From: James Hogan <james.hogan@imgtec.com>
To: <linux-kernel@vger.kernel.org>
Cc: <linux-arch@vger.kernel.org>,
James Hogan <james.hogan@imgtec.com>,
"Kees Cook" <keescook@chromium.org>,
Andrew Morton <akpm@linux-foundation.org>
Subject: [PATCH v2 10/11] test_user_copy: Check user compatibility accessors
Date: Fri, 7 Aug 2015 16:22:03 +0100 [thread overview]
Message-ID: <1438960924-23628-11-git-send-email-james.hogan@imgtec.com> (raw)
In-Reply-To: <1438960924-23628-1-git-send-email-james.hogan@imgtec.com>
Add basic success/failure checking of user accessors used by 32-bit
compatibility code. This includes copy_in_user() which copies data from
userspace to userspace (or kernel to kernel), its unchecking friend
__copy_in_user which assume that access_ok() has already been used,
and __get_user_unaligned() / __put_user_unaligned().
These might not be provided for architectures which don't need 32-bit
compatibility syscalls, so they are tested conditional upon
CONFIG_COMPAT.
The following cases are checked:
- __copy_in_user/copy_in_user from user to user should succeed.
- __copy_in_user/copy_in_user involving 1 or 2 kernel pointers should
not succeed.
- __copy_in_user/copy_in_user from kernel to kernel should succeed when
user address limit is set for kernel accesses.
- __get_user_unaligned/__put_user_unaligned with user pointer should
succeed.
- __get_user_unaligned/__put_user_unaligned with kernel pointer should
not succeed.
- __get_user_unaligned/__put_user_unaligned with kernel pointer succeed
when user address limit is set for kernel accesses.
New tests:
- legitimate copy_in_user
- legitimate __copy_in_user
- legitimate __get_user_unaligned
- legitimate __put_user_unaligned
- illegal all-kernel copy_in_user
- illegal copy_in_user to kernel
- illegal copy_in_user from kernel
- illegal all-kernel __copy_in_user
- illegal __copy_in_user to kernel
- illegal __copy_in_user from kernel
- illegal __get_user_unaligned
- illegal __put_user_unaligned
- legitimate all-kernel copy_in_user
- legitimate all-kernel __copy_in_user
- legitimate kernel __get_user_unaligned
- legitimate kernel __put_user_unaligned
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
---
Changes in v2:
- Conditionalise on CONFIG_COMPAT, otherwise it breaks build on some
32-bit arches e.g. i386 (kbuild test robot).
- Add testing of _unaligned accessors, which are also conditional upon
CONFIG_COMPAT.
---
lib/test_user_copy.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 60 insertions(+)
diff --git a/lib/test_user_copy.c b/lib/test_user_copy.c
index 56af2439d2be..ebaa28d2c8bd 100644
--- a/lib/test_user_copy.c
+++ b/lib/test_user_copy.c
@@ -74,6 +74,10 @@ static int __init test_user_copy_init(void)
"legitimate strncpy_from_user failed");
ret |= test(strnlen_user(usermem, PAGE_SIZE) == 0,
"legitimate strnlen_user failed");
+#ifdef CONFIG_COMPAT
+ ret |= test(copy_in_user(usermem, usermem + PAGE_SIZE, PAGE_SIZE),
+ "legitimate copy_in_user failed");
+#endif
ret |= test(!access_ok(VERIFY_READ, usermem, PAGE_SIZE * 2),
"legitimate access_ok VERIFY_READ failed");
@@ -93,6 +97,16 @@ static int __init test_user_copy_init(void)
"legitimate __put_user failed");
ret |= test(__clear_user(usermem, PAGE_SIZE) != 0,
"legitimate __clear_user passed");
+#ifdef CONFIG_COMPAT
+ ret |= test(__copy_in_user(usermem, usermem + PAGE_SIZE, PAGE_SIZE),
+ "legitimate __copy_in_user failed");
+ ret |= test(__get_user_unaligned(value,
+ (unsigned long __user *)(usermem + 1)),
+ "legitimate __get_user_unaligned failed");
+ ret |= test(__put_user_unaligned(value,
+ (unsigned long __user *)(usermem + 1)),
+ "legitimate __put_user_unaligned failed");
+#endif
/* Invalid usage: none of these should succeed. */
ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE),
@@ -121,6 +135,17 @@ static int __init test_user_copy_init(void)
"illegal reversed strncpy_from_user passed");
ret |= test(strnlen_user((char __user *)kmem, PAGE_SIZE) != 0,
"illegal strnlen_user passed");
+#ifdef CONFIG_COMPAT
+ ret |= test(!copy_in_user((char __user *)kmem,
+ (char __user *)(kmem + PAGE_SIZE), PAGE_SIZE),
+ "illegal all-kernel copy_in_user passed");
+ ret |= test(!copy_in_user((char __user *)kmem, usermem,
+ PAGE_SIZE),
+ "illegal copy_in_user to kernel passed");
+ ret |= test(!copy_in_user(usermem, (char __user *)kmem,
+ PAGE_SIZE),
+ "illegal copy_in_user from kernel passed");
+#endif
/*
* If unchecked user accesses (__*) on this architecture cannot access
@@ -165,6 +190,24 @@ static int __init test_user_copy_init(void)
"illegal __put_user passed");
ret |= test(__clear_user((char __user *)kmem, PAGE_SIZE) != PAGE_SIZE,
"illegal kernel __clear_user passed");
+#ifdef CONFIG_COMPAT
+ ret |= test(!__copy_in_user((char __user *)kmem,
+ (char __user *)(kmem + PAGE_SIZE),
+ PAGE_SIZE),
+ "illegal all-kernel __copy_in_user passed");
+ ret |= test(!__copy_in_user((char __user *)kmem, usermem,
+ PAGE_SIZE),
+ "illegal __copy_in_user to kernel passed");
+ ret |= test(!__copy_in_user(usermem, (char __user *)kmem,
+ PAGE_SIZE),
+ "illegal __copy_in_user from kernel passed");
+ ret |= test(!__get_user_unaligned(value,
+ (unsigned long __user *)(kmem + 1)),
+ "illegal __get_user_unaligned passed");
+ ret |= test(!__put_user_unaligned(value,
+ (unsigned long __user *)(kmem + 1)),
+ "illegal __put_user_unaligned passed");
+#endif
#endif
/*
@@ -192,6 +235,11 @@ static int __init test_user_copy_init(void)
"legitimate all-kernel strncpy_from_user failed");
ret |= test(strnlen_user((char __user *)kmem, PAGE_SIZE) == 0,
"legitimate kernel strnlen_user failed");
+#ifdef CONFIG_COMPAT
+ ret |= test(copy_in_user((char __user *)kmem,
+ (char __user *)(kmem + PAGE_SIZE), PAGE_SIZE),
+ "legitimate all-kernel copy_in_user failed");
+#endif
ret |= test(!access_ok(VERIFY_READ, (char __user *)kmem, PAGE_SIZE * 2),
"legitimate kernel access_ok VERIFY_READ failed");
@@ -217,6 +265,18 @@ static int __init test_user_copy_init(void)
"legitimate kernel __put_user failed");
ret |= test(__clear_user((char __user *)kmem, PAGE_SIZE) != 0,
"legitimate kernel __clear_user failed");
+#ifdef CONFIG_COMPAT
+ ret |= test(__copy_in_user((char __user *)kmem,
+ (char __user *)(kmem + PAGE_SIZE),
+ PAGE_SIZE),
+ "legitimate all-kernel __copy_in_user failed");
+ ret |= test(__get_user_unaligned(value,
+ (unsigned long __user *)(kmem + 1)),
+ "legitimate kernel __get_user_unaligned failed");
+ ret |= test(__put_user_unaligned(value,
+ (unsigned long __user *)(kmem + 1)),
+ "legitimate kernel __put_user_unaligned failed");
+#endif
/* Restore previous address limit. */
set_fs(fs);
--
2.3.6
next prev parent reply other threads:[~2015-08-07 15:22 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-08-07 15:21 [PATCH v2 00/11] test_user_copy improvements James Hogan
2015-08-07 15:21 ` [PATCH v2 01/11] microblaze: Export __strnlen_user to modules James Hogan
2015-08-07 15:21 ` [PATCH v2 02/11] nios2: Export strncpy_from_user / strnlen_user " James Hogan
2015-08-10 8:10 ` Ley Foon Tan
2015-08-07 15:21 ` [PATCH v2 03/11] openrisc: Export __clear_user " James Hogan
2015-08-07 15:21 ` [PATCH v2 04/11] xtensa: Export __strnlen_user " James Hogan
2015-08-07 15:21 ` [PATCH v2 05/11] test_user_copy: Check legit kernel accesses James Hogan
2015-08-07 15:21 ` [PATCH v2 06/11] test_user_copy: Check unchecked accessors James Hogan
2015-08-07 15:22 ` [PATCH v2 07/11] test_user_copy: Check __copy_{to,from}_user_inatomic() James Hogan
2015-08-07 15:22 ` [PATCH v2 08/11] test_user_copy: Check __clear_user()/clear_user() James Hogan
2015-08-07 15:22 ` [PATCH v2 09/11] test_user_copy: Check user string accessors James Hogan
2015-08-07 15:22 ` James Hogan [this message]
2015-08-07 15:22 ` [PATCH v2 11/11] test_user_copy: Check user checksum functions James Hogan
2015-08-07 23:51 ` [PATCH v2 00/11] test_user_copy improvements Kees Cook
2015-08-10 22:29 ` David Miller
2015-08-11 4:08 ` David Miller
2015-08-11 11:20 ` Geert Uytterhoeven
2015-08-12 21:34 ` David Miller
2015-08-11 11:07 ` James Hogan
2015-08-11 17:32 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1438960924-23628-11-git-send-email-james.hogan@imgtec.com \
--to=james.hogan@imgtec.com \
--cc=akpm@linux-foundation.org \
--cc=keescook@chromium.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).