Commit fcd35857 authored by Catalin Marinas's avatar Catalin Marinas Committed by Greg Kroah-Hartman
Browse files

lkdtm: Do not use flush_icache_range() on user addresses 



The flush_icache_range() API is meant to be used on kernel addresses
only as it may not have the infrastructure (exception entries) to handle
user memory faults.

The lkdtm execute_user_location() function tests the kernel execution of
user space addresses by mmap'ing an anonymous page, copying some code
together with cache maintenance and attempting to run it. However, the
cache maintenance step may fail because of the incorrect API usage
described above. The patch changes lkdtm to use access_process_vm() for
copying the code into user space which would take care of the necessary
cache maintenance.

Signed-off-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
[kees: export access_process_vm() for module use]
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 052662ca

drivers/misc/lkdtm_perms.c

+5 −2
Original line number Original line Diff line number Diff line
@@ -60,15 +60,18 @@ static noinline void execute_location(void *dst, bool write) 




static void execute_user_location(void *dst)

static void execute_user_location(void *dst)

{

{

	int copied;



	/* Intentionally crossing kernel/user memory boundary. */

	/* Intentionally crossing kernel/user memory boundary. */

	void (*func)(void) = dst;

	void (*func)(void) = dst;





	pr_info("attempting ok execution at %p\n", do_nothing);

	pr_info("attempting ok execution at %p\n", do_nothing);

	do_nothing();

	do_nothing();





	if (copy_to_user((void __user *)dst, do_nothing, EXEC_SIZE))

	copied = access_process_vm(current, (unsigned long)dst, do_nothing,

				   EXEC_SIZE, FOLL_WRITE);

	if (copied < EXEC_SIZE)

		return;

		return;

	flush_icache_range((unsigned long)dst, (unsigned long)dst + EXEC_SIZE);

	pr_info("attempting bad execution at %p\n", func);

	pr_info("attempting bad execution at %p\n", func);

	func();

	func();

}

}

mm/memory.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -3966,6 +3966,7 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, 




	return ret;

	return ret;

}

}

EXPORT_SYMBOL_GPL(access_process_vm);





/*

/*

 * Print the name of a VMA.

 * Print the name of a VMA.

mm/nommu.c

+1 −0
Original line number Original line Diff line number Diff line
@@ -1878,6 +1878,7 @@ int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, in 
	mmput(mm);

	mmput(mm);

	return len;

	return len;

}

}

EXPORT_SYMBOL_GPL(access_process_vm);





/**

/**

 * nommu_shrink_inode_mappings - Shrink the shared mappings on an inode

 * nommu_shrink_inode_mappings - Shrink the shared mappings on an inode

CRA Git | Maintained and supported by SUSTech CRA and CCSE