| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAAeHK+wo5pC2W_zRYMYTAXQbh2a_2=ifgJhMDBZ7p1m=chfSbw@mail.gmail.com>
Date: Mon, 18 Mar 2019 17:53:00 +0100
From: Andrey Konovalov <andreyknvl@...gle.com>
To: kbuild test robot <lkp@...el.com>
Cc: kbuild-all@...org, Catalin Marinas <catalin.marinas@....com>,
Will Deacon <will.deacon@....com>,
Mark Rutland <mark.rutland@....com>,
Robin Murphy <robin.murphy@....com>,
Kees Cook <keescook@...omium.org>,
Kate Stewart <kstewart@...uxfoundation.org>,
Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
Andrew Morton <akpm@...ux-foundation.org>,
Ingo Molnar <mingo@...nel.org>,
"Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
Shuah Khan <shuah@...nel.org>,
Vincenzo Frascino <vincenzo.frascino@....com>,
Eric Dumazet <edumazet@...gle.com>,
"David S. Miller" <davem@...emloft.net>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Steven Rostedt <rostedt@...dmis.org>,
Ingo Molnar <mingo@...hat.com>,
Peter Zijlstra <peterz@...radead.org>,
Arnaldo Carvalho de Melo <acme@...nel.org>,
Linux ARM <linux-arm-kernel@...ts.infradead.org>,
"open list:DOCUMENTATION" <linux-doc@...r.kernel.org>,
Linux Memory Management List <linux-mm@...ck.org>,
linux-arch <linux-arch@...r.kernel.org>,
netdev <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>,
"open list:KERNEL SELFTEST FRAMEWORK"
<linux-kselftest@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
Dmitry Vyukov <dvyukov@...gle.com>,
Kostya Serebryany <kcc@...gle.com>,
Evgeniy Stepanov <eugenis@...gle.com>,
Lee Smith <Lee.Smith@....com>,
Ramana Radhakrishnan <Ramana.Radhakrishnan@....com>,
Jacob Bramley <Jacob.Bramley@....com>,
Ruben Ayrapetyan <Ruben.Ayrapetyan@....com>,
Chintan Pandya <cpandya@...eaurora.org>,
Luc Van Oostenryck <luc.vanoostenryck@...il.com>,
Dave Martin <Dave.Martin@....com>,
Kevin Brodsky <kevin.brodsky@....com>,
Szabolcs Nagy <Szabolcs.Nagy@....com>
Subject: Re: [PATCH v11 09/14] kernel, arm64: untag user pointers in prctl_set_mm*
On Sat, Mar 16, 2019 at 8:32 PM kbuild test robot <lkp@...el.com> wrote:
>
> Hi Andrey,
>
> Thank you for the patch! Yet something to improve:
>
> [auto build test ERROR on linus/master]
> [also build test ERROR on v5.0 next-20190306]
> [if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
>
> url: https://github.com/0day-ci/linux/commits/Andrey-Konovalov/uaccess-add-untagged_addr-definition-for-other-arches/20190317-015913
> config: x86_64-randconfig-x012-201911 (attached as .config)
> compiler: gcc-7 (Debian 7.3.0-1) 7.3.0
> reproduce:
> # save the attached .config to linux build tree
> make ARCH=x86_64
>
> All errors (new ones prefixed by >>):
>
> kernel/sys.c: In function 'prctl_set_mm_map':
> >> kernel/sys.c:1996:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->start_code = untagged_addr(prctl_map.start_code);
> ^~
> kernel/sys.c:1997:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->end_code = untagged_addr(prctl_map.end_code);
> ^~
> kernel/sys.c:1998:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->start_data = untagged_addr(prctl_map.start_data);
> ^~
> kernel/sys.c:1999:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->end_data = untagged_addr(prctl_map.end_data);
> ^~
> kernel/sys.c:2000:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->start_brk = untagged_addr(prctl_map.start_brk);
> ^~
> kernel/sys.c:2001:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->brk = untagged_addr(prctl_map.brk);
> ^~
> kernel/sys.c:2002:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->start_stack = untagged_addr(prctl_map.start_stack);
> ^~
> kernel/sys.c:2003:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->arg_start = untagged_addr(prctl_map.arg_start);
> ^~
> kernel/sys.c:2004:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->arg_end = untagged_addr(prctl_map.arg_end);
> ^~
> kernel/sys.c:2005:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->env_start = untagged_addr(prctl_map.env_start);
> ^~
> kernel/sys.c:2006:11: error: invalid type argument of '->' (have 'struct prctl_mm_map')
> prctl_map->env_end = untagged_addr(prctl_map.env_end);
> ^~
>
> vim +1996 kernel/sys.c
Right, I didn't have the related config options enabled when I did the
testing...
>
> 1974
> 1975 #ifdef CONFIG_CHECKPOINT_RESTORE
> 1976 static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data_size)
> 1977 {
> 1978 struct prctl_mm_map prctl_map = { .exe_fd = (u32)-1, };
> 1979 unsigned long user_auxv[AT_VECTOR_SIZE];
> 1980 struct mm_struct *mm = current->mm;
> 1981 int error;
> 1982
> 1983 BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
> 1984 BUILD_BUG_ON(sizeof(struct prctl_mm_map) > 256);
> 1985
> 1986 if (opt == PR_SET_MM_MAP_SIZE)
> 1987 return put_user((unsigned int)sizeof(prctl_map),
> 1988 (unsigned int __user *)addr);
> 1989
> 1990 if (data_size != sizeof(prctl_map))
> 1991 return -EINVAL;
> 1992
> 1993 if (copy_from_user(&prctl_map, addr, sizeof(prctl_map)))
> 1994 return -EFAULT;
> 1995
> > 1996 prctl_map->start_code = untagged_addr(prctl_map.start_code);
> 1997 prctl_map->end_code = untagged_addr(prctl_map.end_code);
> 1998 prctl_map->start_data = untagged_addr(prctl_map.start_data);
> 1999 prctl_map->end_data = untagged_addr(prctl_map.end_data);
> 2000 prctl_map->start_brk = untagged_addr(prctl_map.start_brk);
> 2001 prctl_map->brk = untagged_addr(prctl_map.brk);
> 2002 prctl_map->start_stack = untagged_addr(prctl_map.start_stack);
> 2003 prctl_map->arg_start = untagged_addr(prctl_map.arg_start);
> 2004 prctl_map->arg_end = untagged_addr(prctl_map.arg_end);
> 2005 prctl_map->env_start = untagged_addr(prctl_map.env_start);
> 2006 prctl_map->env_end = untagged_addr(prctl_map.env_end);
> 2007
> 2008 error = validate_prctl_map(&prctl_map);
> 2009 if (error)
> 2010 return error;
> 2011
> 2012 if (prctl_map.auxv_size) {
> 2013 memset(user_auxv, 0, sizeof(user_auxv));
> 2014 if (copy_from_user(user_auxv,
> 2015 (const void __user *)prctl_map.auxv,
> 2016 prctl_map.auxv_size))
> 2017 return -EFAULT;
> 2018
> 2019 /* Last entry must be AT_NULL as specification requires */
> 2020 user_auxv[AT_VECTOR_SIZE - 2] = AT_NULL;
> 2021 user_auxv[AT_VECTOR_SIZE - 1] = AT_NULL;
> 2022 }
> 2023
> 2024 if (prctl_map.exe_fd != (u32)-1) {
> 2025 error = prctl_set_mm_exe_file(mm, prctl_map.exe_fd);
> 2026 if (error)
> 2027 return error;
> 2028 }
> 2029
> 2030 /*
> 2031 * arg_lock protects concurent updates but we still need mmap_sem for
> 2032 * read to exclude races with sys_brk.
> 2033 */
> 2034 down_read(&mm->mmap_sem);
> 2035
> 2036 /*
> 2037 * We don't validate if these members are pointing to
> 2038 * real present VMAs because application may have correspond
> 2039 * VMAs already unmapped and kernel uses these members for statistics
> 2040 * output in procfs mostly, except
> 2041 *
> 2042 * - @start_brk/@brk which are used in do_brk but kernel lookups
> 2043 * for VMAs when updating these memvers so anything wrong written
> 2044 * here cause kernel to swear at userspace program but won't lead
> 2045 * to any problem in kernel itself
> 2046 */
> 2047
> 2048 spin_lock(&mm->arg_lock);
> 2049 mm->start_code = prctl_map.start_code;
> 2050 mm->end_code = prctl_map.end_code;
> 2051 mm->start_data = prctl_map.start_data;
> 2052 mm->end_data = prctl_map.end_data;
> 2053 mm->start_brk = prctl_map.start_brk;
> 2054 mm->brk = prctl_map.brk;
> 2055 mm->start_stack = prctl_map.start_stack;
> 2056 mm->arg_start = prctl_map.arg_start;
> 2057 mm->arg_end = prctl_map.arg_end;
> 2058 mm->env_start = prctl_map.env_start;
> 2059 mm->env_end = prctl_map.env_end;
> 2060 spin_unlock(&mm->arg_lock);
> 2061
> 2062 /*
> 2063 * Note this update of @saved_auxv is lockless thus
> 2064 * if someone reads this member in procfs while we're
> 2065 * updating -- it may get partly updated results. It's
> 2066 * known and acceptable trade off: we leave it as is to
> 2067 * not introduce additional locks here making the kernel
> 2068 * more complex.
> 2069 */
> 2070 if (prctl_map.auxv_size)
> 2071 memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv));
> 2072
> 2073 up_read(&mm->mmap_sem);
> 2074 return 0;
> 2075 }
> 2076 #endif /* CONFIG_CHECKPOINT_RESTORE */
> 2077
>
> ---
> 0-DAY kernel test infrastructure Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all Intel Corporation
Powered by blists - more mailing lists