Re: [PATCH v2] x86/dumpstack: don't dump kernel memory based on usermode RIP

2018-08-29 Thread Borislav Petkov
On Wed, Aug 29, 2018 at 03:55:32PM +0200, Jann Horn wrote: > > > diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c > > > index 9c8652974f8e..14b337582b6f 100644 > > > --- a/arch/x86/kernel/dumpstack.c > > > +++ b/arch/x86/kernel/dumpstack.c > > > @@ -89,14 +89,21 @@ static void

Re: [PATCH v2] x86/dumpstack: don't dump kernel memory based on usermode RIP

2018-08-29 Thread Jann Horn
On Wed, Aug 29, 2018 at 9:10 AM Borislav Petkov wrote: > > On Tue, Aug 28, 2018 at 05:49:01PM +0200, Jann Horn wrote: > > show_opcodes() is used both for dumping kernel instructions and for dumping > > user instructions. If userspace causes #PF by jumping to a kernel address, > > show_opcodes() ca

Re: [PATCH v2] x86/dumpstack: don't dump kernel memory based on usermode RIP

2018-08-29 Thread Borislav Petkov
On Tue, Aug 28, 2018 at 05:49:01PM +0200, Jann Horn wrote: > show_opcodes() is used both for dumping kernel instructions and for dumping > user instructions. If userspace causes #PF by jumping to a kernel address, > show_opcodes() can be reached with regs->ip controlled by the user, > pointing to k

Re: [PATCH v2] x86/dumpstack: don't dump kernel memory based on usermode RIP

2018-08-29 Thread Borislav Petkov
On Tue, Aug 28, 2018 at 06:29:43PM +0200, Jann Horn wrote: > No, you can also get user opcode bytes printed by WARN() and friends. > When you add a WARN() in the pagefault handler, you get something like Ok, let's always do the checking then - who knows in what context we might be dumping opcodes

Re: [PATCH v2] x86/dumpstack: don't dump kernel memory based on usermode RIP

2018-08-28 Thread Jann Horn
On Tue, Aug 28, 2018 at 6:25 PM Borislav Petkov wrote: > > On Tue, Aug 28, 2018 at 05:49:01PM +0200, Jann Horn wrote: > > show_opcodes() is used both for dumping kernel instructions and for dumping > > user instructions. If userspace causes #PF by jumping to a kernel address, > > show_opcodes() ca

Re: [PATCH v2] x86/dumpstack: don't dump kernel memory based on usermode RIP

2018-08-28 Thread Borislav Petkov
On Tue, Aug 28, 2018 at 05:49:01PM +0200, Jann Horn wrote: > show_opcodes() is used both for dumping kernel instructions and for dumping > user instructions. If userspace causes #PF by jumping to a kernel address, > show_opcodes() can be reached with regs->ip controlled by the user, > pointing to k

[PATCH v2] x86/dumpstack: don't dump kernel memory based on usermode RIP

2018-08-28 Thread Jann Horn
show_opcodes() is used both for dumping kernel instructions and for dumping user instructions. If userspace causes #PF by jumping to a kernel address, show_opcodes() can be reached with regs->ip controlled by the user, pointing to kernel code. Make sure that userspace can't trick us into dumping ke