On Tue, May 24, 2016 at 03:48:42PM -0700, Andy Lutomirski wrote:
> If a uaccess instruction fails due to an8 error other than #PF,
> warn. If the fault is #GP, it most likely indicates access to a
> non-canonical address, which means that an access_ok check is
> missing, and that's bad. If the fault is something else (#UD?),
> then something is very wrong and we should diagnose it rather
> than ignoring it.
>
> Signed-off-by: Andy Lutomirski <l...@kernel.org>
> ---
> arch/x86/mm/extable.c | 13 +++++++++++++
> 1 file changed, 13 insertions(+)
>
> diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
> index 658292fdee5e..c1933471fce7 100644
> --- a/arch/x86/mm/extable.c
> +++ b/arch/x86/mm/extable.c
> @@ -29,6 +29,19 @@ EXPORT_SYMBOL(ex_handler_default);
> static bool uaccess_fault_okay(int trapnr, unsigned long error_code,
> unsigned long extra)
> {
> + /*
> + * For uaccess, only page faults should be fixed up. I can't see
> + * any exploit mitigation value in OOPSing on other types of faults,
> + * so just warn and continue if that happens. This means that
> + * uaccess faults to non-canonical addresses will warn. That's okay
> + * -- this will only happen if an access_ok is missing, and we want to
> + * detect that error if it happens.
> + */
> + if (WARN_ONCE(trapnr != X86_TRAP_PF,
> + "unexpected uaccess trap %d (may indicate a missing
> access_ok on a non-canonical address)\n",
> + trapnr))
Perhaps dump also regs->ip and make the warn message more helpful...
> + return true; /* no good reason to OOPS. */
You love those side comments, don'tcha? :-)
--
Regards/Gruss,
Boris.
ECO tip #101: Trim your mails when you reply.
