]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/commit
x86/fault: BUG() when uaccess helpers fault on kernel addresses
authorJann Horn <jannh@google.com>
Tue, 28 Aug 2018 20:14:20 +0000 (22:14 +0200)
committerThomas Gleixner <tglx@linutronix.de>
Mon, 3 Sep 2018 13:12:09 +0000 (15:12 +0200)
commit9da3f2b74054406f87dff7101a569217ffceb29b
tree12dc39602e4c134a2becbe843925b1e65b6971d8
parent81fd9c18444ed1199b5a6f6776a395292d4256fb
x86/fault: BUG() when uaccess helpers fault on kernel addresses

There have been multiple kernel vulnerabilities that permitted userspace to
pass completely unchecked pointers through to userspace accessors:

 - the waitid() bug - commit 96ca579a1ecc ("waitid(): Add missing
   access_ok() checks")
 - the sg/bsg read/write APIs
 - the infiniband read/write APIs

These don't happen all that often, but when they do happen, it is hard to
test for them properly; and it is probably also hard to discover them with
fuzzing. Even when an unmapped kernel address is supplied to such buggy
code, it just returns -EFAULT instead of doing a proper BUG() or at least
WARN().

Try to make such misbehaving code a bit more visible by refusing to do a
fixup in the pagefault handler code when a userspace accessor causes a #PF
on a kernel address and the current context isn't whitelisted.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: kernel-hardening@lists.openwall.com
Cc: dvyukov@google.com
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Cc: Borislav Petkov <bp@alien8.de>
Link: https://lkml.kernel.org/r/20180828201421.157735-7-jannh@google.com
arch/x86/mm/extable.c
fs/namespace.c
include/linux/sched.h
mm/maccess.c