Skip to content

x86: uaccess hardening, easy part

Andy Lutomirski lkml xen-devel 1 version In review

Get series with b4
b4 am [email protected]

Versions newest first

  1. v1 Latest7 patches 22 repliesIn review

Patches in v1 No applies recorded yet

#Subject and filesSizeRepliesApplied
1/7x86/xen: Simplify set_aliased_protarch/x86/xen/enlighten.c+1 -30 replies
1/7x86/xen: Simplify set_aliased_protarch/x86/xen/enlighten.c+1 -38 replies
2/7x86/extable: Pass error_code and an extra unsigned long to exhandlersarch/x86/include/asm/uaccess.h arch/x86/kernel/cpu/mcheck/mce.c arch/x86/kernel/kprobes/core.c +3 more+31 -190 replies
3/7x86/uaccess: Give uaccess faults their own handlerarch/x86/include/asm/uaccess.h arch/x86/lib/getuser.S arch/x86/lib/putuser.S +1 more+42 -230 replies
4/7x86/dumpstack: If addr_limit is non-default, display itarch/x86/kernel/dumpstack_32.c arch/x86/kernel/dumpstack_64.c+9 -07 replies
5/7x86/uaccess: Warn on uaccess faults other than #PFarch/x86/mm/extable.c+13 -02 replies
6/7x86/uaccess: Don't fix up USER_DS uaccess faults to kernel addressesarch/x86/mm/extable.c+18 -00 replies
7/7x86/uaccess: OOPS or warn on a fault with KERNEL_DS and !pagefault_disabled()arch/x86/mm/extable.c+31 -02 replies

Reviews trailers per patch

2 of 8 patches have a Reviewed-by or Acked-by of their own; the series has one for all of them.

PatchAndrew CooperDavid VrabelKees Cook
SeriesR-b
1/7R-b R-b A-b A-b
1/7R-b R-b A-b A-b
2/7
3/7
4/7
5/7
6/7
7/7

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.

Read the v1 thread

Cover letter [PATCH 0/7] x86: uaccess hardening, easy part

This series hardens x86's uaccess code a bit. It adds warnings for some screwups, adds an OOPS for a major exploitable screwup, and it improves debuggability a bit by indicating non-default fs in oopses.

It shouldn't cause any new OOPSes except in the particularly dangerous case where the kernel faults on a kernel address under USER_DS, which indicates that an access_ok is missing and is likely to be easily exploitable -- OOPSing will make it harder to exploit.

I have some draft patches to force OOPSes on user address accesses under KERNEL_DS (which is a big no-no), but I'd rather make those warn instead of OOPSing, and I don't have a good implementation of that yet. Those patches aren't part of this series.

Andy Lutomirski (7):
x86/xen: Simplify set_aliased_prot
x86/extable: Pass error_code and an extra unsigned long to exhandlers x86/uaccess: Give uaccess faults their own handler x86/dumpstack: If addr_limit is non-default, display it x86/uaccess: Warn on uaccess faults other than #PF x86/uaccess: Don't fix up USER_DS uaccess faults to kernel addresses x86/uaccess: OOPS or warn on a fault with KERNEL_DS and
!pagefault_disabled()

 arch/x86/include/asm/uaccess.h   |  19 ++++---
 arch/x86/kernel/cpu/mcheck/mce.c |   2 +-
 arch/x86/kernel/dumpstack_32.c   |   4 ++
 arch/x86/kernel/dumpstack_64.c   |   5 ++
 arch/x86/kernel/kprobes/core.c   |   6 +-
 arch/x86/kernel/traps.c          |   6 +-
 arch/x86/lib/getuser.S           |  12 ++--
 arch/x86/lib/putuser.S           |  10 ++--
 arch/x86/mm/extable.c            | 120 ++++++++++++++++++++++++++++++++++-----
 arch/x86/mm/fault.c              |   2 +-
 arch/x86/xen/enlighten.c         |   4 +-
 11 files changed, 145 insertions(+), 45 deletions(-)
Signature · 1 line
2.5.5