From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751833AbdIQR71 (ORCPT ); Sun, 17 Sep 2017 13:59:27 -0400 Received: from terminus.zytor.com ([65.50.211.136]:49321 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751411AbdIQR70 (ORCPT ); Sun, 17 Sep 2017 13:59:26 -0400 Date: Sun, 17 Sep 2017 10:53:35 -0700 From: tip-bot for Thomas Garnier Message-ID: Cc: hpa@zytor.com, linux@armlinux.org.uk, arnd@arndb.de, luto@amacapital.net, panand@redhat.com, wad@chromium.org, catalin.marinas@arm.com, linux-kernel@vger.kernel.org, viro@zeniv.linux.org.uk, Dave.Martin@arm.com, thgarnie@google.com, will.deacon@arm.com, dave.hansen@intel.com, dhowells@redhat.com, tglx@linutronix.de, mingo@kernel.org, yhs@fb.com, keescook@chromium.org Reply-To: viro@zeniv.linux.org.uk, linux-kernel@vger.kernel.org, will.deacon@arm.com, thgarnie@google.com, Dave.Martin@arm.com, mingo@kernel.org, dhowells@redhat.com, tglx@linutronix.de, dave.hansen@intel.com, yhs@fb.com, keescook@chromium.org, arnd@arndb.de, linux@armlinux.org.uk, hpa@zytor.com, luto@amacapital.net, panand@redhat.com, catalin.marinas@arm.com, wad@chromium.org In-Reply-To: <1504798247-48833-2-git-send-email-keescook@chromium.org> References: <1504798247-48833-2-git-send-email-keescook@chromium.org> To: linux-tip-commits@vger.kernel.org Subject: [tip:core/urgent] syscalls: Use CHECK_DATA_CORRUPTION for addr_limit_user_check Git-Commit-ID: bf29ed1567b67854dc13504f685c45a2ea9b2081 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: bf29ed1567b67854dc13504f685c45a2ea9b2081 Gitweb: http://git.kernel.org/tip/bf29ed1567b67854dc13504f685c45a2ea9b2081 Author: Thomas Garnier AuthorDate: Thu, 7 Sep 2017 08:30:44 -0700 Committer: Thomas Gleixner CommitDate: Sun, 17 Sep 2017 19:45:32 +0200 syscalls: Use CHECK_DATA_CORRUPTION for addr_limit_user_check Use CHECK_DATA_CORRUPTION instead of BUG_ON to provide more flexibility on address limit failures. By default, send a SIGKILL signal to kill the current process preventing exploitation of a bad address limit. Make the TIF_FSCHECK flag optional so ARM can use this function. Signed-off-by: Thomas Garnier Signed-off-by: Kees Cook Signed-off-by: Thomas Gleixner Cc: Pratyush Anand Cc: Dave Martin Cc: Will Drewry Cc: Arnd Bergmann Cc: Catalin Marinas Cc: Will Deacon Cc: Russell King Cc: Andy Lutomirski Cc: David Howells Cc: Dave Hansen Cc: Al Viro Cc: linux-api@vger.kernel.org Cc: Yonghong Song Cc: linux-arm-kernel@lists.infradead.org Link: http://lkml.kernel.org/r/1504798247-48833-2-git-send-email-keescook@chromium.org --- include/linux/syscalls.h | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h index 95606a2..a78186d 100644 --- a/include/linux/syscalls.h +++ b/include/linux/syscalls.h @@ -221,21 +221,25 @@ static inline int is_syscall_trace_event(struct trace_event_call *tp_event) } \ static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__)) -#ifdef TIF_FSCHECK /* * Called before coming back to user-mode. Returning to user-mode with an * address limit different than USER_DS can allow to overwrite kernel memory. */ static inline void addr_limit_user_check(void) { - +#ifdef TIF_FSCHECK if (!test_thread_flag(TIF_FSCHECK)) return; +#endif - BUG_ON(!segment_eq(get_fs(), USER_DS)); + if (CHECK_DATA_CORRUPTION(!segment_eq(get_fs(), USER_DS), + "Invalid address limit on user-mode return")) + force_sig(SIGKILL, current); + +#ifdef TIF_FSCHECK clear_thread_flag(TIF_FSCHECK); -} #endif +} asmlinkage long sys32_quotactl(unsigned int cmd, const char __user *special, qid_t id, void __user *addr);