From: Mark Salyzyn <salyzyn@android.com>
To: linux-kernel@vger.kernel.org
Cc: Kevin Brodsky <kevin.brodsky@arm.com>,
Mark Salyzyn <salyzyn@android.com>,
James Morse <james.morse@arm.com>,
Russell King <linux@armlinux.org.uk>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>,
Andy Lutomirski <luto@amacapital.net>,
Dmitry Safonov <dsafonov@virtuozzo.com>,
John Stultz <john.stultz@linaro.org>,
Mark Rutland <mark.rutland@arm.com>,
Laura Abbott <labbott@redhat.com>,
Kees Cook <keescook@chromium.org>,
Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Andy Gross <andy.gross@linaro.org>,
Andrew Pinski <apinski@cavium.com>,
Thomas Gleixner <tglx@linutronix.de>,
linux-arm-kernel@lists.infradead.org,
Jeremy Linton <Jeremy.Linton@arm.com>,
Marc Zyngier <marc.zyngier@arm.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Masahiro Yamada <yamada.masahiro@socionext.com>
Subject: RESEND [PATCH v2 3/3] arm64: compat: Add CONFIG_KUSER_HELPERS
Date: Mon, 18 Jun 2018 08:06:02 -0700 [thread overview]
Message-ID: <20180618150613.10322-17-salyzyn@android.com> (raw)
In-Reply-To: <20180618150613.10322-1-salyzyn@android.com>
From: Kevin Brodsky <kevin.brodsky@arm.com>
Make it possible to disable the kuser helpers by adding a KUSER_HELPERS
config option (enabled by default). When disabled, all kuser
helpers-related code is removed from the kernel and no mapping is done
at the fixed high address (0xffff0000); any attempt to use a kuser
helper from a 32-bit process will result in a segfault.
Signed-off-by: Kevin Brodsky <kevin.brodsky@arm.com>
Signed-off-by: Mark Salyzyn <salyzyn@android.com>
Cc: James Morse <james.morse@arm.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Dmitry Safonov <dsafonov@virtuozzo.com>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Laura Abbott <labbott@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Andy Gross <andy.gross@linaro.org>
Cc: Andrew Pinski <apinski@cavium.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Cc: linux-arm-kernel@lists.infradead.org
Cc: Jeremy Linton <Jeremy.Linton@arm.com>
v2:
- split off assembler changes to a new previous patch in series to reduce churn
- modify slightly the feature documentation to reduce its reach
- modify slightly the feature documentation to rationalize the yes default.
- There are more ifdefs as a result of the rebase.
v3:
- rebase
---
arch/arm64/Kconfig | 30 ++++++++++++++++++++++++++++++
arch/arm64/kernel/Makefile | 2 +-
arch/arm64/kernel/vdso.c | 10 ++++++++++
3 files changed, 41 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 42c090cf0292..11b4c6aef7d7 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -1296,6 +1296,36 @@ config COMPAT
If you want to execute 32-bit userspace applications, say Y.
+config KUSER_HELPERS
+ bool "Enable the kuser helpers page in 32-bit processes"
+ depends on COMPAT
+ default y
+ help
+ Warning: disabling this option may break 32-bit applications.
+
+ Provide kuser helpers in a special purpose fixed-address page. The
+ kernel provides helper code to userspace in read-only form at a fixed
+ location to allow userspace to be independent of the CPU type fitted
+ to the system. This permits 32-bit binaries to be run on ARMv6 through
+ to ARMv8 without modification.
+
+ See Documentation/arm/kernel_user_helpers.txt for details.
+
+ However, the fixed-address nature of these helpers can be used by ROP
+ (return-orientated programming) authors when creating exploits.
+
+ If all of the 32-bit binaries and libraries that run on your platform
+ are built specifically for your platform, and make no use of these
+ helpers, then you can turn this option off to hinder such exploits.
+ However, in that case, if a binary or library relying on those helpers
+ is run, it will receive a SIGSEGV signal, which will terminate the
+ program. Typically, binaries compiled for ARMv7 or later do not use
+ the kuser helpers.
+
+ Say N here only if you are absolutely certain that you do not need
+ these helpers; otherwise, the safe option is to say Y (the default
+ for now)
+
config SYSVIPC_COMPAT
def_bool y
depends on COMPAT && SYSVIPC
diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
index 9851be3ef932..c16be3cf39bf 100644
--- a/arch/arm64/kernel/Makefile
+++ b/arch/arm64/kernel/Makefile
@@ -29,7 +29,7 @@ $(obj)/%.stub.o: $(obj)/%.o FORCE
arm64-obj-$(CONFIG_COMPAT) += sys32.o signal32.o \
sys_compat.o entry32.o
arm64-obj-$(CONFIG_COMPAT) += sigreturn32.o
-arm64-obj-$(CONFIG_COMPAT) += kuser32.o
+arm64-obj-$(CONFIG_KUSER_HELPERS) += kuser32.o
arm64-obj-$(CONFIG_FUNCTION_TRACER) += ftrace.o entry-ftrace.o
arm64-obj-$(CONFIG_MODULES) += arm64ksyms.o module.o
arm64-obj-$(CONFIG_ARM64_MODULE_PLTS) += module-plts.o
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 5398f6454ce1..76a94bed4bd5 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -62,18 +62,22 @@ static const struct vm_special_mapping compat_vdso_spec[] = {
.name = "[sigpage]",
.pages = &vectors_page[0],
},
+#ifdef CONFIG_KUSER_HELPERS
{
.name = "[kuserhelpers]",
.pages = &vectors_page[1],
},
+#endif
};
static struct page *vectors_page[ARRAY_SIZE(compat_vdso_spec)] __ro_after_init;
static int __init alloc_vectors_page(void)
{
+#ifdef CONFIG_KUSER_HELPERS
extern char __kuser_helper_start[], __kuser_helper_end[];
size_t kuser_sz = __kuser_helper_end - __kuser_helper_start;
unsigned long kuser_vpage;
+#endif
extern char __aarch32_sigret_code_start[], __aarch32_sigret_code_end[];
size_t sigret_sz =
@@ -84,22 +88,26 @@ static int __init alloc_vectors_page(void)
if (!sigret_vpage)
return -ENOMEM;
+#ifdef CONFIG_KUSER_HELPERS
kuser_vpage = get_zeroed_page(GFP_ATOMIC);
if (!kuser_vpage) {
free_page(sigret_vpage);
return -ENOMEM;
}
+#endif
/* sigreturn code */
memcpy((void *)sigret_vpage, __aarch32_sigret_code_start, sigret_sz);
flush_icache_range(sigret_vpage, sigret_vpage + PAGE_SIZE);
vectors_page[0] = virt_to_page(sigret_vpage);
+#ifdef CONFIG_KUSER_HELPERS
/* kuser helpers */
memcpy((void *)kuser_vpage + 0x1000 - kuser_sz, __kuser_helper_start,
kuser_sz);
flush_icache_range(kuser_vpage, kuser_vpage + PAGE_SIZE);
vectors_page[1] = virt_to_page(kuser_vpage);
+#endif
return 0;
}
@@ -128,11 +136,13 @@ int aarch32_setup_vectors_page(struct linux_binprm *bprm, int uses_interp)
current->mm->context.vdso = (void *)addr;
+#ifdef CONFIG_KUSER_HELPERS
/* Map the kuser helpers at the ABI-defined high address. */
ret = _install_special_mapping(mm, AARCH32_KUSER_HELPERS_BASE,
PAGE_SIZE,
VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC,
&compat_vdso_spec[1]);
+#endif
out:
up_write(&mm->mmap_sem);
--
2.18.0.rc1.244.gcf134e6275-goog
next prev parent reply other threads:[~2018-06-18 15:09 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-06-18 15:05 RESEND arm+arm64+aarch32 vdso rewrite Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 01/12] arm: vdso: rename vdso_datapage variables Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 02/12] arm: vdso: add include file defining __get_datapage() Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 03/12] arm: vdso: inline assembler operations to compiler.h Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 04/12] arm: vdso: do calculations outside reader loops Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v6 05/12] arm: vdso: Add support for CLOCK_MONOTONIC_RAW Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 06/12] arm: vdso: add support for clock_getres Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 07/12] arm: vdso: disable profiling Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 08/12] arm: vdso: Add ARCH_CLOCK_FIXED_MASK Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 09/12] arm: vdso: move vgettimeofday.c to lib/vdso/ Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 10/12] arm64: vdso: replace gettimeofday.S with global vgettimeofday.C Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v6 11/12] lib: vdso: Add support for CLOCK_BOOTTIME Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH v5 12/12] lib: vdso: do not expose gettimeofday, if no arch supported timer Mark Salyzyn
2018-06-18 15:05 ` RESEND [PATCH] lib: vdso: add support for time Mark Salyzyn
2018-06-18 15:06 ` RESEND [PATCH v2 1/3] arm64: compat: Split the sigreturn trampolines and kuser helpers (C sources) Mark Salyzyn
2018-06-18 15:06 ` RESEND [PATCH v2 2/3] arm64: compat: Split the sigreturn trampolines and kuser helpers (assembler sources) Mark Salyzyn
2018-06-18 15:06 ` Mark Salyzyn [this message]
2018-06-18 15:06 ` RESEND [PATCH] arm64: compat: Expose offset to registers in sigframes Mark Salyzyn
2018-06-18 15:06 ` RESEND [PATCH 1/6] arm64: compat: Use vDSO sigreturn trampolines if available Mark Salyzyn
2018-06-18 15:06 ` RESEND [PATCH 2/6] arm64: elf: Set AT_SYSINFO_EHDR in compat processes Mark Salyzyn
2018-06-18 15:06 ` RESEND [PATCH 3/6] arm64: Refactor vDSO init/setup Mark Salyzyn
2018-06-18 15:06 ` RESEND [PATCH v2 4/6] arm64: compat: Add a 32-bit vDSO Mark Salyzyn
2018-06-18 15:06 ` RESEND [PATCH 5/6] arm64: compat: 32-bit vDSO setup Mark Salyzyn
2018-06-18 15:06 ` RESEND [PATCH 6/6] arm64: Wire up and expose the new compat vDSO Mark Salyzyn
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180618150613.10322-17-salyzyn@android.com \
--to=salyzyn@android.com \
--cc=Jeremy.Linton@arm.com \
--cc=andy.gross@linaro.org \
--cc=apinski@cavium.com \
--cc=ard.biesheuvel@linaro.org \
--cc=catalin.marinas@arm.com \
--cc=dsafonov@virtuozzo.com \
--cc=gregkh@linuxfoundation.org \
--cc=james.morse@arm.com \
--cc=john.stultz@linaro.org \
--cc=keescook@chromium.org \
--cc=kevin.brodsky@arm.com \
--cc=labbott@redhat.com \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=luto@amacapital.net \
--cc=marc.zyngier@arm.com \
--cc=mark.rutland@arm.com \
--cc=tglx@linutronix.de \
--cc=will.deacon@arm.com \
--cc=yamada.masahiro@socionext.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).