linux-kernel - [PATCH v2 1/2] pci: imx6: avoid dereferencing program counter from user mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  4 Dec 2018 14:27:32 +0100
From:   Stefan Agner <stefan@...er.ch>
To:     hongxing.zhu@....com, l.stach@...gutronix.de
Cc:     robin.murphy@....com, tpiepho@...inj.com, linux@...linux.org.uk,
        leonard.crestez@....com, andrew.smirnov@...il.com,
        festevam@...il.com, lorenzo.pieralisi@....com, bhelgaas@...gle.com,
        stefan@...er.ch, linux-pci@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [PATCH v2 1/2] pci: imx6: avoid dereferencing program counter from user mode

The custom fault handler is currently only meant to handle kernel
mode bus faults. Exit in case the abort happened in user mode.

Signed-off-by: Stefan Agner <stefan@...er.ch>
---
 drivers/pci/controller/dwc/pci-imx6.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/controller/dwc/pci-imx6.c b/drivers/pci/controller/dwc/pci-imx6.c
index 69f86234f7c0..54a29e441303 100644
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -270,8 +270,14 @@ static int imx6q_pcie_abort_handler(unsigned long addr,
 		unsigned int fsr, struct pt_regs *regs)
 {
 	unsigned long pc = instruction_pointer(regs);
-	unsigned long instr = *(unsigned long *)pc;
-	int reg = (instr >> 12) & 15;
+	unsigned long instr;
+	int reg;
+
+	if (user_mode(regs))
+		return 1;
+
+	instr = *(unsigned long *)pc;
+	reg = (instr >> 12) & 15;
 
 	/*
 	 * If the instruction being executed was a read,
-- 
2.19.1