[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <tip-5ea0727b163cb5575e36397a12eade68a1f35f24@git.kernel.org>
Date: Sat, 8 Jul 2017 05:09:53 -0700
From: tip-bot for Thomas Garnier <tipbot@...or.com>
To: linux-tip-commits@...r.kernel.org
Cc: dave.hansen@...el.com, dhowells@...hat.com, linux@...linux.org.uk,
hpa@...or.com, pmladek@...e.com, catalin.marinas@....com,
tglx@...utronix.de, oleg@...hat.com, pbonzini@...hat.com,
mingo@...nel.org, cmetcalf@...lanox.com, riel@...hat.com,
will.deacon@....com, mbenes@...e.cz, jpoimboe@...hat.com,
thgarnie@...gle.com, luto@...capital.net, luto@...nel.org,
wad@...omium.org, linux-kernel@...r.kernel.org,
mark.rutland@....com, arnd@...db.de, keescook@...omium.org,
panand@...hat.com, viro@...iv.linux.org.uk
Subject: [tip:x86/syscall] x86/syscalls: Check address limit on user-mode
return
Commit-ID: 5ea0727b163cb5575e36397a12eade68a1f35f24
Gitweb: http://git.kernel.org/tip/5ea0727b163cb5575e36397a12eade68a1f35f24
Author: Thomas Garnier <thgarnie@...gle.com>
AuthorDate: Wed, 14 Jun 2017 18:12:01 -0700
Committer: Thomas Gleixner <tglx@...utronix.de>
CommitDate: Sat, 8 Jul 2017 14:05:32 +0200
x86/syscalls: Check address limit on user-mode return
Ensure the address limit is a user-mode segment before returning to
user-mode. Otherwise a process can corrupt kernel-mode memory and elevate
privileges [1].
The set_fs function sets the TIF_SETFS flag to force a slow path on
return. In the slow path, the address limit is checked to be USER_DS if
needed.
The addr_limit_user_check function is added as a cross-architecture
function to check the address limit.
[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=990
Signed-off-by: Thomas Garnier <thgarnie@...gle.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Mark Rutland <mark.rutland@....com>
Cc: kernel-hardening@...ts.openwall.com
Cc: Catalin Marinas <catalin.marinas@....com>
Cc: Will Deacon <will.deacon@....com>
Cc: David Howells <dhowells@...hat.com>
Cc: Dave Hansen <dave.hansen@...el.com>
Cc: Miroslav Benes <mbenes@...e.cz>
Cc: Chris Metcalf <cmetcalf@...lanox.com>
Cc: Pratyush Anand <panand@...hat.com>
Cc: Russell King <linux@...linux.org.uk>
Cc: Petr Mladek <pmladek@...e.com>
Cc: Rik van Riel <riel@...hat.com>
Cc: Kees Cook <keescook@...omium.org>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Al Viro <viro@...iv.linux.org.uk>
Cc: Andy Lutomirski <luto@...nel.org>
Cc: Josh Poimboeuf <jpoimboe@...hat.com>
Cc: linux-arm-kernel@...ts.infradead.org
Cc: Will Drewry <wad@...omium.org>
Cc: linux-api@...r.kernel.org
Cc: Oleg Nesterov <oleg@...hat.com>
Cc: Andy Lutomirski <luto@...capital.net>
Cc: Paolo Bonzini <pbonzini@...hat.com>
Link: http://lkml.kernel.org/r/20170615011203.144108-1-thgarnie@google.com
---
arch/x86/entry/common.c | 3 +++
arch/x86/include/asm/thread_info.h | 5 ++++-
arch/x86/include/asm/uaccess.h | 7 ++++++-
include/linux/syscalls.h | 16 ++++++++++++++++
4 files changed, 29 insertions(+), 2 deletions(-)
diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c
index cdefcfd..03505ff 100644
--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -23,6 +23,7 @@
#include <linux/user-return-notifier.h>
#include <linux/uprobes.h>
#include <linux/livepatch.h>
+#include <linux/syscalls.h>
#include <asm/desc.h>
#include <asm/traps.h>
@@ -183,6 +184,8 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
struct thread_info *ti = current_thread_info();
u32 cached_flags;
+ addr_limit_user_check();
+
if (IS_ENABLED(CONFIG_PROVE_LOCKING) && WARN_ON(!irqs_disabled()))
local_irq_disable();
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index e00e1bd..5161da1a 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -98,6 +98,7 @@ struct thread_info {
#define TIF_SYSCALL_TRACEPOINT 28 /* syscall tracepoint instrumentation */
#define TIF_ADDR32 29 /* 32-bit address space on 64 bits */
#define TIF_X32 30 /* 32-bit native x86-64 binary */
+#define TIF_FSCHECK 31 /* Check FS is USER_DS on return */
#define _TIF_SYSCALL_TRACE (1 << TIF_SYSCALL_TRACE)
#define _TIF_NOTIFY_RESUME (1 << TIF_NOTIFY_RESUME)
@@ -122,6 +123,7 @@ struct thread_info {
#define _TIF_SYSCALL_TRACEPOINT (1 << TIF_SYSCALL_TRACEPOINT)
#define _TIF_ADDR32 (1 << TIF_ADDR32)
#define _TIF_X32 (1 << TIF_X32)
+#define _TIF_FSCHECK (1 << TIF_FSCHECK)
/*
* work to do in syscall_trace_enter(). Also includes TIF_NOHZ for
@@ -137,7 +139,8 @@ struct thread_info {
(_TIF_SYSCALL_TRACE | _TIF_NOTIFY_RESUME | _TIF_SIGPENDING | \
_TIF_NEED_RESCHED | _TIF_SINGLESTEP | _TIF_SYSCALL_EMU | \
_TIF_SYSCALL_AUDIT | _TIF_USER_RETURN_NOTIFY | _TIF_UPROBE | \
- _TIF_PATCH_PENDING | _TIF_NOHZ | _TIF_SYSCALL_TRACEPOINT)
+ _TIF_PATCH_PENDING | _TIF_NOHZ | _TIF_SYSCALL_TRACEPOINT | \
+ _TIF_FSCHECK)
/* flags to check in __switch_to() */
#define _TIF_WORK_CTXSW \
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index a059aac..11433f9 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -26,7 +26,12 @@
#define get_ds() (KERNEL_DS)
#define get_fs() (current->thread.addr_limit)
-#define set_fs(x) (current->thread.addr_limit = (x))
+static inline void set_fs(mm_segment_t fs)
+{
+ current->thread.addr_limit = fs;
+ /* On user-mode return, check fs is correct */
+ set_thread_flag(TIF_FSCHECK);
+}
#define segment_eq(a, b) ((a).seg == (b).seg)
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 980c3c9..ac0cf6f 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -206,6 +206,22 @@ extern struct trace_event_functions exit_syscall_print_funcs;
} \
static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__))
+#ifdef TIF_FSCHECK
+/*
+ * Called before coming back to user-mode. Returning to user-mode with an
+ * address limit different than USER_DS can allow to overwrite kernel memory.
+ */
+static inline void addr_limit_user_check(void)
+{
+
+ if (!test_thread_flag(TIF_FSCHECK))
+ return;
+
+ BUG_ON(!segment_eq(get_fs(), USER_DS));
+ clear_thread_flag(TIF_FSCHECK);
+}
+#endif
+
asmlinkage long sys32_quotactl(unsigned int cmd, const char __user *special,
qid_t id, void __user *addr);
asmlinkage long sys_time(time_t __user *tloc);
Powered by blists - more mailing lists