linux-kernel - Re: access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 14 Jul 2009 19:13:20 +0200
From:	Arnd Bergmann <arnd@...db.de>
To:	monstr@...str.eu
Cc:	Linux Kernel list <linux-kernel@...r.kernel.org>,
	LTP <ltp-list@...ts.sourceforge.net>
Subject: Re: access_ok macor

On Tuesday 14 July 2009, Michal Simek wrote:
> when the code tried to read/write from unaligned address (and in cpu is turn on unaligned exception)
> then is caused unaligned exception and asm code assemble/return value which is on that unaligned
> address. (Assemble it that read/write every byte separately). That will be harder to prevent all
> this cases because unaligned exception is in generic code.
> What do you mean add __range_ok? Range checking is ok. The problem is when in case get_user kernel
> try to load unaligned addr - unaligned exception is perform and try to load that value separately.
> If that page is not there, page fault handler is called and not find it, it is performed search
> from exception table and that address is not there of course - because address in pc is generic
> unaligned code. I think that handling this needs more code.
> Maybe if the address with from unaligned exception handler (there are some address which can caused
> it) and find out which aligned address is there and find out proper fixup for it.
> I think that this could work.
> 
> What do you think?

I think the key point is that the kernel should never try an unaligned
access. Other architectures already rely on this, so you can too.
Instead of doing an aligned access from the unaligned exception handler,
you should not access the data at all when you come from kernel mode
but only search the fixup table to see if you should continue anyway.

Sorry for adding confusion by mentioning the __range_ok, which is addressing
a separate problem. I should have made that clearer.

In pseudo-code, I think you should do:

void unaligned_exception(struct pt_regs *regs, unsigned long address)
{
	if (kernel_mode(regs)) {
		/*
		 * unaligned access not allowed in kernel,
		 * but search exception table.
		 */
		bad_page_fault(regs, address, 0);
	} else {
		if (!access_ok(address, 4))
			force_sig(SIGBUS, current);
		else
			fixup_unaligned_access(regs);
	}
}

	Arnd <><
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/