linux-kernel - [PATCH v2 10/11] test_user_copy: Check user compatibility accessors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 7 Aug 2015 16:22:03 +0100
From:	James Hogan <james.hogan@...tec.com>
To:	<linux-kernel@...r.kernel.org>
CC:	<linux-arch@...r.kernel.org>, James Hogan <james.hogan@...tec.com>,
	"Kees Cook" <keescook@...omium.org>,
	Andrew Morton <akpm@...ux-foundation.org>
Subject: [PATCH v2 10/11] test_user_copy: Check user compatibility accessors

Add basic success/failure checking of user accessors used by 32-bit
compatibility code. This includes copy_in_user() which copies data from
userspace to userspace (or kernel to kernel), its unchecking friend
__copy_in_user which assume that access_ok() has already been used,
and __get_user_unaligned() / __put_user_unaligned().

These might not be provided for architectures which don't need 32-bit
compatibility syscalls, so they are tested conditional upon
CONFIG_COMPAT.

The following cases are checked:
- __copy_in_user/copy_in_user from user to user should succeed.
- __copy_in_user/copy_in_user involving 1 or 2 kernel pointers should
  not succeed.
- __copy_in_user/copy_in_user from kernel to kernel should succeed when
  user address limit is set for kernel accesses.
- __get_user_unaligned/__put_user_unaligned with user pointer should
  succeed.
- __get_user_unaligned/__put_user_unaligned with kernel pointer should
  not succeed.
- __get_user_unaligned/__put_user_unaligned with kernel pointer succeed
  when user address limit is set for kernel accesses.

New tests:
- legitimate copy_in_user
- legitimate __copy_in_user
- legitimate __get_user_unaligned
- legitimate __put_user_unaligned
- illegal all-kernel copy_in_user
- illegal copy_in_user to kernel
- illegal copy_in_user from kernel
- illegal all-kernel __copy_in_user
- illegal __copy_in_user to kernel
- illegal __copy_in_user from kernel
- illegal __get_user_unaligned
- illegal __put_user_unaligned
- legitimate all-kernel copy_in_user
- legitimate all-kernel __copy_in_user
- legitimate kernel __get_user_unaligned
- legitimate kernel __put_user_unaligned

Signed-off-by: James Hogan <james.hogan@...tec.com>
Cc: Kees Cook <keescook@...omium.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>
---
Changes in v2:
- Conditionalise on CONFIG_COMPAT, otherwise it breaks build on some
  32-bit arches e.g. i386 (kbuild test robot).
- Add testing of _unaligned accessors, which are also conditional upon
  CONFIG_COMPAT.
---
 lib/test_user_copy.c | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 60 insertions(+)

diff --git a/lib/test_user_copy.c b/lib/test_user_copy.c
index 56af2439d2be..ebaa28d2c8bd 100644
--- a/lib/test_user_copy.c
+++ b/lib/test_user_copy.c
@@ -74,6 +74,10 @@ static int __init test_user_copy_init(void)
 		    "legitimate strncpy_from_user failed");
 	ret |= test(strnlen_user(usermem, PAGE_SIZE) == 0,
 		    "legitimate strnlen_user failed");
+#ifdef CONFIG_COMPAT
+	ret |= test(copy_in_user(usermem, usermem + PAGE_SIZE, PAGE_SIZE),
+		    "legitimate copy_in_user failed");
+#endif
 
 	ret |= test(!access_ok(VERIFY_READ, usermem, PAGE_SIZE * 2),
 		    "legitimate access_ok VERIFY_READ failed");
@@ -93,6 +97,16 @@ static int __init test_user_copy_init(void)
 		    "legitimate __put_user failed");
 	ret |= test(__clear_user(usermem, PAGE_SIZE) != 0,
 		    "legitimate __clear_user passed");
+#ifdef CONFIG_COMPAT
+	ret |= test(__copy_in_user(usermem, usermem + PAGE_SIZE, PAGE_SIZE),
+		    "legitimate __copy_in_user failed");
+	ret |= test(__get_user_unaligned(value,
+					 (unsigned long __user *)(usermem + 1)),
+		    "legitimate __get_user_unaligned failed");
+	ret |= test(__put_user_unaligned(value,
+					 (unsigned long __user *)(usermem + 1)),
+		    "legitimate __put_user_unaligned failed");
+#endif
 
 	/* Invalid usage: none of these should succeed. */
 	ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE),
@@ -121,6 +135,17 @@ static int __init test_user_copy_init(void)
 		    "illegal reversed strncpy_from_user passed");
 	ret |= test(strnlen_user((char __user *)kmem, PAGE_SIZE) != 0,
 		    "illegal strnlen_user passed");
+#ifdef CONFIG_COMPAT
+	ret |= test(!copy_in_user((char __user *)kmem,
+				  (char __user *)(kmem + PAGE_SIZE), PAGE_SIZE),
+		    "illegal all-kernel copy_in_user passed");
+	ret |= test(!copy_in_user((char __user *)kmem, usermem,
+				  PAGE_SIZE),
+		    "illegal copy_in_user to kernel passed");
+	ret |= test(!copy_in_user(usermem, (char __user *)kmem,
+				  PAGE_SIZE),
+		    "illegal copy_in_user from kernel passed");
+#endif
 
 	/*
 	 * If unchecked user accesses (__*) on this architecture cannot access
@@ -165,6 +190,24 @@ static int __init test_user_copy_init(void)
 		    "illegal __put_user passed");
 	ret |= test(__clear_user((char __user *)kmem, PAGE_SIZE) != PAGE_SIZE,
 		    "illegal kernel __clear_user passed");
+#ifdef CONFIG_COMPAT
+	ret |= test(!__copy_in_user((char __user *)kmem,
+				    (char __user *)(kmem + PAGE_SIZE),
+				    PAGE_SIZE),
+		    "illegal all-kernel __copy_in_user passed");
+	ret |= test(!__copy_in_user((char __user *)kmem, usermem,
+				    PAGE_SIZE),
+		    "illegal __copy_in_user to kernel passed");
+	ret |= test(!__copy_in_user(usermem, (char __user *)kmem,
+				    PAGE_SIZE),
+		    "illegal __copy_in_user from kernel passed");
+	ret |= test(!__get_user_unaligned(value,
+					  (unsigned long __user *)(kmem + 1)),
+		    "illegal __get_user_unaligned passed");
+	ret |= test(!__put_user_unaligned(value,
+					  (unsigned long __user *)(kmem + 1)),
+		    "illegal __put_user_unaligned passed");
+#endif
 #endif
 
 	/*
@@ -192,6 +235,11 @@ static int __init test_user_copy_init(void)
 		    "legitimate all-kernel strncpy_from_user failed");
 	ret |= test(strnlen_user((char __user *)kmem, PAGE_SIZE) == 0,
 		    "legitimate kernel strnlen_user failed");
+#ifdef CONFIG_COMPAT
+	ret |= test(copy_in_user((char __user *)kmem,
+				 (char __user *)(kmem + PAGE_SIZE), PAGE_SIZE),
+		    "legitimate all-kernel copy_in_user failed");
+#endif
 
 	ret |= test(!access_ok(VERIFY_READ, (char __user *)kmem, PAGE_SIZE * 2),
 		    "legitimate kernel access_ok VERIFY_READ failed");
@@ -217,6 +265,18 @@ static int __init test_user_copy_init(void)
 		    "legitimate kernel __put_user failed");
 	ret |= test(__clear_user((char __user *)kmem, PAGE_SIZE) != 0,
 		    "legitimate kernel __clear_user failed");
+#ifdef CONFIG_COMPAT
+	ret |= test(__copy_in_user((char __user *)kmem,
+				   (char __user *)(kmem + PAGE_SIZE),
+				   PAGE_SIZE),
+		    "legitimate all-kernel __copy_in_user failed");
+	ret |= test(__get_user_unaligned(value,
+					 (unsigned long __user *)(kmem + 1)),
+		    "legitimate kernel __get_user_unaligned failed");
+	ret |= test(__put_user_unaligned(value,
+					 (unsigned long __user *)(kmem + 1)),
+		    "legitimate kernel __put_user_unaligned failed");
+#endif
 
 	/* Restore previous address limit. */
 	set_fs(fs);
-- 
2.3.6

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/