin" , Andy Lutomirski , Borislav Petkov , Denys Vlasenko , "x86@kernel.org" , LKML , Kostya Serebryany , Alexander Potapenko , Andrey Konovalov , Sasha Levin , Andi Kleen , kasan-dev , Linus Torvalds , Peter Zijlstra , Andrew Morton , Al Viro Subject: [PATCH v2] fs/proc: Don't expose absolute kernel addresses via wchan Message-ID: <20150930135917.GA3285@gmail.com> References: <1443430839-13225-1-git-send-email-dvyukov@google.com> <20150930071537.GA19048@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org * Thomas Gleixner wrote: > On Wed, 30 Sep 2015, Ingo Molnar wrote: > > diff --git a/fs/proc/array.c b/fs/proc/array.c > > index f60f0121e331..99082730b2ac 100644 > > --- a/fs/proc/array.c > > +++ b/fs/proc/array.c > > @@ -507,7 +507,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, > > seq_put_decimal_ull(m, ' ', task->blocked.sig[0] & 0x7fffffffUL); > > seq_put_decimal_ull(m, ' ', sigign.sig[0] & 0x7fffffffUL); > > seq_put_decimal_ull(m, ' ', sigcatch.sig[0] & 0x7fffffffUL); > > - seq_put_decimal_ull(m, ' ', wchan); > > + seq_puts(m, " 0"); /* Used to be numeric wchan - replaced by /proc/PID/wchan */ > > That should get rid of all wchan usage in do_task_stat() Indeed - updated patch attached. Thanks, Ingo ================================> >>From 985037cd05b379240dd381b29c2525758c665bb0 Mon Sep 17 00:00:00 2001 From: Ingo Molnar Date: Wed, 30 Sep 2015 09:15:37 +0200 Subject: [PATCH] fs/proc: Don't expose absolute kernel addresses via wchan So wchan leaks absolute kernel addresses to unprivileged user-space, of kernel functions that sleep: static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task) { unsigned long wchan; char symname[KSYM_NAME_LEN]; wchan = get_wchan(task); if (lookup_symbol_name(wchan, symname) < 0) { if (!ptrace_may_access(task, PTRACE_MODE_READ)) return 0; seq_printf(m, "%lu", wchan); } else { seq_printf(m, "%s", symname); } return 0; } So for example it trivially leaks the KASLR offset to any local attacker: fomalhaut:~> printf "%016lx\n" $(cat /proc/$$/stat | cut -d' ' -f35) ffffffff8123b380 Most real-life uses of wchan are symbolic: ps -eo pid:10,tid:10,wchan:30,comm and procps uses /proc/PID/wchan, not the absolute address in /proc/PID/stat: triton:~/tip> strace -f ps -eo pid:10,tid:10,wchan:30,comm 2>&1 | grep wchan | tail -1 open("/proc/30833/wchan", O_RDONLY) = 6 These days there's very little legitimate reason user-space would be interested in the absolute address. The absolute address is mostly historic: from the days when we didn't have kallsyms and user-space procps had to do the decoding itself via the System.map. So this patch sets all numeric output to 0 and keeps the symbolic output in /proc/PID/wchan. ( The absolute sleep address can generally still be profiled via perf, by tasks with sufficient privileges. ) Cc: Al Viro Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Andy Lutomirski Cc: Andy Lutomirski Cc: Borislav Petkov Cc: Denys Vlasenko Cc: Dmitry Vyukov Cc: Kees Cook Cc: Kostya Serebryany Cc: Linus Torvalds Cc: Mike Galbraith Cc: Peter Zijlstra Cc: Peter Zijlstra Cc: Sasha Levin Cc: Thomas Gleixner Cc: kasan-dev Cc: linux-kernel@vger.kernel.org Link: http://lkml.kernel.org/r/20150930071537.GA19048@gmail.com Signed-off-by: Ingo Molnar --- fs/proc/array.c | 6 ++---- fs/proc/base.c | 7 +------ 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index f60f0121e331..ad5ad1e376ad 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -375,7 +375,7 @@ int proc_pid_status(struct seq_file *m, struct pid_namespace *ns, static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task, int whole) { - unsigned long vsize, eip, esp, wchan = ~0UL; + unsigned long vsize, eip, esp; int priority, nice; int tty_pgrp = -1, tty_nr = 0; sigset_t sigign, sigcatch; @@ -454,8 +454,6 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, unlock_task_sighand(task, &flags); } - if (permitted && (!whole || num_threads < 2)) - wchan = get_wchan(task); if (!whole) { min_flt = task->min_flt; maj_flt = task->maj_flt; @@ -507,7 +505,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, seq_put_decimal_ull(m, ' ', task->blocked.sig[0] & 0x7fffffffUL); seq_put_decimal_ull(m, ' ', sigign.sig[0] & 0x7fffffffUL); seq_put_decimal_ull(m, ' ', sigcatch.sig[0] & 0x7fffffffUL); - seq_put_decimal_ull(m, ' ', wchan); + seq_puts(m, " 0"); /* Used to be numeric wchan - replaced by /proc/PID/wchan */ seq_put_decimal_ull(m, ' ', 0); seq_put_decimal_ull(m, ' ', 0); seq_put_decimal_ll(m, ' ', task->exit_signal); diff --git a/fs/proc/base.c b/fs/proc/base.c index b25eee4cead5..2fdbf303e3eb 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -430,13 +430,8 @@ static int proc_pid_wchan(struct seq_file *m, struct pid_namespace *ns, wchan = get_wchan(task); - if (lookup_symbol_name(wchan, symname) < 0) { - if (!ptrace_may_access(task, PTRACE_MODE_READ)) - return 0; - seq_printf(m, "%lu", wchan); - } else { + if (!lookup_symbol_name(wchan, symname)) seq_printf(m, "%s", symname); - } return 0; }