Messages in this thread | | | Date | Wed, 28 Oct 2015 06:25:05 +0900 | Subject | Re: [PATCH] lkdtm: fix ACCESS_USERSPACE test | From | Kees Cook <> |
| |
On Wed, Oct 28, 2015 at 5:47 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote: > Add a copy_to_user() call to the ACCESS_USERSPACE test > prior to attempting direct dereferencing of the user > address to ensure the page is present. Otherwise, > a fault occurs on arm kernels even prior to the introduction > of CONFIG_CPU_SW_DOMAIN_PAN, and there is no difference in > behavior for CONFIG_CPU_SW_DOMAIN_PAN=n vs CONFIG_CPU_SW_DOMAIN_PAN=y. > > Before this change, for any value of CONFIG_CPU_SW_DOMAIN_PAN: > lkdtm: Performing direct entry ACCESS_USERSPACE > lkdtm: attempting bad read at b6fe8000 > Unable to handle kernel paging request at virtual address b6fe8000 > > After this change, for CONFIG_CPU_SW_DOMAIN_PAN=n: > lkdtm: Performing direct entry ACCESS_USERSPACE > lkdtm: attempting bad read at b6efc000 > lkdtm: attempting bad write at b6efc000 > > After this change, for CONFIG_CPU_SW_DOMAIN_PAN=y: > lkdtm: Performing direct entry ACCESS_USERSPACE > lkdtm: attempting bad read at b6f7d000 > Unhandled fault: page domain fault (0x01b) at 0xb6f7d000 > ... > > Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Great catch! In looking at this test again, I wonder if ACCESS_USERSPACE should be split so that read and write can be tested separately...
Acked-by: Kees Cook <keescook@chromium.org>
-Kees
> --- > drivers/misc/lkdtm.c | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > > diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c > index b5abe34..11fdadc 100644 > --- a/drivers/misc/lkdtm.c > +++ b/drivers/misc/lkdtm.c > @@ -472,7 +472,7 @@ static void lkdtm_do_action(enum ctype which) > break; > } > case CT_ACCESS_USERSPACE: { > - unsigned long user_addr, tmp; > + unsigned long user_addr, tmp = 0; > unsigned long *ptr; > > user_addr = vm_mmap(NULL, 0, PAGE_SIZE, > @@ -483,6 +483,12 @@ static void lkdtm_do_action(enum ctype which) > return; > } > > + if (copy_to_user((void __user *)user_addr, &tmp, sizeof(tmp))) { > + pr_warn("copy_to_user failed\n"); > + vm_munmap(user_addr, PAGE_SIZE); > + return; > + } > + > ptr = (unsigned long *)user_addr; > > pr_info("attempting bad read at %p\n", ptr); > -- > 2.4.3 >
-- Kees Cook Chrome OS Security
| |