[PATCH v2] proc/vmcore: fix clearing user buffer by properly using clear_user()

David Hildenbrand

author

2021-11-12 09:28 UTC #0 lore raw

PATCH v2 1/1 proc/vmcore: fix clearing user buffer by properly using clear_user()

To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a vmcore_cb and has some logically unplugged memory inside an added Linux memory block, I can easily trigger a BUG by copying the vmcore via "cp":

[   11.327580] systemd[1]: Starting Kdump Vmcore Save Service...
[   11.339697] kdump[420]: Kdump is using the default log level(3).
[   11.370964] kdump[453]: saving to /sysroot/var/crash/127.0.0.1-2021-11-11-14:59:22/
[   11.373997] kdump[458]: saving vmcore-dmesg.txt to /sysroot/var/crash/127.0.0.1-2021-11-11-14:59:22/
[   11.385357] kdump[465]: saving vmcore-dmesg.txt complete
[   11.386722] kdump[467]: saving vmcore
[   16.531275] BUG: unable to handle page fault for address: 00007f2374e01000
[   16.531705] #PF: supervisor write access in kernel mode
[   16.532037] #PF: error_code(0x0003) - permissions violation
[   16.532396] PGD 7a523067 P4D 7a523067 PUD 7a528067 PMD 7a525067 PTE 800000007048f867
[   16.532872] Oops: 0003 [#1] PREEMPT SMP NOPTI
[   16.533154] CPU: 0 PID: 468 Comm: cp Not tainted 5.15.0+ #6
[   16.533513] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.14.0-27-g64f37cc530f1-prebuilt.qemu.org 04/01/2014
[   16.534198] RIP: 0010:read_from_oldmem.part.0.cold+0x1d/0x86
[   16.534552] Code: ff ff ff e8 05 ff fe ff e9 b9 e9 7f ff 48 89 de 48 c7 c7 38 3b 60 82 e8 f1 fe fe ff 83 fd 08 72 3c 49 8d 7d 08 4c 89 e9 89 e8 <49> c7 45 00 00 00 00 00 49 c7 44 05 f8 00 00 00 00 48 83 e7 f81
[   16.535670] RSP: 0018:ffffc9000073be08 EFLAGS: 00010212
[   16.535998] RAX: 0000000000001000 RBX: 00000000002fd000 RCX: 00007f2374e01000
[   16.536441] RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00007f2374e01008
[   16.536878] RBP: 0000000000001000 R08: 0000000000000000 R09: ffffc9000073bc50
[   16.537315] R10: ffffc9000073bc48 R11: ffffffff829461a8 R12: 000000000000f000
[   16.537755] R13: 00007f2374e01000 R14: 0000000000000000 R15: ffff88807bd421e8
[   16.538200] FS:  00007f2374e12140(0000) GS:ffff88807f000000(0000) knlGS:0000000000000000
[   16.538696] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   16.539055] CR2: 00007f2374e01000 CR3: 000000007a4aa000 CR4: 0000000000350eb0
[   16.539510] Call Trace:
[   16.539679]  <TASK>
[   16.539828]  read_vmcore+0x236/0x2c0
[   16.540063]  ? enqueue_hrtimer+0x2f/0x80
[   16.540323]  ? inode_security+0x22/0x60
[   16.540572]  proc_reg_read+0x55/0xa0
[   16.540807]  vfs_read+0x95/0x190
[   16.541022]  ksys_read+0x4f/0xc0
[   16.541238]  do_syscall_64+0x3b/0x90
[   16.541475]  entry_SYSCALL_64_after_hwframe+0x44/0xae

Some x86-64 CPUs have a CPU feature called "Supervisor Mode Access Prevention (SMAP)", which is used to detect wrong access from the kernel to user buffers like this: SMAP triggers a permissions violation on wrong access. In the x86-64 variant of clear_user(), SMAP is properly handled via clac()+stac().

To fix, properly use clear_user() when we're dealing with a user buffer.

Fixes 997c136f518c ("fs/proc/vmcore.c: add hook to read_from_oldmem() to check for non-ram pages")

Acked-by Baoquan He <[email protected]>

Cc Dave Young <[email protected]>

Cc Baoquan He <[email protected]>

Cc Vivek Goyal <[email protected]>

Cc Andrew Morton <[email protected]>

Cc Philipp Rudo <[email protected]>

Cc [email protected]

Signed-off-by David Hildenbrand <[email protected]>

---

v1 -> v2:
- Extend patch description

---
 fs/proc/vmcore.c | 20 ++++++++++++--------
 1 file changed, 12 insertions(+), 8 deletions(-)

fs/proc/vmcore.c +12 -8

index 30a3b66f475a..509f85148fee 100644
@@ -154,9 +154,13 @@ ssize_t read_from_oldmem(char *buf, size_t count,
 			nr_bytes = count;
 
 		/* If pfn is not ram, return zeros for sparse dump files */
-		if (!pfn_is_ram(pfn))
-			memset(buf, 0, nr_bytes);
-		else {
+		if (!pfn_is_ram(pfn)) {
+			tmp = 0;
+			if (!userbuf)
+				memset(buf, 0, nr_bytes);
+			else if (clear_user(buf, nr_bytes))
+				tmp = -EFAULT;
+		} else {
 			if (encrypted)
 				tmp = copy_oldmem_page_encrypted(pfn, buf,
 								 nr_bytes,

@@ -165,12 +169,12 @@ ssize_t read_from_oldmem(char *buf, size_t count,
 			else
 				tmp = copy_oldmem_page(pfn, buf, nr_bytes,
 						       offset, userbuf);
-
-			if (tmp < 0) {
-				up_read(&vmcore_cb_rwsem);
-				return tmp;
-			}
 		}
+		if (tmp < 0) {
+			up_read(&vmcore_cb_rwsem);
+			return tmp;
+		}
+
 		*ppos += nr_bytes;
 		count -= nr_bytes;
 		buf += nr_bytes;

base-commit: debe436e77c72fcee804fb867f275e6d31aa999c

Signature · 7 lines

2.31.1


_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec

Andrew Morton

maintainer

2021-11-15 22:04 UTC #1 lore raw

Quoted 7 lines · On Fri, 12 Nov 2021 10:27:50 +0100 David Hildenbrand <[email protected]> wrote:

To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a vmcore_cb and has some logically unplugged memory inside an added Linux memory block, I can easily trigger a BUG by copying the vmcore via "cp":
...

Quoted 8 lines

Some x86-64 CPUs have a CPU feature called "Supervisor Mode Access Prevention (SMAP)", which is used to detect wrong access from the kernel to user buffers like this: SMAP triggers a permissions violation on wrong access. In the x86-64 variant of clear_user(), SMAP is properly handled via clac()+stac().
To fix, properly use clear_user() when we're dealing with a user buffer.

I added cc:stable, OK?

_______________________________________________
kexec mailing list
[email protected]
http://lists.infradead.org/mailman/listinfo/kexec

David Hildenbrand

author

2021-11-16 08:02 UTC #2 lore raw

Quoted 15 lines · Andrew Morton

Quoted 13 lines · On Fri, 12 Nov 2021 10:27:50 +0100 David Hildenbrand <[email protected]> wrote:
To clear a user buffer we cannot simply use memset, we have to use clear_user(). With a virtio-mem device that registers a vmcore_cb and has some logically unplugged memory inside an added Linux memory block, I can easily trigger a BUG by copying the vmcore via "cp":
...
Some x86-64 CPUs have a CPU feature called "Supervisor Mode Access Prevention (SMAP)", which is used to detect wrong access from the kernel to user buffers like this: SMAP triggers a permissions violation on wrong access. In the x86-64 variant of clear_user(), SMAP is properly handled via clac()+stac().

Quoted 5 lines

Quoted 2 lines
To fix, properly use clear_user() when we're dealing with a user buffer.
I added cc:stable, OK?

I was a bit hesitant because this would (beofe the virtio-mem changes) only trigger under XEN and I was wondering why nobody notices under XEN so far. But yes, even though it only applies to the kdump kernel, cc:stable sounds like the right think to do!

Thanks Andrew!

Signature · 3 lines

Thanks,

David / dhildenb

kernel test robot

build bot

2021-11-17 11:31 UTC #3 lore raw

In reply to David Hildenbrand

I love your patch! Perhaps something to improve:

Hi David,

I love your patch! Perhaps something to improve:

[auto build test WARNING on debe436e77c72fcee804fb867f275e6d31aa999c]

url:    https://github.com/0day-ci/linux/commits/David-Hildenbrand/proc-vmcore-fix-clearing-user-buffer-by-properly-using-clear_user/20211112-172947
base:   debe436e77c72fcee804fb867f275e6d31aa999c
config: sh-randconfig-s032-20211117 (attached as .config)
compiler: sh4-linux-gcc (GCC) 11.2.0

reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# apt-get install sparse
# sparse version: v0.6.4-dirty
# https://github.com/0day-ci/linux/commit/c20846d5e7db81244d84acaab61b47462aaa8d13
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review David-Hildenbrand/proc-vmcore-fix-clearing-user-buffer-by-properly-using-clear_user/20211112-172947 git checkout c20846d5e7db81244d84acaab61b47462aaa8d13
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' ARCH=sh

If you fix the issue, kindly add following tag as appropriate

Reported-by kernel test robot <[email protected]>

sparse warnings: (new ones prefixed by >>)

>> fs/proc/vmcore.c:161:34: sparse: sparse: incorrect type in initializer (different address spaces) @@     expected void [noderef] __user *__cl_addr @@     got char *buf @@

fs/proc/vmcore.c:161:34: sparse: expected void [noderef] __user *__cl_addr
fs/proc/vmcore.c:161:34: sparse: got char *buf
fs/proc/vmcore.c:161:34: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void *addr @@ got void [noderef] __user *__cl_addr @@
fs/proc/vmcore.c:161:34: sparse: expected void *addr
fs/proc/vmcore.c:161:34: sparse: got void [noderef] __user *__cl_addr

vim +161 fs/proc/vmcore.c

133
134 /* Reads a page from the oldmem device from given offset. */
135 ssize_t read_from_oldmem(char *buf, size_t count,
136 u64 *ppos, int userbuf,
137 bool encrypted)
138 {
139 unsigned long pfn, offset;
140 size_t nr_bytes;
141 ssize_t read = 0, tmp;
142
143 if (!count)
144 return 0;
145
146 offset = (unsigned long)(*ppos % PAGE_SIZE);
147 pfn = (unsigned long)(*ppos / PAGE_SIZE);
148
149 down_read(&vmcore_cb_rwsem);
150 do {
151 if (count > (PAGE_SIZE - offset))
152 nr_bytes = PAGE_SIZE - offset;
153 else
154 nr_bytes = count;
155
156 /* If pfn is not ram, return zeros for sparse dump files */
157 if (!pfn_is_ram(pfn)) {
158 tmp = 0;
159 if (!userbuf)
160 memset(buf, 0, nr_bytes);

 > 161				else if (clear_user(buf, nr_bytes))

162 tmp = -EFAULT;
163 } else {
164 if (encrypted)
165 tmp = copy_oldmem_page_encrypted(pfn, buf,
166 nr_bytes,
167 offset,
168 userbuf);
169 else
170 tmp = copy_oldmem_page(pfn, buf, nr_bytes,
171 offset, userbuf);
172 }
173 if (tmp < 0) {
174 up_read(&vmcore_cb_rwsem);
175 return tmp;
176 }
177
178 *ppos += nr_bytes;
179 count -= nr_bytes;
180 buf += nr_bytes;
181 read += nr_bytes;
182 ++pfn;
183 offset = 0;
184 } while (count);
185
186 up_read(&vmcore_cb_rwsem);
187 return read;
188 }
189

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]

kernel test robot

build bot

2021-11-25 06:13 UTC #4 lore raw

In reply to David Hildenbrand

I love your patch! Perhaps something to improve:

Hi David,

I love your patch! Perhaps something to improve:

[auto build test WARNING on debe436e77c72fcee804fb867f275e6d31aa999c]

url:    https://github.com/0day-ci/linux/commits/David-Hildenbrand/proc-vmcore-fix-clearing-user-buffer-by-properly-using-clear_user/20211112-172947
base:   debe436e77c72fcee804fb867f275e6d31aa999c
config: i386-randconfig-s001-20211115 (https://download.01.org/0day-ci/archive/20211125/202111251406.V4R8NmsN-lkp(a)intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce:
        # apt-get install sparse
        # sparse version: v0.6.4-dirty
        # https://github.com/0day-ci/linux/commit/c20846d5e7db81244d84acaab61b47462aaa8d13
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review David-Hildenbrand/proc-vmcore-fix-clearing-user-buffer-by-properly-using-clear_user/20211112-172947
        git checkout c20846d5e7db81244d84acaab61b47462aaa8d13
        # save the config file to linux build tree
        make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' ARCH=i386

If you fix the issue, kindly add following tag as appropriate

Reported-by kernel test robot <[email protected]>

sparse warnings: (new ones prefixed by >>)

>> fs/proc/vmcore.c:161:45: sparse: sparse: incorrect type in argument 1 (different address spaces) @@     expected void [noderef] __user *mem @@     got char *buf @@

fs/proc/vmcore.c:161:45: sparse: expected void [noderef] __user *mem
fs/proc/vmcore.c:161:45: sparse: got char *buf

vim +161 fs/proc/vmcore.c

133
134 /* Reads a page from the oldmem device from given offset. */
135 ssize_t read_from_oldmem(char *buf, size_t count,
136 u64 *ppos, int userbuf,
137 bool encrypted)
138 {
139 unsigned long pfn, offset;
140 size_t nr_bytes;
141 ssize_t read = 0, tmp;
142
143 if (!count)
144 return 0;
145
146 offset = (unsigned long)(*ppos % PAGE_SIZE);
147 pfn = (unsigned long)(*ppos / PAGE_SIZE);
148
149 down_read(&vmcore_cb_rwsem);
150 do {
151 if (count > (PAGE_SIZE - offset))
152 nr_bytes = PAGE_SIZE - offset;
153 else
154 nr_bytes = count;
155
156 /* If pfn is not ram, return zeros for sparse dump files */
157 if (!pfn_is_ram(pfn)) {
158 tmp = 0;
159 if (!userbuf)
160 memset(buf, 0, nr_bytes);

 > 161				else if (clear_user(buf, nr_bytes))

162 tmp = -EFAULT;
163 } else {
164 if (encrypted)
165 tmp = copy_oldmem_page_encrypted(pfn, buf,
166 nr_bytes,
167 offset,
168 userbuf);
169 else
170 tmp = copy_oldmem_page(pfn, buf, nr_bytes,
171 offset, userbuf);
172 }
173 if (tmp < 0) {
174 up_read(&vmcore_cb_rwsem);
175 return tmp;
176 }
177
178 *ppos += nr_bytes;
179 count -= nr_bytes;
180 buf += nr_bytes;
181 read += nr_bytes;
182 ++pfn;
183 offset = 0;
184 } while (count);
185
186 up_read(&vmcore_cb_rwsem);
187 return read;
188 }
189

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]

kernel test robot

build bot

2021-11-26 01:44 UTC #5 lore raw

In reply to David Hildenbrand

I love your patch! Perhaps something to improve:

Hi David,

I love your patch! Perhaps something to improve:

[auto build test WARNING on debe436e77c72fcee804fb867f275e6d31aa999c]

url:    https://github.com/0day-ci/linux/commits/David-Hildenbrand/proc-vmcore-fix-clearing-user-buffer-by-properly-using-clear_user/20211112-172947
base:   debe436e77c72fcee804fb867f275e6d31aa999c
config: s390-randconfig-s031-20211115 (https://download.01.org/0day-ci/archive/20211126/202111260925.UOahu0wC-lkp(a)intel.com/config)
compiler: s390-linux-gcc (GCC) 11.2.0

reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# apt-get install sparse
# sparse version: v0.6.4-dirty
# https://github.com/0day-ci/linux/commit/c20846d5e7db81244d84acaab61b47462aaa8d13
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review David-Hildenbrand/proc-vmcore-fix-clearing-user-buffer-by-properly-using-clear_user/20211112-172947 git checkout c20846d5e7db81244d84acaab61b47462aaa8d13
# save the config file to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' ARCH=s390

If you fix the issue, kindly add following tag as appropriate

Reported-by kernel test robot <[email protected]>

sparse warnings: (new ones prefixed by >>)

>> fs/proc/vmcore.c:161:45: sparse: sparse: incorrect type in argument 1 (different address spaces) @@     expected void [noderef] __user *to @@     got char *buf @@

fs/proc/vmcore.c:161:45: sparse: expected void [noderef] __user *to
fs/proc/vmcore.c:161:45: sparse: got char *buf

vim +161 fs/proc/vmcore.c

133
134 /* Reads a page from the oldmem device from given offset. */
135 ssize_t read_from_oldmem(char *buf, size_t count,
136 u64 *ppos, int userbuf,
137 bool encrypted)
138 {
139 unsigned long pfn, offset;
140 size_t nr_bytes;
141 ssize_t read = 0, tmp;
142
143 if (!count)
144 return 0;
145
146 offset = (unsigned long)(*ppos % PAGE_SIZE);
147 pfn = (unsigned long)(*ppos / PAGE_SIZE);
148
149 down_read(&vmcore_cb_rwsem);
150 do {
151 if (count > (PAGE_SIZE - offset))
152 nr_bytes = PAGE_SIZE - offset;
153 else
154 nr_bytes = count;
155
156 /* If pfn is not ram, return zeros for sparse dump files */
157 if (!pfn_is_ram(pfn)) {
158 tmp = 0;
159 if (!userbuf)
160 memset(buf, 0, nr_bytes);

 > 161				else if (clear_user(buf, nr_bytes))

162 tmp = -EFAULT;
163 } else {
164 if (encrypted)
165 tmp = copy_oldmem_page_encrypted(pfn, buf,
166 nr_bytes,
167 offset,
168 userbuf);
169 else
170 tmp = copy_oldmem_page(pfn, buf, nr_bytes,
171 offset, userbuf);
172 }
173 if (tmp < 0) {
174 up_read(&vmcore_cb_rwsem);
175 return tmp;
176 }
177
178 *ppos += nr_bytes;
179 count -= nr_bytes;
180 buf += nr_bytes;
181 read += nr_bytes;
182 ++pfn;
183 offset = 0;
184 } while (count);
185
186 up_read(&vmcore_cb_rwsem);
187 return read;
188 }
189

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/[email protected]