From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932276AbcEXWs7 (ORCPT ); Tue, 24 May 2016 18:48:59 -0400 Received: from mail.kernel.org ([198.145.29.136]:36704 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932112AbcEXWs5 (ORCPT ); Tue, 24 May 2016 18:48:57 -0400 From: Andy Lutomirski To: x86@kernel.org Cc: linux-kernel@vger.kernel.org, Borislav Petkov , Kees Cook , Brian Gerst , Andy Lutomirski Subject: [PATCH 6/7] x86/uaccess: Don't fix up USER_DS uaccess faults to kernel addresses Date: Tue, 24 May 2016 15:48:43 -0700 Message-Id: X-Mailer: git-send-email 2.5.5 In-Reply-To: References: In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If a uaccess in USER_DS mode faults on a kernel address, it is reasonably like to be an exploitable bug. Make it more obvious in testing and make it harder to exploit in practice by letting it OOPS. Signed-off-by: Andy Lutomirski --- arch/x86/mm/extable.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c index c1933471fce7..818cc7ffef79 100644 --- a/arch/x86/mm/extable.c +++ b/arch/x86/mm/extable.c @@ -29,6 +29,8 @@ EXPORT_SYMBOL(ex_handler_default); static bool uaccess_fault_okay(int trapnr, unsigned long error_code, unsigned long extra) { + bool is_user_ds; + /* * For uaccess, only page faults should be fixed up. I can't see * any exploit mitigation value in OOPSing on other types of faults, @@ -42,6 +44,22 @@ static bool uaccess_fault_okay(int trapnr, unsigned long error_code, trapnr)) return true; /* no good reason to OOPS. */ + /* + * This is a page fault, so extra contains the address we failed to + * access. + */ + is_user_ds = segment_eq(get_fs(), USER_DS); + + if (unlikely(is_user_ds && extra >= TASK_SIZE_MAX)) { + /* + * We accessed out out-of-range address with USER_DS. Force + * an OOPS: if we just warned, then an attacker could trigger + * this repeatedly to learn the kernel memory layout. + */ + pr_crit("BUG: uaccess to bad address 0x%lx (missing access_ok check)\n", extra); + return false; + } + return true; } -- 2.5.5