From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
Muhammad Usama Anjum <usama.anjum@collabora.com>,
Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 5.15 04/51] lkdtm/usercopy: Expand size of "out of frame" object
Date: Tue, 7 Jun 2022 13:55:03 -0400 [thread overview]
Message-ID: <20220607175552.479948-4-sashal@kernel.org> (raw)
In-Reply-To: <20220607175552.479948-1-sashal@kernel.org>
From: Kees Cook <keescook@chromium.org>
[ Upstream commit f387e86d3a74407bdd9c5815820ac9d060962840 ]
To be sufficiently out of range for the usercopy test to see the lifetime
mismatch, expand the size of the "bad" buffer, which will let it be
beyond current_stack_pointer regardless of stack growth direction.
Paired with the recent addition of stack depth checking under
CONFIG_HARDENED_USERCOPY=y, this will correctly start tripping again.
Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Link: https://lore.kernel.org/lkml/762faf1b-0443-5ddf-4430-44a20cf2ec4d@collabora.com/
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/lkdtm/usercopy.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
index 9161ce7ed47a..3fead5efe523 100644
--- a/drivers/misc/lkdtm/usercopy.c
+++ b/drivers/misc/lkdtm/usercopy.c
@@ -30,12 +30,12 @@ static const unsigned char test_text[] = "This is a test.\n";
*/
static noinline unsigned char *trick_compiler(unsigned char *stack)
{
- return stack + 0;
+ return stack + unconst;
}
static noinline unsigned char *do_usercopy_stack_callee(int value)
{
- unsigned char buf[32];
+ unsigned char buf[128];
int i;
/* Exercise stack to avoid everything living in registers. */
@@ -43,7 +43,12 @@ static noinline unsigned char *do_usercopy_stack_callee(int value)
buf[i] = value & 0xff;
}
- return trick_compiler(buf);
+ /*
+ * Put the target buffer in the middle of stack allocation
+ * so that we don't step on future stack users regardless
+ * of stack growth direction.
+ */
+ return trick_compiler(&buf[(128/2)-32]);
}
static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
@@ -66,6 +71,12 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
bad_stack -= sizeof(unsigned long);
}
+#ifdef ARCH_HAS_CURRENT_STACK_POINTER
+ pr_info("stack : %px\n", (void *)current_stack_pointer);
+#endif
+ pr_info("good_stack: %px-%px\n", good_stack, good_stack + sizeof(good_stack));
+ pr_info("bad_stack : %px-%px\n", bad_stack, bad_stack + sizeof(good_stack));
+
user_addr = vm_mmap(NULL, 0, PAGE_SIZE,
PROT_READ | PROT_WRITE | PROT_EXEC,
MAP_ANONYMOUS | MAP_PRIVATE, 0);
--
2.35.1
next prev parent reply other threads:[~2022-06-07 18:33 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-06-07 17:55 [PATCH AUTOSEL 5.15 01/51] iio: dummy: iio_simple_dummy: check the return value of kstrdup() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 02/51] staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 03/51] iio: st_sensors: Add a local lock for protecting odr Sasha Levin
2022-06-07 17:55 ` Sasha Levin [this message]
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 05/51] drivers: staging: rtl8723bs: Fix deadlock in rtw_surveydone_event_callback() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 06/51] drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 07/51] tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 08/51] tty: Fix a possible resource leak in icom_probe Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 09/51] thunderbolt: Use different lane for second DisplayPort tunnel Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 10/51] drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 11/51] drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 12/51] USB: host: isp116x: check return value after calling platform_get_resource() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 13/51] drivers: tty: serial: Fix deadlock in sa1100_set_termios() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 14/51] drivers: usb: host: Fix deadlock in oxu_bus_suspend() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 15/51] USB: hcd-pci: Fully suspend across freeze/thaw cycle Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 16/51] char: xillybus: fix a refcount leak in cleanup_dev() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 17/51] sysrq: do not omit current cpu when showing backtrace of all active CPUs Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 18/51] usb: dwc2: gadget: don't reset gadget's driver->bus Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 19/51] soundwire: qcom: adjust autoenumeration timeout Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 20/51] misc: rtsx: set NULL intfdata when probe fails Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 21/51] extcon: Fix extcon_get_extcon_dev() error handling Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 22/51] extcon: Modify extcon device to be created after driver data is set Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 23/51] clocksource/drivers/sp804: Avoid error on multiple instances Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 24/51] staging: rtl8723bs: Fix alignment to match open parenthesis Sasha Levin
2022-06-08 0:04 ` Joe Perches
2022-06-08 6:15 ` Greg Kroah-Hartman
2022-06-09 13:55 ` Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 25/51] staging: rtl8712: fix uninit-value in usb_read8() and friends Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 26/51] staging: rtl8712: fix uninit-value in r871xu_drv_init() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 27/51] serial: msm_serial: disable interrupts in __msm_console_write() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 28/51] accessiblity: speakup: Add missing misc_deregister in softsynth_probe Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 29/51] kernfs: Separate kernfs_pr_cont_buf and rename_lock Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 30/51] watchdog: wdat_wdt: Stop watchdog when rebooting the system Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 31/51] md: don't unregister sync_thread with reconfig_mutex held Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 32/51] md: protect md_unregister_thread from reentrancy Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 33/51] scsi: myrb: Fix up null pointer access on myrb_cleanup() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 34/51] Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 35/51] ceph: allow ceph.dir.rctime xattr to be updatable Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 36/51] ceph: flush the mdlog for filesystem sync Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 37/51] drm/amd/display: Check if modulo is 0 before dividing Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 38/51] drm/radeon: fix a possible null pointer dereference Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 39/51] drm/amd/pm: Fix missing thermal throttler status Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 40/51] um: line: Use separate IRQs per line Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 41/51] modpost: fix undefined behavior of is_arm_mapping_symbol() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 42/51] x86/cpu: Elide KCSAN for cpu_has() and friends Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 43/51] jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 44/51] nbd: call genl_unregister_family() first in nbd_cleanup() Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 45/51] nbd: fix race between nbd_alloc_config() and module removal Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 46/51] nbd: fix io hung while disconnecting device Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 47/51] fs/ntfs3: Fix invalid free in log_replay Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 48/51] s390/gmap: voluntarily schedule during key setting Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 49/51] cifs: version operations for smb20 unneeded when legacy support disabled Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 50/51] drm/amd/pm: use bitmap_{from,to}_arr32 where appropriate Sasha Levin
2022-06-07 17:55 ` [PATCH AUTOSEL 5.15 51/51] nodemask: Fix return values to be unsigned Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220607175552.479948-4-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=arnd@arndb.de \
--cc=gregkh@linuxfoundation.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=usama.anjum@collabora.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).