Commit 2bf8496f authored by Kees Cook's avatar Kees Cook
Browse files

lkdtm/usercopy: Moves the KERNEL_DS test to non-canonical 



The prior implementation of the KERNEL_DS fault checking would work on
any unmapped kernel address, but this was narrowed to the non-canonical
range instead. This adjusts the LKDTM test to match.

Fixes: 00c42373 ("x86-64: add warning for non-canonical user access address dereferences")
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
parent 8c2ffd91

drivers/misc/lkdtm/usercopy.c

+6 −4
Original line number Original line Diff line number Diff line
@@ -324,14 +324,16 @@ free_user: 




void lkdtm_USERCOPY_KERNEL_DS(void)

void lkdtm_USERCOPY_KERNEL_DS(void)

{

{

	char __user *user_ptr = (char __user *)ERR_PTR(-EINVAL);

	char __user *user_ptr =

		(char __user *)(0xFUL << (sizeof(unsigned long) * 8 - 4));

	mm_segment_t old_fs = get_fs();

	mm_segment_t old_fs = get_fs();

	char buf[10] = {0};

	char buf[10] = {0};





	pr_info("attempting copy_to_user on unmapped kernel address\n");

	pr_info("attempting copy_to_user() to noncanonical address: %px\n",

		user_ptr);

	set_fs(KERNEL_DS);

	set_fs(KERNEL_DS);

	if (copy_to_user(user_ptr, buf, sizeof(buf)))

	if (copy_to_user(user_ptr, buf, sizeof(buf)) == 0)

		pr_info("copy_to_user un unmapped kernel address failed\n");

		pr_err("copy_to_user() to noncanonical address succeeded!?\n");

	set_fs(old_fs);

	set_fs(old_fs);

}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE