From: Borislav Petkov <bp@alien8.de>
To: Thomas Gleixner <tglx@linutronix.de>
Cc: Oleg Nesterov <oleg@redhat.com>,
Mark Mossberg <mark.mossberg@gmail.com>,
mingo@redhat.com, x86@kernel.org, linux-kernel@vger.kernel.org,
hpa@zytor.com, jannh@google.com, kyin@redhat.com
Subject: Re: [PATCH v2] x86/dumpstack: Fix misleading instruction pointer error message
Date: Tue, 17 Nov 2020 10:54:53 +0100 [thread overview]
Message-ID: <20201117095453.GB5719@zn.tnic> (raw)
In-Reply-To: <87blfxx8ps.fsf@nanos.tec.linutronix.de>
On Mon, Nov 16, 2020 at 11:01:03PM +0100, Thomas Gleixner wrote:
> Subject: x86/dumpstack: Don't try to access user space code of other tasks
> From: Thomas Gleixner <tglx@linutronix.de>
> Date: Mon, 16 Nov 2020 22:26:52 +0100
>
> sysrq-t ends up invoking show_opcodes() for each task which tries to access
> the user space code of other processes which is obviously bogus.
>
> It either manages to dump where the foreign tasks regs->ip points to in
I guess you mean here "points to valid mapping of current" or so.
> currents mapping or triggers a pagefault and prints "Code: Bad RIP
> value.". Both is just wrong.
>
> Add a safeguard in copy_code() and check whether the @regs pointer matches
> currents pt_regs. If not, do not even try to access it.
>
> While at it, add commentry why using copy_from_user_nmi() is safe in
s/commentry/commentary/
> copy_code() even if the function name suggests otherwise.
>
> Reported-by: Mark Mossberg <mark.mossberg@gmail.com>
This is Reported-by: Oleg
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> ---
> arch/x86/kernel/dumpstack.c | 23 +++++++++++++++++++----
> 1 file changed, 19 insertions(+), 4 deletions(-)
>
> --- a/arch/x86/kernel/dumpstack.c
> +++ b/arch/x86/kernel/dumpstack.c
> @@ -78,6 +78,9 @@ static int copy_code(struct pt_regs *reg
> if (!user_mode(regs))
> return copy_from_kernel_nofault(buf, (u8 *)src, nbytes);
>
> + /* The user space code from other tasks cannot be accessed. */
> + if (regs != task_pt_regs(current))
> + return -EPERM;
> /*
> * Make sure userspace isn't trying to trick us into dumping kernel
> * memory by pointing the userspace instruction pointer at it.
> @@ -85,6 +88,12 @@ static int copy_code(struct pt_regs *reg
> if (__chk_range_not_ok(src, nbytes, TASK_SIZE_MAX))
> return -EINVAL;
>
> + /*
> + * Even if named copy_from_user_nmi() this can be invoked from
> + * other contexts and will not try to resolve a pagefault, which is
> + * the correct thing to do here as this code can be called from any
> + * context.
> + */
Can we stick the first part of this comment about "this can be invoked
from other contexts" over the function definition?
> return copy_from_user_nmi(buf, (void __user *)src, nbytes);
> }
...
With this, I see Code: only once with Sysrq-T:
[ 25.491878] task:bash state:R running task stack: 0 pid: 4267 ppid: 4187 flags:0x00004000
...
[ 25.497740] Code: 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b3 0f 1f 80 00 00 00 00 48 8d 05 f9 61 0d 00 8b 00 85 c0 75 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 41 54 49 89 d4 55 48 89 f5 53
which is the shell doing the
$ echo t > /proc/sysrq-trigger
So
Reviewed-by: Borislav Petkov <bp@suse.de>
Tested-by: Borislav Petkov <bp@suse.de>
Thanks!
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
next prev parent reply other threads:[~2020-11-17 9:55 UTC|newest]
Thread overview: 14+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-02 4:29 [PATCH v2] x86/dumpstack: Fix misleading instruction pointer error message Mark Mossberg
2020-10-02 10:26 ` [tip: x86/core] " tip-bot2 for Mark Mossberg
2020-11-03 12:50 ` [PATCH v2] " Oleg Nesterov
2020-11-03 17:15 ` Borislav Petkov
2020-11-03 17:47 ` Oleg Nesterov
2020-11-03 17:52 ` Borislav Petkov
2020-11-03 18:11 ` Oleg Nesterov
2020-11-03 18:20 ` Borislav Petkov
2020-11-16 22:01 ` Thomas Gleixner
2020-11-16 23:04 ` Andy Lutomirski
2020-11-16 23:37 ` Thomas Gleixner
2020-11-17 3:29 ` Andy Lutomirski
2020-11-17 9:54 ` Borislav Petkov [this message]
2020-11-17 17:31 ` Oleg Nesterov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201117095453.GB5719@zn.tnic \
--to=bp@alien8.de \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=kyin@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.mossberg@gmail.com \
--cc=mingo@redhat.com \
--cc=oleg@redhat.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).