From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752335AbdLGAnx (ORCPT ); Wed, 6 Dec 2017 19:43:53 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:52646 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751950AbdLGAnv (ORCPT ); Wed, 6 Dec 2017 19:43:51 -0500 Date: Wed, 6 Dec 2017 16:43:50 -0800 From: Andrew Morton To: Heiko Carstens Cc: Linus Torvalds , Kees Cook , Jiri Olsa , Al Viro , linux-kernel@vger.kernel.org Subject: Re: [PATCH] fs/proc/kcore.c: use probe_kernel_read() instead of memcpy() Message-Id: <20171206164350.2bec38f46c1fdf84285f862c@linux-foundation.org> In-Reply-To: <20171202132739.99971-1-heiko.carstens@de.ibm.com> References: <20171202132739.99971-1-heiko.carstens@de.ibm.com> X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sat, 2 Dec 2017 14:27:39 +0100 Heiko Carstens wrote: > git commit df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext > data") added a bounce buffer to avoid hardened usercopy > checks. Copying to the bounce buffer was implemented with a simple > memcpy() assuming that it is always valid to read from kernel memory > iff the kern_addr_valid() check passed. > > A simple, but pointless, test case like "dd if=/proc/kcore > of=/dev/null" now can easily crash the kernel, since the former > execption handling on invalid kernel addresses now doesn't work > anymore. > > Also adding a kern_addr_valid() implementation wouldn't help > here. Most architectures simply return 1 here, while a couple > implemented a page table walk to figure out if something is mapped at > the address in question. > With DEBUG_PAGEALLOC active mappings are established and removed all > the time, so that relying on the result of kern_addr_valid() before > executing the memcpy() also doesn't work. > > Therefore simply use probe_kernel_read() to copy to the bounce > buffer. This also allows to simplify read_kcore(). > > At least on s390 this fixes the observed crashes and doesn't introduce > warnings that were removed with df04abfd181a ("fs/proc/kcore.c: Add > bounce buffer for ktext data"), even though the generic > probe_kernel_read() implementation uses uaccess functions. > > While looking into this I'm also wondering if kern_addr_valid() could > be completely removed...(?) > > Fixes: df04abfd181a ("fs/proc/kcore.c: Add bounce buffer for ktext data") > Fixes: f5509cc18daa ("mm: Hardened usercopy") It's a privileged operation, but oopsing root's kernel is still a bit rude. So I'll add cc:stable. And let it bake until 4.16-rc1, since the bug has been there for a year or more. Sound OK?