linux-kernel - Re: [PATCH 5/7] x86/uaccess: Warn on uaccess faults other than #PF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALCETrXjniz64=c9bNVLxDWup1Q1iz=33wbzWvDpr971EHOfzQ@mail.gmail.com>
Date:	Sun, 29 May 2016 09:42:24 -0700
From:	Andy Lutomirski <luto@...capital.net>
To:	Borislav Petkov <bp@...en8.de>
Cc:	Andy Lutomirski <luto@...nel.org>, X86 ML <x86@...nel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	Kees Cook <keescook@...omium.org>,
	Brian Gerst <brgerst@...il.com>
Subject: Re: [PATCH 5/7] x86/uaccess: Warn on uaccess faults other than #PF

On Wed, May 25, 2016 at 2:49 AM, Borislav Petkov <bp@...en8.de> wrote:
> On Tue, May 24, 2016 at 03:48:42PM -0700, Andy Lutomirski wrote:
>> If a uaccess instruction fails due to an8 error other than #PF,
>> warn.  If the fault is #GP, it most likely indicates access to a
>> non-canonical address, which means that an access_ok check is
>> missing, and that's bad.  If the fault is something else (#UD?),
>> then something is very wrong and we should diagnose it rather
>> than ignoring it.
>>
>> Signed-off-by: Andy Lutomirski <luto@...nel.org>
>> ---
>>  arch/x86/mm/extable.c | 13 +++++++++++++
>>  1 file changed, 13 insertions(+)
>>
>> diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
>> index 658292fdee5e..c1933471fce7 100644
>> --- a/arch/x86/mm/extable.c
>> +++ b/arch/x86/mm/extable.c
>> @@ -29,6 +29,19 @@ EXPORT_SYMBOL(ex_handler_default);
>>  static bool uaccess_fault_okay(int trapnr, unsigned long error_code,
>>                              unsigned long extra)
>>  {
>> +     /*
>> +      * For uaccess, only page faults should be fixed up.  I can't see
>> +      * any exploit mitigation value in OOPSing on other types of faults,
>> +      * so just warn and continue if that happens.  This means that
>> +      * uaccess faults to non-canonical addresses will warn.  That's okay
>> +      * -- this will only happen if an access_ok is missing, and we want to
>> +      * detect that error if it happens.
>> +      */
>> +     if (WARN_ONCE(trapnr != X86_TRAP_PF,
>> +                   "unexpected uaccess trap %d (may indicate a missing access_ok on a non-canonical address)\n",
>> +                   trapnr))
>
> Perhaps dump also regs->ip and make the warn message more helpful...
>

The stack trace will show it, and I'm not convinced that regs->ip by
itself will be all that helpful -- depending on what gets inlined,  it
could just point to __copy_from_user or similar.

>> +             return true;  /* no good reason to OOPS. */
>
> You love those side comments, don'tcha? :-)

ECO tip #102: avoid silly newlines :-p

--Andy