From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755988AbcGFWgk (ORCPT ); Wed, 6 Jul 2016 18:36:40 -0400 Received: from mail-pa0-f53.google.com ([209.85.220.53]:32778 "EHLO mail-pa0-f53.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752634AbcGFWdm (ORCPT ); Wed, 6 Jul 2016 18:33:42 -0400 From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Kees Cook , Greg Kroah-Hartman , Arnd Bergmann Subject: [PATCH 01/12] lkdtm: add usercopy test for blocking kernel text Date: Wed, 6 Jul 2016 15:33:20 -0700 Message-Id: <1467844411-32373-2-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1467844411-32373-1-git-send-email-keescook@chromium.org> References: <1467844411-32373-1-git-send-email-keescook@chromium.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The upcoming HARDENED_USERCOPY checks will also block access to the kernel text, so provide a test for this as well. Signed-off-by: Kees Cook --- drivers/misc/lkdtm_core.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index a595a6f2615a..23d222a6c77d 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -47,6 +47,7 @@ #include #include #include +#include #ifdef CONFIG_IDE #include @@ -120,6 +121,7 @@ enum ctype { CT_USERCOPY_STACK_FRAME_TO, CT_USERCOPY_STACK_FRAME_FROM, CT_USERCOPY_STACK_BEYOND, + CT_USERCOPY_KERNEL, }; static char* cp_name[] = { @@ -171,6 +173,7 @@ static char* cp_type[] = { "USERCOPY_STACK_FRAME_TO", "USERCOPY_STACK_FRAME_FROM", "USERCOPY_STACK_BEYOND", + "USERCOPY_KERNEL", }; static struct jprobe lkdtm; @@ -495,6 +498,35 @@ free_user: vm_munmap(user_addr, PAGE_SIZE); } +static void do_usercopy_kernel(void) +{ + unsigned long user_addr; + + user_addr = vm_mmap(NULL, 0, PAGE_SIZE, + PROT_READ | PROT_WRITE | PROT_EXEC, + MAP_ANONYMOUS | MAP_PRIVATE, 0); + if (user_addr >= TASK_SIZE) { + pr_warn("Failed to allocate user memory\n"); + return; + } + + pr_info("attempting good copy_to_user from kernel rodata\n"); + if (copy_to_user((void __user *)user_addr, test_text, + sizeof(test_text))) { + pr_warn("copy_to_user failed unexpectedly?!\n"); + goto free_user; + } + + pr_info("attempting bad copy_to_user from kernel text\n"); + if (copy_to_user((void __user *)user_addr, _stext, PAGE_SIZE)) { + pr_warn("copy_to_user failed, but lacked Oops\n"); + goto free_user; + } + +free_user: + vm_munmap(user_addr, PAGE_SIZE); +} + static void do_usercopy_heap_size(bool to_user) { unsigned long user_addr; @@ -957,6 +989,9 @@ static void lkdtm_do_action(enum ctype which) case CT_USERCOPY_STACK_BEYOND: do_usercopy_stack(true, false); break; + case CT_USERCOPY_KERNEL: + do_usercopy_kernel(); + break; case CT_NONE: default: break; -- 2.7.4