From patchwork Mon Sep 11 15:28:05 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mark Salyzyn X-Patchwork-Id: 9947603 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 5A05E602C9 for ; Mon, 11 Sep 2017 15:28:55 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 489FB28C03 for ; Mon, 11 Sep 2017 15:28:55 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 4707E28C04; Mon, 11 Sep 2017 15:28:55 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [65.50.211.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 5E5F528CD0 for ; Mon, 11 Sep 2017 15:28:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=geVn+fNGmNqRhVpanEBXk78BCsHJnVTCH/XFrc4iqaQ=; b=kYz EOhV06WsBtOwTuAGcSvcciAJ17h5XOSHOQt6VDFGhZ6JPIyO+dlEPaAqhTG7pGVQSuu49rB/2b4qN CyGYvGMMKzyaodHSAG5DThk74sT9Qdl/01Y1FbwNZgoUWHry3RrbLFVMthtkcdeYOUfEFoDnrKrSd 758oLYzj3iAhMmalBd9SxEis8+BHo6B3Y73Jp84KqpeCkIwe8j1iS762r84GFHGU9fl0VFQTFZTk2 ay+ghf2ItIlFoocaGeXxcWhrwd+alBX0xTGottXfqv5eDafdt2a4wZgoPDenEG14mkK+JHMGQsEvz vQQWRoSDCiBDd2bQ0hs8eZ6puGSU5lw==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.87 #1 (Red Hat Linux)) id 1drQdj-0002jD-S9; Mon, 11 Sep 2017 15:28:47 +0000 Received: from mail-pg0-x232.google.com ([2607:f8b0:400e:c05::232]) by bombadil.infradead.org with esmtps (Exim 4.87 #1 (Red Hat Linux)) id 1drQdb-0002cb-8I for linux-arm-kernel@lists.infradead.org; Mon, 11 Sep 2017 15:28:45 +0000 Received: by mail-pg0-x232.google.com with SMTP id j16so5537392pga.1 for ; Mon, 11 Sep 2017 08:28:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=android.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=engZr9RjjrfnhjMYKG1efy/r9bFcJwlB0LvPfvNqUtQ=; b=dqymZkXG/Au5xH7Dc8sdv2iJQWpWL/la/TI5hVtKWIClaLAQMhRI0W/Gn/mttwHHtF 5ISbL3gr+cKqUC4kWOhzhxpc9yNDptunenhjoVDPGtH7ITz7SHXWYqLAhx2/ChJO79vz 1+LwtYp2kaixd/z0YP/tTuQfwRkoXhuq+II31Awr7R52p7QFzkRXvsDgaRxx/WZ2CnSz Qrvu6WIGreSxCRq/fMVXAnJCYGxaxHtGr/TDHdwUe7y5wStTDdrYiVx72Z/KcqvK559s HspRYDArcrcv1/hq7hH+++vJmLvw2tQ/9NOE2k5z0RHCmDw9RY0gr7YHJlGFuAp+KhPv upfg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=engZr9RjjrfnhjMYKG1efy/r9bFcJwlB0LvPfvNqUtQ=; b=J1dvThNWwMvjHF0PqUB4NGBAkEtz+9mbYXq0IRtzosA6V0R1dYLHVX4KHAoGQMcN9j JSlLzsvjFw70Nwtb8SlpofHaCy6FQrVjc1jT1AyEnLuU/5nqNMP7S94N02trwkffLuWF kzIGguEZBrgIDmaGtfm5X/izzA+z4edBJREjvit5dPI6fMw+c9AhOjDItBN4303hl4/g Zqzcr2sxAPK35hXct8KrfSG+JfgMWcn4CJqVTEsyZwi0SK5iqVm8Kd60aEKUNcYC5KdT IykF9fYgbas5O/IWKtB6FR5LTNenCfCi3X6fn6dNK1vC9Km8h0UGwQk7XQnYn99JxfRp BS1g== X-Gm-Message-State: AHPjjUgUgDYmRJe55sxFnYbm+VZKpKj4FJmqRejbCyTrZQSaf40/+3sU tiVtkktZZNBafCck X-Google-Smtp-Source: ADKCNb67rsSLtjkExZaHklE8H2b0sMXo1oNBfcE/Fh+AybcOGhh6N/L5ivVpe/kxbBrD1qrY362MuQ== X-Received: by 10.99.181.23 with SMTP id y23mr12201404pge.179.1505143698132; Mon, 11 Sep 2017 08:28:18 -0700 (PDT) Received: from nebulus.mtv.corp.google.com ([100.98.120.17]) by smtp.gmail.com with ESMTPSA id e4sm16901888pfa.112.2017.09.11.08.28.16 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 11 Sep 2017 08:28:17 -0700 (PDT) From: Mark Salyzyn To: linux-kernel@vger.kernel.org Subject: [PATCH v3 3/3] arm64: compat: Add CONFIG_KUSER_HELPERS Date: Mon, 11 Sep 2017 08:28:05 -0700 Message-Id: <20170911152810.95685-1-salyzyn@android.com> X-Mailer: git-send-email 2.14.1.581.gf28d330327-goog X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20170911_082839_518064_AB633F6D X-CRM114-Status: GOOD ( 17.61 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: mark.rutland@arm.com, peterz@infradead.org, catalin.marinas@arm.com, will.deacon@arm.com, mingo@kernel.org, zijun_hu@htc.com, jszhang@marvell.com, borntraeger@de.ibm.com, takahiro.akashi@linaro.org, labbott@redhat.com, Dave.Martin@arm.com, keescook@chromium.org, kevin.brodsky@arm.com, Scott Wood , mmarek@suse.com, john.stultz@linaro.org, linux-arm-kernel@lists.infradead.org, ard.biesheuvel@linaro.org, Dmitry Safonov , Mark Salyzyn , james.morse@arm.com, credmonster@gmail.com MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP From: Kevin Brodsky Make it possible to disable the kuser helpers by adding a KUSER_HELPERS config option (enabled by default). When disabled, all kuser helpers-related code is removed from the kernel and no mapping is done at the fixed high address (0xffff0000); any attempt to use a kuser helper from a 32-bit process will result in a segfault. Signed-off-by: Kevin Brodsky Signed-off-by: Mark Salyzyn v2: - split off assembler changes to a new previous patch in series to reduce churn - modify slightly the feature documentation to reduce its reach - modify slightly the feature documentation to rationalize the yes default. - There are more ifdefs as a result of the rebase. v3: - rebase --- arch/arm64/Kconfig | 30 ++++++++++++++++++++++++++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/vdso.c | 10 ++++++++++ 3 files changed, 41 insertions(+), 1 deletion(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 0df64a6a56d4..c29299bbb7d7 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -1113,6 +1113,36 @@ config COMPAT If you want to execute 32-bit userspace applications, say Y. +config KUSER_HELPERS + bool "Enable the kuser helpers page in 32-bit processes" + depends on COMPAT + default y + help + Warning: disabling this option may break 32-bit applications. + + Provide kuser helpers in a special purpose fixed-address page. The + kernel provides helper code to userspace in read-only form at a fixed + location to allow userspace to be independent of the CPU type fitted + to the system. This permits 32-bit binaries to be run on ARMv6 through + to ARMv8 without modification. + + See Documentation/arm/kernel_user_helpers.txt for details. + + However, the fixed-address nature of these helpers can be used by ROP + (return-orientated programming) authors when creating exploits. + + If all of the 32-bit binaries and libraries that run on your platform + are built specifically for your platform, and make no use of these + helpers, then you can turn this option off to hinder such exploits. + However, in that case, if a binary or library relying on those helpers + is run, it will receive a SIGSEGV signal, which will terminate the + program. Typically, binaries compiled for ARMv7 or later do not use + the kuser helpers. + + Say N here only if you are absolutely certain that you do not need + these helpers; otherwise, the safe option is to say Y (the default + for now) + config SYSVIPC_COMPAT def_bool y depends on COMPAT && SYSVIPC diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index 59e1b2b002e5..12f9d1e3a027 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -30,7 +30,7 @@ $(obj)/%.stub.o: $(obj)/%.o FORCE arm64-obj-$(CONFIG_COMPAT) += sys32.o signal32.o \ sys_compat.o entry32.o arm64-obj-$(CONFIG_COMPAT) += sigreturn32.o -arm64-obj-$(CONFIG_COMPAT) += kuser32.o +arm64-obj-$(CONFIG_KUSER_HELPERS) += kuser32.o arm64-obj-$(CONFIG_FUNCTION_TRACER) += ftrace.o entry-ftrace.o arm64-obj-$(CONFIG_MODULES) += arm64ksyms.o module.o arm64-obj-$(CONFIG_ARM64_MODULE_PLTS) += module-plts.o diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c index 544bbee5b447..6af0defff416 100644 --- a/arch/arm64/kernel/vdso.c +++ b/arch/arm64/kernel/vdso.c @@ -62,18 +62,22 @@ static const struct vm_special_mapping compat_vdso_spec[] = { .name = "[sigpage]", .pages = &vectors_page[0], }, +#ifdef CONFIG_KUSER_HELPERS { .name = "[kuserhelpers]", .pages = &vectors_page[1], }, +#endif }; static struct page *vectors_page[ARRAY_SIZE(compat_vdso_spec)] __ro_after_init; static int __init alloc_vectors_page(void) { +#ifdef CONFIG_KUSER_HELPERS extern char __kuser_helper_start[], __kuser_helper_end[]; size_t kuser_sz = __kuser_helper_end - __kuser_helper_start; unsigned long kuser_vpage; +#endif extern char __aarch32_sigret_code_start[], __aarch32_sigret_code_end[]; size_t sigret_sz = @@ -84,22 +88,26 @@ static int __init alloc_vectors_page(void) if (!sigret_vpage) return -ENOMEM; +#ifdef CONFIG_KUSER_HELPERS kuser_vpage = get_zeroed_page(GFP_ATOMIC); if (!kuser_vpage) { free_page(sigret_vpage); return -ENOMEM; } +#endif /* sigreturn code */ memcpy((void *)sigret_vpage, __aarch32_sigret_code_start, sigret_sz); flush_icache_range(sigret_vpage, sigret_vpage + PAGE_SIZE); vectors_page[0] = virt_to_page(sigret_vpage); +#ifdef CONFIG_KUSER_HELPERS /* kuser helpers */ memcpy((void *)kuser_vpage + 0x1000 - kuser_sz, __kuser_helper_start, kuser_sz); flush_icache_range(kuser_vpage, kuser_vpage + PAGE_SIZE); vectors_page[1] = virt_to_page(kuser_vpage); +#endif return 0; } @@ -128,11 +136,13 @@ int aarch32_setup_vectors_page(struct linux_binprm *bprm, int uses_interp) current->mm->context.vdso = (void *)addr; +#ifdef CONFIG_KUSER_HELPERS /* Map the kuser helpers at the ABI-defined high address. */ ret = _install_special_mapping(mm, AARCH32_KUSER_HELPERS_BASE, PAGE_SIZE, VM_READ|VM_EXEC|VM_MAYREAD|VM_MAYEXEC, &compat_vdso_spec[1]); +#endif out: up_write(&mm->mmap_sem);