On Wed, Jan 2, 2019 at 12:41 PM akpm@linux-foundation.org wrote:
The patch titled Subject: mm/usercopy.c: no check page span for stack objects has been added to the -mm tree. Its filename is usercopy-no-check-page-span-for-stack-objects.patch
This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/usercopy-no-check-page-span-for-sta... and later at http://ozlabs.org/~akpm/mmotm/broken-out/usercopy-no-check-page-span-for-sta...
Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated there every 3-4 working days
From: Qian Cai cai@lca.pw Subject: mm/usercopy.c: no check page span for stack objects
It is easy to trigger this with CONFIG_HARDENED_USERCOPY_PAGESPAN=y,
usercopy: Kernel memory overwrite attempt detected to spans multiple pages (offset 0, size 23)! kernel BUG at mm/usercopy.c:102!
For example,
print_worker_info char name[WQ_NAME_LEN] = { }; char desc[WORKER_DESC_LEN] = { }; probe_kernel_read(name, wq->name, sizeof(name) - 1); probe_kernel_read(desc, worker->desc, sizeof(desc) - 1); __copy_from_user_inatomic check_object_size check_heap_object check_page_span
This is because on-stack variables could cross PAGE_SIZE boundary, and failed this check,
if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) == ((unsigned long)end & (unsigned long)PAGE_MASK)))
ptr = FFFF889007D7EFF8 end = FFFF889007D7F00E
Hence, fix it by checking if it is a stack object first.
Link: http://lkml.kernel.org/r/20181231030254.99441-1-cai@lca.pw Signed-off-by: Qian Cai cai@lca.pw Cc: Kees Cook keescook@chromium.org Cc: stable@vger.kernel.org Signed-off-by: Andrew Morton akpm@linux-foundation.org
Acked-by: Kees Cook keescook@chromium.org
I was planning on doing this already, so yes please. :) I do want to include a comment update as well. I'll send that as a fix.
-Kees
mm/usercopy.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
--- a/mm/usercopy.c~usercopy-no-check-page-span-for-stack-objects +++ a/mm/usercopy.c @@ -262,9 +262,6 @@ void __check_object_size(const void *ptr /* Check for invalid addresses. */ check_bogus_address((const unsigned long)ptr, n, to_user);
/* Check for bad heap object. */check_heap_object(ptr, n, to_user);/* Check for bad stack object. */ switch (check_stack_object(ptr, n)) { case NOT_STACK:@@ -282,6 +279,9 @@ void __check_object_size(const void *ptr usercopy_abort("process stack", NULL, to_user, 0, n); }
/* Check for bad heap object. */check_heap_object(ptr, n, to_user);/* Check for object in kernel to avoid text exposure. */ check_kernel_text_object((const unsigned long)ptr, n, to_user);} _
Patches currently in -mm which might be from cai@lca.pw are
mm-page_owner-fix-for-deferred-struct-page-init.patch usercopy-no-check-page-span-for-stack-objects.patch