From: Pavel Tatashin <pasha.tatashin@soleen.com>
To: pasha.tatashin@soleen.com, jmorris@namei.org, sashal@kernel.org,
linux-kernel@vger.kernel.org, catalin.marinas@arm.com,
will@kernel.org, steve.capper@arm.com,
linux-arm-kernel@lists.infradead.org, marc.zyngier@arm.com,
james.morse@arm.com, vladimir.murzin@arm.com,
mark.rutland@arm.com, tglx@linutronix.de,
gregkh@linuxfoundation.org, allison@lohutok.net, info@metux.net,
alexios.zavras@intel.com
Subject: [PATCH] arm64: kernel: memory corruptions due non-disabled PAN
Date: Tue, 19 Nov 2019 17:10:06 -0500 [thread overview]
Message-ID: <20191119221006.1021520-1-pasha.tatashin@soleen.com> (raw)
Userland access functions (__arch_clear_user, __arch_copy_from_user,
__arch_copy_in_user, __arch_copy_to_user), enable and disable PAN
for the duration of copy. However, when copy fails for some reason,
i.e. access violation the code is transferred to fixedup section,
where we do not disable PAN.
The bug is a security violation as the access to userland is still
open when it should be disabled, but it also causes memory corruptions
when software emulated PAN is used: CONFIG_ARM64_SW_TTBR0_PAN=y.
I was able to reproduce memory corruption problem on Broadcom's SoC
ARMv8-A like this:
Enable software perf-events with PERF_SAMPLE_CALLCHAIN so userland's
stack is accessed and copied.
The test program performed the following on every CPU and forking many
processes:
unsigned long *map = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE,
MAP_SHARED | MAP_ANONYMOUS, -1, 0);
map[0] = getpid();
sched_yield();
if (map[0] != getpid()) {
fprintf(stderr, "Corruption detected!");
}
munmap(map, PAGE_SIZE);
From time to time I was getting map[0] to contain pid for a different
process.
Fixes: 338d4f49d6f7114 ("arm64: kernel: Add support for Privileged...")
Signed-off-by: Pavel Tatashin <pasha.tatashin@soleen.com>
---
arch/arm64/lib/clear_user.S | 1 +
arch/arm64/lib/copy_from_user.S | 1 +
arch/arm64/lib/copy_in_user.S | 1 +
arch/arm64/lib/copy_to_user.S | 1 +
4 files changed, 4 insertions(+)
diff --git a/arch/arm64/lib/clear_user.S b/arch/arm64/lib/clear_user.S
index 10415572e82f..322b55664cca 100644
--- a/arch/arm64/lib/clear_user.S
+++ b/arch/arm64/lib/clear_user.S
@@ -48,5 +48,6 @@ EXPORT_SYMBOL(__arch_clear_user)
.section .fixup,"ax"
.align 2
9: mov x0, x2 // return the original size
+ uaccess_disable_not_uao x2, x3
ret
.previous
diff --git a/arch/arm64/lib/copy_from_user.S b/arch/arm64/lib/copy_from_user.S
index 680e74409ff9..8472dc7798b3 100644
--- a/arch/arm64/lib/copy_from_user.S
+++ b/arch/arm64/lib/copy_from_user.S
@@ -66,5 +66,6 @@ EXPORT_SYMBOL(__arch_copy_from_user)
.section .fixup,"ax"
.align 2
9998: sub x0, end, dst // bytes not copied
+ uaccess_disable_not_uao x3, x4
ret
.previous
diff --git a/arch/arm64/lib/copy_in_user.S b/arch/arm64/lib/copy_in_user.S
index 0bedae3f3792..8e0355c1e318 100644
--- a/arch/arm64/lib/copy_in_user.S
+++ b/arch/arm64/lib/copy_in_user.S
@@ -68,5 +68,6 @@ EXPORT_SYMBOL(__arch_copy_in_user)
.section .fixup,"ax"
.align 2
9998: sub x0, end, dst // bytes not copied
+ uaccess_disable_not_uao x3, x4
ret
.previous
diff --git a/arch/arm64/lib/copy_to_user.S b/arch/arm64/lib/copy_to_user.S
index 2d88c736e8f2..6085214654dc 100644
--- a/arch/arm64/lib/copy_to_user.S
+++ b/arch/arm64/lib/copy_to_user.S
@@ -65,5 +65,6 @@ EXPORT_SYMBOL(__arch_copy_to_user)
.section .fixup,"ax"
.align 2
9998: sub x0, end, dst // bytes not copied
+ uaccess_disable_not_uao x3, x4
ret
.previous
--
2.24.0
next reply other threads:[~2019-11-19 22:10 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-19 22:10 Pavel Tatashin [this message]
2019-11-20 16:43 ` [PATCH] arm64: kernel: memory corruptions due non-disabled PAN Mark Rutland
2019-11-20 16:55 ` Pavel Tatashin
2019-11-20 19:46 ` Pavel Tatashin
2019-11-20 19:52 ` Pavel Tatashin
2019-11-20 19:16 ` Will Deacon
2019-11-20 19:46 ` Pavel Tatashin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191119221006.1021520-1-pasha.tatashin@soleen.com \
--to=pasha.tatashin@soleen.com \
--cc=alexios.zavras@intel.com \
--cc=allison@lohutok.net \
--cc=catalin.marinas@arm.com \
--cc=gregkh@linuxfoundation.org \
--cc=info@metux.net \
--cc=james.morse@arm.com \
--cc=jmorris@namei.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=marc.zyngier@arm.com \
--cc=mark.rutland@arm.com \
--cc=sashal@kernel.org \
--cc=steve.capper@arm.com \
--cc=tglx@linutronix.de \
--cc=vladimir.murzin@arm.com \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).