Powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which
from my (arguably very short) checking is not commonly done for other
archs. This is fine, except when PF_IO_WORKER's have been created and
the task does something that causes a coredump to be generated. Then we
get this crash:
Kernel attempted to read user page (160) - exploit attempt? (uid: 1000)
BUG: Kernel NULL pointer dereference on read at 0x00000160
Faulting instruction address: 0xc0000000000c3a60
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries
Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr
syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes
evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs
drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid
xhci_pci xhci_hcd usbcore usb_common sd_mod
CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88
Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005
of:SLOF,HEAD hv:linux,kvm pSeries
NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0
REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+)
MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 88082828 XER:
200400f8
CFAR: c0000000000c386c DAR: 0000000000000160 DSISR: 40000000 IRQMASK: 0
GPR00: c000000000039920 c000000004183650 c00000000175d600 c0000000040f9800
GPR04: 0000000000000160 0000000000000008 c000000000039920 0000000000000000
GPR08: 0000000000000000 0000000000000000 00000003fe060000 0000000000002000
GPR12: c0000000000398e0 c0000003fffff200 c0000000015edbc0 c00000000ba2f648
GPR16: c00000000ba2f600 c000000001616ea8 0000000000000004 00000000ffffffff
GPR20: 0000000000000048 c000000004183918 c000000001410f00 c000000001410ef8
GPR24: c0000000040f9800 c0000000040f9800 c0000000041837b8 c0000000000398e0
GPR28: c00000000cc4cb80 c0000000040f9800 0000000000000008 0000000000000008
NIP [c0000000000c3a60] memcpy_power7+0x200/0x7d0
LR [c000000000039944] ppr_get+0x64/0xb0
Call Trace:
[c000000004183650] [c000000000039920] ppr_get+0x40/0xb0 (unreliable)
[c000000004183690] [c0000000001e5e80] __regset_get+0x180/0x1f0
[c000000004183700] [c0000000001e5f94] regset_get_alloc+0x64/0x90
[c000000004183740] [c0000000007ae638] elf_core_dump+0xb98/0x1b60
[c0000000041839c0] [c0000000007bb564] do_coredump+0x1c34/0x24a0
[c000000004183ba0] [c0000000001acf0c] get_signal+0x71c/0x1410
[c000000004183ce0] [c0000000000228a0] do_notify_resume+0x140/0x6f0
[c000000004183db0] [c0000000000353bc]
interrupt_exit_user_prepare_main+0x29c/0x320
[c000000004183e20] [c00000000003579c] interrupt_exit_user_prepare+0x6c/0xa0
[c000000004183e50] [c00000000000c6f4] interrupt_return_srr_user+0x8/0x138
--- interrupt: 300 at 0x183ee09e0
NIP: 0000000183ee09e0 LR: 0000000183ee09dc CTR: 800000000280f033
REGS: c000000004183e80 TRAP: 0300 Not tainted (6.3.0-rc2+)
MSR: 800000000000d033 <SF,EE,PR,ME,IR,DR,RI,LE> CR: 22002848 XER: 000000f8
CFAR: 00007ffe6d746aa8 DAR: 0000000000000000 DSISR: 42000000 IRQMASK: 0
GPR00: 0000000183ee09dc 00007ffff20d37c0 0000000183f07f00 0000000000000000
GPR04: 0000000000000000 00007ffff20d37a8 0000000000000000 00007ffe6d9eae00
GPR08: 00007ffff20d3710 0000000000000000 0000000000000000 0000000000000000
GPR12: 0000000000000000 00007ffe6d9eae00 0000000000000000 0000000000000000
GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
GPR20: 0000000000000000 0000000000000000 0000000000000000 0000000183ee0860
GPR24: 00007ffe6d9df820 00007ffe6d9e0000 00007ffff20d7d98 0000000000000001
GPR28: 0000000183ee0c60 00007ffff20d7924 00007ffff20d7820 0000000000000000
NIP [0000000183ee09e0] 0x183ee09e0
LR [0000000183ee09dc] 0x183ee09dc
--- interrupt: 300
Code: f9030018 38630020 409f001c e8040000 e8c40008 38840010 f8030000 f8c30008
38630010 78a50720 7cb01120 409c001c <80040000> 80c40004 38840008 90030000
---[ end trace 0000000000000000 ]---
note: ppc-crash[1982] exited with irqs disabled
because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL
pt_regs.
Check for a valid pt_regs in both ppc_get/ppr_set, and return an error
if not set. The actual error value doesn't seem to be important here,
so just pick -EINVAL.
Signed-off-by: Jens Axboe <ax...@kernel.dk>
diff --git a/arch/powerpc/kernel/ptrace/ptrace-view.c
b/arch/powerpc/kernel/ptrace/ptrace-view.c
index 2087a785f05f..80b699dd0d7f 100644
--- a/arch/powerpc/kernel/ptrace/ptrace-view.c
+++ b/arch/powerpc/kernel/ptrace/ptrace-view.c
@@ -290,6 +290,8 @@ static int gpr_set(struct task_struct *target, const struct
user_regset *regset,
static int ppr_get(struct task_struct *target, const struct user_regset
*regset,
struct membuf to)
{
+ if (!target->thread.regs)
+ return -EINVAL;
return membuf_write(&to, &target->thread.regs->ppr, sizeof(u64));
}
@@ -297,6 +299,8 @@ static int ppr_set(struct task_struct *target, const struct
user_regset *regset,
unsigned int pos, unsigned int count, const void *kbuf,
const void __user *ubuf)
{
+ if (!target->thread.regs)
+ return -EINVAL;
return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
&target->thread.regs->ppr, 0, sizeof(u64));
}
--
Jens Axboe
