linux-kernel - Re: [PATCH v5] riscv: add userland instruction dump to RISC-V splats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <878r9hvn3m.fsf@all.your.base.are.belong.to.us>
Date:   Thu, 07 Sep 2023 20:45:33 +0200
From:   Björn Töpel <bjorn@...nel.org>
To:     Yunhui Cui <cuiyunhui@...edance.com>, paul.walmsley@...ive.com,
        palmer@...belt.com, aou@...s.berkeley.edu, guoren@...nel.org,
        bjorn@...osinc.com, conor.dooley@...rochip.com, jszhang@...nel.org,
        andy.chiu@...ive.com, cuiyunhui@...edance.com,
        dave.hansen@...ux.intel.com, elver@...gle.com, glider@...gle.com,
        cyphar@...har.com, kirill.shutemov@...ux.intel.com,
        keescook@...omium.org, linux-riscv@...ts.infradead.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v5] riscv: add userland instruction dump to RISC-V splats

Yunhui Cui <cuiyunhui@...edance.com> writes:

> Add userland instruction dump and rename dump_kernel_instr()
> to dump_instr().
>
> An example:
> [    0.822439] Freeing unused kernel image (initmem) memory: 6916K
> [    0.823817] Run /init as init process
> [    0.839411] init[1]: unhandled signal 4 code 0x1 at 0x000000000005be18 in bb[10000+5fb000]
> [    0.840751] CPU: 0 PID: 1 Comm: init Not tainted 5.14.0-rc4-00049-gbd644290aa72-dirty #187
> [    0.841373] Hardware name:  , BIOS
> [    0.841743] epc : 000000000005be18 ra : 0000000000079e74 sp : 0000003fffcafda0
> [    0.842271]  gp : ffffffff816e9dc8 tp : 0000000000000000 t0 : 0000000000000000
> [    0.842947]  t1 : 0000003fffc9fdf0 t2 : 0000000000000000 s0 : 0000000000000000
> [    0.843434]  s1 : 0000000000000000 a0 : 0000003fffca0190 a1 : 0000003fffcafe18
> [    0.843891]  a2 : 0000000000000000 a3 : 0000000000000000 a4 : 0000000000000000
> [    0.844357]  a5 : 0000000000000000 a6 : 0000000000000000 a7 : 0000000000000000
> [    0.844803]  s2 : 0000000000000000 s3 : 0000000000000000 s4 : 0000000000000000
> [    0.845253]  s5 : 0000000000000000 s6 : 0000000000000000 s7 : 0000000000000000
> [    0.845722]  s8 : 0000000000000000 s9 : 0000000000000000 s10: 0000000000000000
> [    0.846180]  s11: 0000000000d144e0 t3 : 0000000000000000 t4 : 0000000000000000
> [    0.846616]  t5 : 0000000000000000 t6 : 0000000000000000
> [    0.847204] status: 0000000200000020 badaddr: 00000000f0028053 cause: 0000000000000002
> [    0.848219] Code: f06f ff5f 3823 fa11 0113 fb01 2e23 0201 0293 0000 (8053) f002
> [    0.851016] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000004
>
> Signed-off-by: Yunhui Cui <cuiyunhui@...edance.com>
> ---
>  arch/riscv/kernel/traps.c | 19 ++++++++++++++++---
>  1 file changed, 16 insertions(+), 3 deletions(-)
>
> diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c
> index f798c853bede..923b49c38985 100644
> --- a/arch/riscv/kernel/traps.c
> +++ b/arch/riscv/kernel/traps.c
> @@ -33,7 +33,19 @@ int show_unhandled_signals = 1;
>  
>  static DEFINE_SPINLOCK(die_lock);
>  
> -static void dump_kernel_instr(const char *loglvl, struct pt_regs *regs)
> +static int copy_code(struct pt_regs *regs, u16 *val, const u16 *insns)
> +{
> +	if (!user_mode(regs))
> +		return get_kernel_nofault(*val, insns);
> +
> +	/* The user space code from other tasks cannot be accessed. */
> +	if (regs != task_pt_regs(current))
> +		return -EPERM;
> +
> +	return copy_from_user_nofault(val, insns, sizeof(*val));

Hmm, I think you missed the actual problem in [1]. I'm still getting:

  |   CHECK   arch/riscv/kernel/traps.c
  | arch/riscv/kernel/traps.c:46:44: warning: incorrect type in argument 2 (different address spaces)
  | arch/riscv/kernel/traps.c:46:44:    expected void const [noderef] __user *src
  | arch/riscv/kernel/traps.c:46:44:    got unsigned short const [usertype] *insns

This only moves the problem. You needs to cast the "insn" with something
like:

  | const void __user *uaddr =  (__force const void __user *)insn;

...and pass uaddr to copy_from_user_nofault().

  | long copy_from_user_nofault(void *dst, const void __user *src, size_t size);

Notice the "__user" tag to src.


Björn

[1] https://lore.kernel.org/linux-riscv/87msy6p8k3.fsf@all.your.base.are.belong.to.us/