Patch "mm: Tighten x86 /dev/mem with zeroing reads" has been added to the 4.10-stable tree
Subsystems (4)
This is a note to let you know that I've just added the patch titled
mm: Tighten x86 /dev/mem with zeroing reads
to the 4.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
mm-tighten-x86-dev-mem-with-zeroing-reads.patch
and it can be found in the queue-4.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
a4866aa812518ed1a37d8ea0c881dc946409de94Mon Sep 17 00:00:00 2001
From: Kees Cook <[email protected]>
Date: Wed, 5 Apr 2017 09:39:08 -0700
Subject: mm: Tighten x86 /dev/mem with zeroing reads
From: Kees Cook <[email protected]>
commit a4866aa812518ed1a37d8ea0c881dc946409de94 upstream.
Under CONFIG_STRICT_DEVMEM, reading System RAM through /dev/mem is disallowed. However, on x86, the first 1MB was always allowed for BIOS and similar things, regardless of it actually being System RAM. It was possible for heap to end up getting allocated in low 1MB RAM, and then read by things like x86info or dd, which would trip hardened usercopy:
usercopy: kernel memory exposure attempt detected from ffff880000090000 (dma-kmalloc-256) (4096 bytes)
This changes the x86 exception for the low 1MB by reading back zeros for System RAM areas instead of blindly allowing them. More work is needed to extend this to mmap, but currently mmap doesn't go through usercopy, so hardened usercopy won't Oops the kernel.
--- arch/x86/mm/init.c | 41 +++++++++++++++++++------- drivers/char/mem.c | 82 +++++++++++++++++++++++++++++++++-------------------- 2 files changed, 82 insertions(+), 41 deletions(-)
arch/x86/mm/init.c +30 -11
@@ -643,21 +643,40 @@ void __init init_mem_mapping(void)* devmem_is_allowed() checks to see if /dev/mem access to a certain address * is valid. The argument is a physical page number. * -* -* On x86, access has to be given to the first megabyte of ram because that area -* contains BIOS code and data regions used by X and dosemu and similar apps. -* Access has to be given to non-kernel-ram areas as well, these contain the PCI -* mmio resources as well as potential bios/acpi data regions. +* On x86, access has to be given to the first megabyte of RAM because that +* area traditionally contains BIOS code and data regions used by X, dosemu, +* and similar apps. Since they map the entire memory range, the whole range +* must be allowed (for mapping), but any areas that would otherwise be +* disallowed are flagged as being "zero filled" instead of rejected. +* Access has to be given to non-kernel-ram areas as well, these contain the +* PCI mmio resources as well as potential bios/acpi data regions. */ int devmem_is_allowed (unsigned long pagenr) { -if (pagenr <256 ) -return 1 ; -if (iomem_is_exclusive (pagenr <<PAGE_SHIFT )) +if (page_is_ram (pagenr)) { +/* +* For disallowed memory regions in the low 1MB range, +* request that the page be shown as all zeros. +*/ +if (pagenr <256 ) +return 2 ; + +return 0 ; + } + +/* +* This must follow RAM test, since System RAM is considered a +* restricted resource under CONFIG_STRICT_IOMEM. +*/ +if (iomem_is_exclusive (pagenr <<PAGE_SHIFT )) { +/* Low 1MB bypasses iomem restrictions. */ +if (pagenr <256 ) +return 1 ; +return 0 ; -if (!page_is_ram (pagenr)) -return 1 ; -return 0 ; + } + +return 1 ; }void free_init_pages (char *what,unsigned long begin,unsigned long end)
drivers/char/mem.c +52 -30
117 lines not on this page · raw message
Patches currently in stable-queue which might be from [email protected] are
queue-4.10/mm-tighten-x86-dev-mem-with-zeroing-reads.patch