On Wed, Oct 28, 2015 at 5:47 AM, Stephen Smalley <[email protected]> wrote: > Add a copy_to_user() call to the ACCESS_USERSPACE test > prior to attempting direct dereferencing of the user > address to ensure the page is present. Otherwise, > a fault occurs on arm kernels even prior to the introduction > of CONFIG_CPU_SW_DOMAIN_PAN, and there is no difference in > behavior for CONFIG_CPU_SW_DOMAIN_PAN=n vs CONFIG_CPU_SW_DOMAIN_PAN=y. > > Before this change, for any value of CONFIG_CPU_SW_DOMAIN_PAN: > lkdtm: Performing direct entry ACCESS_USERSPACE > lkdtm: attempting bad read at b6fe8000 > Unable to handle kernel paging request at virtual address b6fe8000 > > After this change, for CONFIG_CPU_SW_DOMAIN_PAN=n: > lkdtm: Performing direct entry ACCESS_USERSPACE > lkdtm: attempting bad read at b6efc000 > lkdtm: attempting bad write at b6efc000 > > After this change, for CONFIG_CPU_SW_DOMAIN_PAN=y: > lkdtm: Performing direct entry ACCESS_USERSPACE > lkdtm: attempting bad read at b6f7d000 > Unhandled fault: page domain fault (0x01b) at 0xb6f7d000 > ... > > Signed-off-by: Stephen Smalley <[email protected]>
Great catch! In looking at this test again, I wonder if ACCESS_USERSPACE should be split so that read and write can be tested separately... Acked-by: Kees Cook <[email protected]> -Kees > --- > drivers/misc/lkdtm.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > > diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c > index b5abe34..11fdadc 100644 > --- a/drivers/misc/lkdtm.c > +++ b/drivers/misc/lkdtm.c > @@ -472,7 +472,7 @@ static void lkdtm_do_action(enum ctype which) > break; > } > case CT_ACCESS_USERSPACE: { > - unsigned long user_addr, tmp; > + unsigned long user_addr, tmp = 0; > unsigned long *ptr; > > user_addr = vm_mmap(NULL, 0, PAGE_SIZE, > @@ -483,6 +483,12 @@ static void lkdtm_do_action(enum ctype which) > return; > } > > + if (copy_to_user((void __user *)user_addr, &tmp, > sizeof(tmp))) { > + pr_warn("copy_to_user failed\n"); > + vm_munmap(user_addr, PAGE_SIZE); > + return; > + } > + > ptr = (unsigned long *)user_addr; > > pr_info("attempting bad read at %p\n", ptr); > -- > 2.4.3 > -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
