Commit 5ea0727b authored by Thomas Garnier's avatar Thomas Garnier Committed by Thomas Gleixner
Browse files

x86/syscalls: Check address limit on user-mode return 

Ensure the address limit is a user-mode segment before returning to
user-mode. Otherwise a process can corrupt kernel-mode memory and elevate
privileges [1].

The set_fs function sets the TIF_SETFS flag to force a slow path on
return. In the slow path, the address limit is checked to be USER_DS if
needed.

The addr_limit_user_check function is added as a cross-architecture
function to check the address limit.

[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=990



Signed-off-by: default avatarThomas Garnier <thgarnie@google.com>
Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: kernel-hardening@lists.openwall.com
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Miroslav Benes <mbenes@suse.cz>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Pratyush Anand <panand@redhat.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Will Drewry <wad@chromium.org>
Cc: linux-api@vger.kernel.org
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Link: http://lkml.kernel.org/r/20170615011203.144108-1-thgarnie@google.com
parent 4422d80e

arch/x86/entry/common.c

+3 −0
Original line number Diff line number Diff line
@@ -23,6 +23,7 @@ 
#include <linux/user-return-notifier.h>

#include <linux/uprobes.h>

#include <linux/livepatch.h>

#include <linux/syscalls.h>



#include <asm/desc.h>

#include <asm/traps.h>
@@ -183,6 +184,8 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs) 
	struct thread_info *ti = current_thread_info();

	u32 cached_flags;



	addr_limit_user_check();



	if (IS_ENABLED(CONFIG_PROVE_LOCKING) && WARN_ON(!irqs_disabled()))

		local_irq_disable();

arch/x86/include/asm/thread_info.h

+4 −1
Original line number Diff line number Diff line
@@ -98,6 +98,7 @@ struct thread_info { 
#define TIF_SYSCALL_TRACEPOINT	28	/* syscall tracepoint instrumentation */

#define TIF_ADDR32		29	/* 32-bit address space on 64 bits */

#define TIF_X32			30	/* 32-bit native x86-64 binary */

#define TIF_FSCHECK		31	/* Check FS is USER_DS on return */



#define _TIF_SYSCALL_TRACE	(1 << TIF_SYSCALL_TRACE)

#define _TIF_NOTIFY_RESUME	(1 << TIF_NOTIFY_RESUME)
@@ -122,6 +123,7 @@ struct thread_info { 
#define _TIF_SYSCALL_TRACEPOINT	(1 << TIF_SYSCALL_TRACEPOINT)

#define _TIF_ADDR32		(1 << TIF_ADDR32)

#define _TIF_X32		(1 << TIF_X32)

#define _TIF_FSCHECK		(1 << TIF_FSCHECK)



/*

 * work to do in syscall_trace_enter().  Also includes TIF_NOHZ for
@@ -137,7 +139,8 @@ struct thread_info { 
	(_TIF_SYSCALL_TRACE | _TIF_NOTIFY_RESUME | _TIF_SIGPENDING |	\

	 _TIF_NEED_RESCHED | _TIF_SINGLESTEP | _TIF_SYSCALL_EMU |	\

	 _TIF_SYSCALL_AUDIT | _TIF_USER_RETURN_NOTIFY | _TIF_UPROBE |	\

	 _TIF_PATCH_PENDING | _TIF_NOHZ | _TIF_SYSCALL_TRACEPOINT)

	 _TIF_PATCH_PENDING | _TIF_NOHZ | _TIF_SYSCALL_TRACEPOINT |	\

	 _TIF_FSCHECK)



/* flags to check in __switch_to() */

#define _TIF_WORK_CTXSW							\

arch/x86/include/asm/uaccess.h

+6 −1
Original line number Diff line number Diff line
@@ -26,7 +26,12 @@ 


#define get_ds()	(KERNEL_DS)

#define get_fs()	(current->thread.addr_limit)

#define set_fs(x)	(current->thread.addr_limit = (x))

static inline void set_fs(mm_segment_t fs)

{

	current->thread.addr_limit = fs;

	/* On user-mode return, check fs is correct */

	set_thread_flag(TIF_FSCHECK);

}



#define segment_eq(a, b)	((a).seg == (b).seg)

include/linux/syscalls.h

+16 −0
Original line number Diff line number Diff line
@@ -206,6 +206,22 @@ extern struct trace_event_functions exit_syscall_print_funcs; 
	}								\

	static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__))



#ifdef TIF_FSCHECK

/*

 * Called before coming back to user-mode. Returning to user-mode with an

 * address limit different than USER_DS can allow to overwrite kernel memory.

 */

static inline void addr_limit_user_check(void)

{



	if (!test_thread_flag(TIF_FSCHECK))

		return;



	BUG_ON(!segment_eq(get_fs(), USER_DS));

	clear_thread_flag(TIF_FSCHECK);

}

#endif



asmlinkage long sys32_quotactl(unsigned int cmd, const char __user *special,

			       qid_t id, void __user *addr);

asmlinkage long sys_time(time_t __user *tloc);

CRA Git | Maintained and supported by SUSTech CRA and CCSE