On Tue, Aug 28, 2018 at 8:18 AM, Jann Horn <[email protected]> wrote: > show_opcodes() is used both for dumping kernel instructions and for dumping > user instructions. If userspace causes #PF by jumping to a kernel address, > show_opcodes() can be reached with regs->ip controlled by the user, > pointing to kernel code. Make sure that userspace can't trick us into > dumping kernel memory into dmesg. > > Cc: [email protected] > Fixes: 7cccf0725cf7 ("x86/dumpstack: Add a show_ip() function") > Signed-off-by: Jann Horn <[email protected]>
Thanks for finding this! Reviewed-by: Kees Cook <[email protected]> -Kees > --- > arch/x86/include/asm/stacktrace.h | 2 +- > arch/x86/kernel/dumpstack.c | 13 ++++++++++--- > arch/x86/mm/fault.c | 2 +- > 3 files changed, 12 insertions(+), 5 deletions(-) > > diff --git a/arch/x86/include/asm/stacktrace.h > b/arch/x86/include/asm/stacktrace.h > index b6dc698f992a..f335aad404a4 100644 > --- a/arch/x86/include/asm/stacktrace.h > +++ b/arch/x86/include/asm/stacktrace.h > @@ -111,6 +111,6 @@ static inline unsigned long caller_frame_pointer(void) > return (unsigned long)frame; > } > > -void show_opcodes(u8 *rip, const char *loglvl); > +void show_opcodes(struct pt_regs *regs, const char *loglvl); > void show_ip(struct pt_regs *regs, const char *loglvl); > #endif /* _ASM_X86_STACKTRACE_H */ > diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c > index 9c8652974f8e..5d2700c98b29 100644 > --- a/arch/x86/kernel/dumpstack.c > +++ b/arch/x86/kernel/dumpstack.c > @@ -89,14 +89,21 @@ static void printk_stack_address(unsigned long address, > int reliable, > * Thus, the 2/3rds prologue and 64 byte OPCODE_BUFSIZE is just a random > * guesstimate in attempt to achieve all of the above. > */ > -void show_opcodes(u8 *rip, const char *loglvl) > +void show_opcodes(struct pt_regs *regs, const char *loglvl) > { > #define PROLOGUE_SIZE 42 > #define EPILOGUE_SIZE 21 > #define OPCODE_BUFSIZE (PROLOGUE_SIZE + 1 + EPILOGUE_SIZE) > u8 opcodes[OPCODE_BUFSIZE]; > + u8 *prologue = (u8 *)regs->ip - PROLOGUE_SIZE; > + /* > + * Make sure userspace isn't trying to trick us into dumping kernel > + * memory by pointing the userspace instruction pointer at it. > + */ > + bool bad_ip = user_mode(regs) && > + __range_not_ok(prologue, OPCODE_BUFSIZE, TASK_SIZE_MAX); > > - if (probe_kernel_read(opcodes, rip - PROLOGUE_SIZE, OPCODE_BUFSIZE)) { > + if (bad_ip || probe_kernel_read(opcodes, prologue, OPCODE_BUFSIZE)) { > printk("%sCode: Bad RIP value.\n", loglvl); > } else { > printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %" > @@ -112,7 +119,7 @@ void show_ip(struct pt_regs *regs, const char *loglvl) > #else > printk("%sRIP: %04x:%pS\n", loglvl, (int)regs->cs, (void *)regs->ip); > #endif > - show_opcodes((u8 *)regs->ip, loglvl); > + show_opcodes(regs, loglvl); > } > > void show_iret_regs(struct pt_regs *regs) > diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c > index b9123c497e0a..47bebfe6efa7 100644 > --- a/arch/x86/mm/fault.c > +++ b/arch/x86/mm/fault.c > @@ -837,7 +837,7 @@ show_signal_msg(struct pt_regs *regs, unsigned long > error_code, > > printk(KERN_CONT "\n"); > > - show_opcodes((u8 *)regs->ip, loglvl); > + show_opcodes(regs, loglvl); > } > > static void > -- > 2.19.0.rc0.228.g281dcd1b4d0-goog > -- Kees Cook Pixel Security
