From: Will Deacon <will.deacon@arm.com>
To: Sodagudi Prasad <psodagud@codeaurora.org>
Cc: catalin.marinas@arm.com, james.morse@arm.com,
akpm@linux-foundation.org, sandeepa.s.prabhu@gmail.com,
shijie.huang@arm.com, linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org
Subject: Re: <Query> Looking more details and reasons for using orig_add_limit.
Date: Wed, 15 Feb 2017 11:38:30 +0000 [thread overview]
Message-ID: <20170215113829.GE9630@arm.com> (raw)
In-Reply-To: <def87360266193184dc013a055ec3869@codeaurora.org>
On Tue, Feb 14, 2017 at 09:52:30PM -0800, Sodagudi Prasad wrote:
>
> Hi All,
>
> Would like to understand the reasons behind using the orig_add_limit
> variable in the following code. Can you please share more details ?
>
> "arch/arm64/mm/fault.c"
> static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
> struct pt_regs *regs)
> {
> …
> …
> …
> if (addr < USER_DS && is_permission_fault(esr, regs)) {
> =====>> condition_1
> /* regs->orig_addr_limit may be 0 if we entered from EL0 */
> if (regs->orig_addr_limit == KERNEL_DS)
> =====>> condition_2
> die("Accessing user space memory with fs=KERNEL_DS",
> regs, esr);
>
> if (is_el1_instruction_abort(esr))
> die("Attempting to execute userspace memory", regs,
> esr);
>
> if (!search_exception_tables(regs->pc))
> die("Accessing user space memory outside uaccess.h
> routines", regs, esr);
> }
>
>
> When any sys call is made from user space orig_addr_limit will be zero and
> after that driver is calling set_fs(KERNEL_DS) and then copy_to_user() to
> user space memory. If there is permission fault for user space address the
> above condition is leading to kernel crash. Because orig_add_limit is having
> KERNEL_DS as set_fs called before copy_to_user().
Which driver is setting KERNEL_DS prior to accessing userspace and why? It
sounds broken to me. I also don't think it will work with PAN + UAO enabled.
Will
next prev parent reply other threads:[~2017-02-15 11:38 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-02-15 5:52 <Query> Looking more details and reasons for using orig_add_limit Sodagudi Prasad
2017-02-15 11:38 ` Will Deacon [this message]
2017-02-15 12:09 ` James Morse
2017-02-15 21:12 ` Sodagudi Prasad
2017-02-16 10:39 ` James Morse
2017-02-21 14:20 ` Sodagudi Prasad
2017-02-22 19:53 ` Laurent Pinchart
2017-02-22 20:25 ` Mauro Carvalho Chehab
2017-02-23 0:25 ` Laurent Pinchart
2017-02-22 19:53 ` Mauro Carvalho Chehab
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170215113829.GE9630@arm.com \
--to=will.deacon@arm.com \
--cc=akpm@linux-foundation.org \
--cc=catalin.marinas@arm.com \
--cc=james.morse@arm.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=psodagud@codeaurora.org \
--cc=sandeepa.s.prabhu@gmail.com \
--cc=shijie.huang@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox