Files
kernel/include/linux
Jann Horn 9da3f2b740 x86/fault: BUG() when uaccess helpers fault on kernel addresses
There have been multiple kernel vulnerabilities that permitted userspace to
pass completely unchecked pointers through to userspace accessors:

 - the waitid() bug - commit 96ca579a1e ("waitid(): Add missing
   access_ok() checks")
 - the sg/bsg read/write APIs
 - the infiniband read/write APIs

These don't happen all that often, but when they do happen, it is hard to
test for them properly; and it is probably also hard to discover them with
fuzzing. Even when an unmapped kernel address is supplied to such buggy
code, it just returns -EFAULT instead of doing a proper BUG() or at least
WARN().

Try to make such misbehaving code a bit more visible by refusing to do a
fixup in the pagefault handler code when a userspace accessor causes a #PF
on a kernel address and the current context isn't whitelisted.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: kernel-hardening@lists.openwall.com
Cc: dvyukov@google.com
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Cc: Borislav Petkov <bp@alien8.de>
Link: https://lkml.kernel.org/r/20180828201421.157735-7-jannh@google.com
2018-09-03 15:12:09 +02:00
..
2018-08-09 14:05:30 -07:00
2018-07-24 14:43:26 -06:00
2018-08-22 10:52:48 -07:00
2018-07-22 14:13:43 +02:00
2018-07-24 19:11:26 +02:00
2018-07-27 09:57:23 +10:00
2018-08-08 11:06:20 +02:00
2018-08-22 10:52:45 -07:00
2018-08-15 14:59:03 -05:00
2018-07-19 11:34:23 +01:00
2018-07-25 13:41:22 -07:00
2018-07-21 10:43:12 -05:00
2018-08-22 10:52:46 -07:00
2018-07-20 01:11:45 +02:00
2018-08-02 17:33:06 -04:00
2018-08-02 17:16:05 +02:00
2018-08-16 12:14:42 -07:00