linux-kernel - <Query> Looking more details and reasons for using orig_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Feb 2017 21:52:30 -0800
From:   Sodagudi Prasad <psodagud@...eaurora.org>
To:     catalin.marinas@....com, will.deacon@....com,
        "<mark.rutland"@arm.com, james.morse@....com,
        akpm@...ux-foundation.org, sandeepa.s.prabhu@...il.com,
        sandeepa.s.prabhu@...il.com, shijie.huang@....com
Cc:     linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        psodagud@...eaurora.org
Subject: <Query> Looking more details and reasons for using orig_add_limit.

Hi All,

  Would like to understand the reasons behind using the orig_add_limit 
variable in the following code. Can you please share more details ?

"arch/arm64/mm/fault.c"
static int __kprobes do_page_fault(unsigned long addr, unsigned int esr,
                                    struct pt_regs *regs)
{
…
…
…
         if (addr < USER_DS && is_permission_fault(esr, regs)) {          
=====>> condition_1
                 /* regs->orig_addr_limit may be 0 if we entered from EL0 
*/
                 if (regs->orig_addr_limit == KERNEL_DS)             	    
=====>> condition_2
                         die("Accessing user space memory with 
fs=KERNEL_DS", regs, esr);

                 if (is_el1_instruction_abort(esr))
                         die("Attempting to execute userspace memory", 
regs, esr);

                 if (!search_exception_tables(regs->pc))
                         die("Accessing user space memory outside 
uaccess.h routines", regs, esr);
         }

When any sys call is made from user space orig_addr_limit will be zero 
and after that driver is calling set_fs(KERNEL_DS) and  then 
copy_to_user() to user space memory.  If there is permission fault for 
user space address the above condition is leading to kernel crash. 
Because orig_add_limit is having KERNEL_DS as set_fs called before 
copy_to_user().

1)	So I would like to understand that,  is that user space pointer 
leading to permission fault not correct(condition_1) in this scenario?
2)	Are there any corner cases where these if conditions (condition_1 and 
condition2) would lead to kernel crash ?
3)	What are all scenarios these if conditions (condition_1 and 
condition2)  would like to take care?

-Thanks, Prasad

-- 
The Qualcomm Innovation Center, Inc. is a member of the Code Aurora 
Forum,
Linux Foundation Collaborative Project