linux-kernel - [PATCH] arm64: Fix 32-bit compatible userspace write size overflow error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231116074706.3448008-1-ruanjinjie@huawei.com>
Date:   Thu, 16 Nov 2023 15:47:05 +0800
From:   Jinjie Ruan <ruanjinjie@...wei.com>
To:     <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will@...nel.org>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Sam Ravnborg <sam@...nborg.org>,
        Stafford Horne <shorne@...il.com>,
        Arnd Bergmann <arnd@...db.de>,
        Dinh Nguyen <dinguyen@...nel.org>
CC:     <ruanjinjie@...wei.com>
Subject: [PATCH] arm64: Fix 32-bit compatible userspace write size overflow error

For 32-bit compatible userspace program, write with size = -1 return not
-1 but unexpected other values, which is due to the __access_ok() check is
not right. The specified "addr + size" is greater than 32-bit limit and
should return -EFAULT, but TASK_SIZE_MAX still defined as UL(1) << VA_BITS
in U32 mode, which is much greater than "addr + size" and cannot catch the
overflow error.

Fix above error by checking 32-bit limit if it is 32-bit compatible
userspace program.

How to reproduce:

The test program is as below:

cat test.c
	#include <unistd.h>
	#include <fcntl.h>
	#include <stdio.h>
	#include <stdint.h>
	#include <stdlib.h>
	#include <assert.h>

	#define pinfo(fmt, args...) \
	    fprintf(stderr, "[INFO][%s][%d][%s]:"fmt, \
	    __FILE__,__LINE__,__func__,##args)

	#undef SIZE_MAX
	#define SIZE_MAX -1

	int main()
	{
	    char wbuf[3] = { 'x', 'y', 'z' };
	    char *path = "write.tmp";
	    int ret;

	    int fd = open(path, O_RDWR | O_CREAT);
	    if (fd<0)
	    {
	        pinfo("fd=%d\n", fd);
	        exit(-1);
	    }

	    assert(write(fd, wbuf, 3) == 3);

	    ret = write (fd, wbuf, SIZE_MAX);
	    pinfo("ret=%d\n", ret);
	    pinfo("size_max=%d\n",SIZE_MAX);
	    assert(ret==-1);
	    close(fd);
	    pinfo("INFO: end\n");

	    return 0;
	}

aarch64-linux-gnu-gcc --static test.c -o test
arm-linux-gnueabi-gcc --static test.c -o test32

Before applying this patch, userspace 32-bit program return 1112 if the
write size = -1 as below:
	/root # ./test
	[INFO][test.c][32][main]:ret=-1
	[INFO][test.c][33][main]:size_max=-1
	[INFO][test.c][36][main]:INFO: end
	/root # ./test32
	[INFO][test.c][32][main]:ret=1112
	[INFO][test.c][33][main]:size_max=-1
	test32: test.c:34: main: Assertion `ret==-1' failed.
	Aborted

After applying this patch, userspace 32-bit program return -1 if the write
size = -1 as expected as below:
	/root # ./test
	[INFO][test.c][32][main]:ret=-1
	[INFO][test.c][33][main]:size_max=-1
	[INFO][test.c][36][main]:INFO: end
	/root # ./test32
	[INFO][test.c][32][main]:ret=-1
	[INFO][test.c][33][main]:size_max=-1
	[INFO][test.c][36][main]:INFO: end

Fixes: 967747bbc084 ("uaccess: remove CONFIG_SET_FS")
Signed-off-by: Jinjie Ruan <ruanjinjie@...wei.com>
---
 arch/arm64/include/asm/processor.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index e5bc54522e71..6a087d58a90a 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -52,7 +52,12 @@
 
 #define DEFAULT_MAP_WINDOW_64	(UL(1) << VA_BITS_MIN)
 #define TASK_SIZE_64		(UL(1) << vabits_actual)
+#ifdef CONFIG_COMPAT
+#define TASK_SIZE_MAX		(test_thread_flag(TIF_32BIT) ? \
+				UL(0x100000000) : (UL(1) << VA_BITS))
+#else
 #define TASK_SIZE_MAX		(UL(1) << VA_BITS)
+#endif
 
 #ifdef CONFIG_COMPAT
 #if defined(CONFIG_ARM64_64K_PAGES) && defined(CONFIG_KUSER_HELPERS)
-- 
2.34.1