From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from usa-sjc-mx-foss1.foss.arm.com ([217.140.101.70]:34458 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750722AbdKBRHs (ORCPT ); Thu, 2 Nov 2017 13:07:48 -0400 Date: Thu, 2 Nov 2017 17:07:50 +0000 From: Will Deacon To: Mark Rutland Cc: linux-arm-kernel@lists.infradead.org, Catalin Marinas , stable@vger.kernel.org Subject: Re: [PATCH] arm64: ensure __dump_instr() checks addr_limit Message-ID: <20171102170750.GC595@arm.com> References: <20171102161203.4704-1-mark.rutland@arm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171102161203.4704-1-mark.rutland@arm.com> Sender: stable-owner@vger.kernel.org List-ID: On Thu, Nov 02, 2017 at 04:12:03PM +0000, Mark Rutland wrote: > It's possible for a user to deliberately trigger __dump_instr with a > chosen kernel address. > > Let's avoid problems resulting from this by using get_user() rather than > __get_user(), ensuring that we don't erroneously access kernel memory. > > Where we use __dump_instr() on kernel text, we already switch to > KERNEL_DS, so this shouldn't adversely affect those cases. > > Signed-off-by: Mark Rutland > Fixes: 60ffc30d5652810d ("arm64: Exception handling") > Cc: Catalin Marinas > Cc: Will Deacon > Cc: stable@vger.kernel.org > --- > arch/arm64/kernel/traps.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Acked-by: Will Deacon Catalin, can you take this as a fix please? Will > diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c > index 5ea4b85aee0e..8383af15a759 100644 > --- a/arch/arm64/kernel/traps.c > +++ b/arch/arm64/kernel/traps.c > @@ -118,7 +118,7 @@ static void __dump_instr(const char *lvl, struct pt_regs *regs) > for (i = -4; i < 1; i++) { > unsigned int val, bad; > > - bad = __get_user(val, &((u32 *)addr)[i]); > + bad = get_user(val, &((u32 *)addr)[i]); > > if (!bad) > p += sprintf(p, i == 0 ? "(%08x) " : "%08x ", val); > -- > 2.11.0 >