Skip to contentSkip to conversation

Help Needed!

CHECKER Andi Kleen 2 participants 2 messages Apr 21, 2003 1 message not in the archive

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Andi Kleen

author
#1 lore raw
Quoted 6 lines · Manfred Spraul

P.S.: On i386, you can access both kernel and user space after set_fs(KERNEL_DS), or if you use __get_user() and bypass access_ok(). Thus the __get_user() in arch/i386/kernel/traps.c, function show_registers is correct. This is the only instance I'm aware of where this is used, and noone else should be doing that. It fails on other archs, e.g. on sparc.

It is used in a couple more of places in the x86-64 architecture specific code. Of course it is legal there too.

Also there are some corner cases; e.g. some architecture specific code (particularly the 32bit emulations) just does access_ok or get_user/put_user (with implied access_ok) on the first element of a structure and then accesses the other elements with __*_user. This works because these architectures have an unmapped hole at the end of the user address space.

But in most other cases (in general outside arch/) it is very likely a bug and a security hole.

-Andi

#2 lore raw
Quoted 13 lines · Andi Kleen
Quoted 8 lines · Manfred Spraul

P.S.: On i386, you can access both kernel and user space after set_fs(KERNEL_DS), or if you use __get_user() and bypass access_ok(). Thus the __get_user() in arch/i386/kernel/traps.c, function show_registers is correct. This is the only instance I'm aware of where this is used, and noone else should be doing that. It fails on other archs, e.g. on sparc.

Quoted 8 lines

It is used in a couple more of places in the x86-64 architecture specific code. Of course it is legal there too.

Also there are some corner cases; e.g. some architecture specific
code (particularly the 32bit emulations) just does access_ok or get_user/put_user (with implied access_ok) on the first element of a structure and then accesses the other elements with __*_user. This works because these architectures have an unmapped hole at the end of the user address space.

This is different bug:
- bug 1 is access user space without the functions from <asm/uaccess.h>, or access user space after set_fs(KERNEL_DS), or access kernel space without set_fs(KERNEL_DS).
- bug 2 is not enough access_ok() calls, e.g. __put_user without a preceeding access_ok() check, either explicit or implicit due to an copy_from_user().

--
Manfred