From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932324AbcEXWtB (ORCPT ); Tue, 24 May 2016 18:49:01 -0400 Received: from mail.kernel.org ([198.145.29.136]:36716 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932265AbcEXWs7 (ORCPT ); Tue, 24 May 2016 18:48:59 -0400 From: Andy Lutomirski To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Borislav Petkov , Kees Cook , Brian Gerst , Andy Lutomirski Subject: [PATCH 7/7] x86/uaccess: OOPS or warn on a fault with KERNEL_DS and !pagefault_disabled() Date: Tue, 24 May 2016 15:48:44 -0700 Message-Id: X-Mailer: git-send-email 2.5.5 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If someone calls set_fs(KERNEL_DS), then they are responsible for making sure that whatever addresses are accessed are safe. If they get it wrong on a kernel address, OOPS. If they get it wrong on a user address, warn. This will make it harder to exploit bugs in which user code controls a pointer accessed with KERNEL_DS: an attacker will OOPS if they access an unmapped page, and they'll therefore need luck or a kASLR bypass in addition. To keep probe_kernel_read(), probe_kernel_write(), and probe_kernel_address() working, skip this check if pagefault_disabled(). Signed-off-by: Andy Lutomirski --- arch/x86/mm/extable.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c index 818cc7ffef79..4bf3ab2b8be1 100644 --- a/arch/x86/mm/extable.c +++ b/arch/x86/mm/extable.c @@ -60,6 +60,37 @@ static bool uaccess_fault_okay(int trapnr, unsigned long error_code, return false; } + /* + * If fs == KERNEL_DS, then all uaccess should be directed to + * known-good kernel addresses. + * + * We still need to support probe_kernel_read and + * probe_kernel_address, which disable page faults. This could be + * tightened up a bit if we explicitly annotated probe_kernel_read(), + * probe_kernel_write() and probe_kernel_address(), perhaps by + * introducing PROBE_KERNEL_DS. + */ + if (unlikely(!is_user_ds && !pagefault_disabled())) { + if (extra < TASK_SIZE_MAX) { + /* + * Accessing user address under KERNEL_DS. This is a + * bug and should be fixed, but OOPSing is not helpful + * for exploit mitigation. + */ + WARN_ONCE(1, "BUG: uaccess fault at 0x%lx with KERNEL_DS\n", + extra); + } else { + /* + * If a bug that allows user-controlled KERNEL_DS + * access exists, this will prevent it from being used + * to trivially bypass kASLR. + */ + pr_crit("BUG: uaccess fault at 0x%lx with KERNEL_DS\n", + extra); + return false; + } + } + return true; } -- 2.5.5