x86: uaccess hardening, easy part
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest7 patches 22 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/7 | x86/xen: Simplify set_aliased_protarch/ | +1 | 0 replies | |
| 1/7 | x86/xen: Simplify set_aliased_protarch/ | +1 | 8 replies | |
| 2/7 | x86/extable: Pass error_code and an extra unsigned long to exhandlersarch/ arch/ arch/ +3 more | +31 | 0 replies | |
| 3/7 | x86/uaccess: Give uaccess faults their own handlerarch/ arch/ arch/ +1 more | +42 | 0 replies | |
| 4/7 | x86/dumpstack: If addr_limit is non-default, display itarch/ arch/ | +9 | 7 replies | |
| 5/7 | x86/uaccess: Warn on uaccess faults other than #PFarch/ | +13 | 2 replies | |
| 6/7 | x86/uaccess: Don't fix up USER_DS uaccess faults to kernel addressesarch/ | +18 | 0 replies | |
| 7/7 | x86/uaccess: OOPS or warn on a fault with KERNEL_DS and !pagefault_disabled()arch/ | +31 | 2 replies |
Reviews trailers per patch
2 of 8 patches have a Reviewed-by or Acked-by of their own; the series has one for all of them.
| Patch | Andrew Cooper | David Vrabel | Kees Cook |
|---|---|---|---|
| Series | R-b | ||
| 1/7 | R-b R-b | A-b A-b | |
| 1/7 | R-b R-b | A-b A-b | |
| 2/7 | |||
| 3/7 | |||
| 4/7 | |||
| 5/7 | |||
| 6/7 | |||
| 7/7 |
Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes. Scroll the table sideways for all 3 reviewers.
Cover letter [PATCH 0/7] x86: uaccess hardening, easy part
This series hardens x86's uaccess code a bit. It adds warnings for some screwups, adds an OOPS for a major exploitable screwup, and it improves debuggability a bit by indicating non-default fs in oopses.
It shouldn't cause any new OOPSes except in the particularly dangerous case where the kernel faults on a kernel address under USER_DS, which indicates that an access_ok is missing and is likely to be easily exploitable -- OOPSing will make it harder to exploit.
I have some draft patches to force OOPSes on user address accesses under KERNEL_DS (which is a big no-no), but I'd rather make those warn instead of OOPSing, and I don't have a good implementation of that yet. Those patches aren't part of this series.
Andy Lutomirski (7):
x86/xen: Simplify set_aliased_prot
x86/extable: Pass error_code and an extra unsigned long to exhandlers x86/uaccess: Give uaccess faults their own handler x86/dumpstack: If addr_limit is non-default, display it x86/uaccess: Warn on uaccess faults other than #PF x86/uaccess: Don't fix up USER_DS uaccess faults to kernel addresses x86/uaccess: OOPS or warn on a fault with KERNEL_DS and
!pagefault_disabled()
arch/x86/include/asm/uaccess.h | 19 ++++--- arch/x86/kernel/cpu/mcheck/mce.c | 2 +- arch/x86/kernel/dumpstack_32.c | 4 ++ arch/x86/kernel/dumpstack_64.c | 5 ++ arch/x86/kernel/kprobes/core.c | 6 +- arch/x86/kernel/traps.c | 6 +- arch/x86/lib/getuser.S | 12 ++-- arch/x86/lib/putuser.S | 10 ++-- arch/x86/mm/extable.c | 120 ++++++++++++++++++++++++++++++++++----- arch/x86/mm/fault.c | 2 +- arch/x86/xen/enlighten.c | 4 +- 11 files changed, 145 insertions(+), 45 deletions(-)
Signature · 1 line
2.5.5