lkml.org 
[lkml]   [2017]   [Feb]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: <Query> Looking more details and reasons for using orig_add_limit.
On Tue, Feb 14, 2017 at 09:52:30PM -0800, Sodagudi Prasad wrote:
>
> Hi All,
>
> Would like to understand the reasons behind using the orig_add_limit
> variable in the following code. Can you please share more details ?
>
> "arch/arm64/mm/fault.c"
> static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
> struct pt_regs *regs)
> {
> …
> …
> …
> if (addr < USER_DS && is_permission_fault(esr, regs)) {
> =====>> condition_1
> /* regs->orig_addr_limit may be 0 if we entered from EL0 */
> if (regs->orig_addr_limit == KERNEL_DS)
> =====>> condition_2
> die("Accessing user space memory with fs=KERNEL_DS",
> regs, esr);
>
> if (is_el1_instruction_abort(esr))
> die("Attempting to execute userspace memory", regs,
> esr);
>
> if (!search_exception_tables(regs->pc))
> die("Accessing user space memory outside uaccess.h
> routines", regs, esr);
> }
>
>
> When any sys call is made from user space orig_addr_limit will be zero and
> after that driver is calling set_fs(KERNEL_DS) and then copy_to_user() to
> user space memory. If there is permission fault for user space address the
> above condition is leading to kernel crash. Because orig_add_limit is having
> KERNEL_DS as set_fs called before copy_to_user().

Which driver is setting KERNEL_DS prior to accessing userspace and why? It
sounds broken to me. I also don't think it will work with PAN + UAO enabled.

Will

\
 
 \ /
  Last update: 2017-02-15 12:39    [W:0.102 / U:0.184 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site