From patchwork Thu Apr 19 15:48:33 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Peter Maydell X-Patchwork-Id: 10351153 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9B2596053C for ; Thu, 19 Apr 2018 16:04:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7AA3728AB1 for ; Thu, 19 Apr 2018 16:04:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6F83528AB3; Thu, 19 Apr 2018 16:04:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI autolearn=ham version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id D032028AB2 for ; Thu, 19 Apr 2018 16:04:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=zOaDWGSGX4zgPnt8pb+yxNw30kfa7OTHbVOzq/CV7E8=; b=mrG IT1K9Cxc/wyr1oUCsF9L3nS/RUcFJu5CzAhc9x1iqGjR4IBAcb9UdV0iRIIXAeTXDI7lJyFQxPqnG dxB1nf/j+6/asRzfjUH+6xUlItTiRehefflNIpJgGQio8Xk9bZwAncKoHjVv1ICkUHG+Ao7jsDxOR DXO7At7hBZUasplzIwmaDlZeCqzFny33PvEFm3tJyJPzXTu+6fgYdDq6FHOtOJ1FU/lm7K03Ls4Pe yYR+KVZt4KrysRDoezndX+yD3OLsYwt8HwQzH6ds7hwMQEFA3KrFyC1AFJ3mJGWomiP63f1alkqXO wyPxDZKCNo5Vyp1JYNXr+mxPB/cWwRA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1f9C2J-00083Z-0E; Thu, 19 Apr 2018 16:03:51 +0000 Received: from casper.infradead.org ([2001:8b0:10b:1236::1]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1f9C24-0007pt-BS for linux-arm-kernel@bombadil.infradead.org; Thu, 19 Apr 2018 16:03:36 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Message-Id:Date:Subject:Cc:To:From: Sender:Reply-To:MIME-Version:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender: Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=j2HQFhaPGu3ZMmAFtAEeSbpNyS+H6TSFl/7Xg8V8jRk=; b=tTUX1G5aq0vIp+4iCMtmvlA7I 6TMJefzgmInFA+yT1AEGqOCs1rcBch6ejnpwNVPAb4y8uFwr1ToNx7VtpBd5YPDWxtrC362vP+k+m M90xKWulh4YEumS65EAVDl0Gw2AAAvMeODUWr2LKuCdLJ+XvWjlXeyzUkq1vse0Bb42TlZAM7M3wv uJiAxcwr3kxJQig6d0B317nzBizKO040aXTfBdMPwrdrX1I+mcYXEXFFyl7gXMmM5YlTH5iPoKpv7 qrGDrzIQcQuNm4jTz6C0yO29FziFKiOyGrSS3/A6yuTQ6OS2ZjbTuJUnYs+/5yZ0XYh3fv6eF5+ax tdJQ8aImg==; Received: from orth.archaic.org.uk ([81.2.115.148]) by casper.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1f9BuN-0002CK-93 for linux-arm-kernel@lists.infradead.org; Thu, 19 Apr 2018 15:55:41 +0000 Received: from pm215 by orth.archaic.org.uk with local (Exim 4.89) (envelope-from ) id 1f9BnX-0004Qw-Mk; Thu, 19 Apr 2018 16:48:35 +0100 From: Peter Maydell To: linux-arm-kernel@lists.infradead.org Subject: [RFC PATCH v2] arm64: fault: Don't leak data in ESR context for user fault on kernel VA Date: Thu, 19 Apr 2018 16:48:33 +0100 Message-Id: <20180419154833.27727-1-peter.maydell@linaro.org> X-Mailer: git-send-email 2.17.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180419_165539_367672_CDBAF860 X-CRM114-Status: GOOD ( 23.09 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Robin Murphy , Will Deacon , Dave Martin , Catalin Marinas , Ard Biesheuvel MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP If userspace faults on a kernel address, handing them the raw ESR value on the sigframe as part of the delivered signal can leak data useful to attackers who are using information about the underlying hardware fault type (e.g. translation vs permission) as a mechanism to defeat KASLR. However there are also legitimate uses for the information provided in the ESR -- notably the GCC and LLVM sanitizers use this to report whether wild pointer accesses by the application are reads or writes (since a wild write is a more serious bug than a wild read), so we don't want to drop the ESR information entirely. For faulting addresses in the kernel, sanitize the ESR. We choose to present userspace with the illusion that there is nothing mapped in the kernel's part of the address space at all, by reporting all faults as level 0 translation faults. These fields are safe to pass through to userspace as they depend only on the instruction that userspace used to provoke the fault: EC IL (always) ISV CM WNR (for all data aborts) SAS SSE SRT SF AR (for data aborts when ISV is 1) All the other fields in ESR except DFSC are architecturally RES0 for an L0 translation fault, so can be zeroed out without confusing userspace. The illusion is not entirely perfect, as there is a tiny wrinkle where we will report an alignment fault that was not due to the memory type (for instance a LDREX to an unaligned address) as a translation fault, whereas if you do this on real unmapped memory the alignment fault takes precedence. This is not likely to trip anybody up in practice, as the only users we know of for the ESR information who care about the behaviour for kernel addresses only really want to know about the WnR bit. Signed-off-by: Peter Maydell --- This RFC patch is an alternative proposal to Will's patch https://patchwork.kernel.org/patch/10258781/ which simply removed the ESR record entirely for kernel addresses. Changes v1->v2: * rebased on master * commit message tweak * DABT_CUR and IABT_CUR moved to "can't happen" default case * explicitly clear the bits which are RES0 if ISV == 0 * comment text tweaks --- arch/arm64/mm/fault.c | 55 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 4165485e8b6e..8fa78fa01a4a 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -293,6 +293,61 @@ static void __do_kernel_fault(unsigned long addr, unsigned int esr, static void __do_user_fault(struct siginfo *info, unsigned int esr) { current->thread.fault_address = (unsigned long)info->si_addr; + + /* + * If the faulting address is in the kernel, we must sanitize the ESR. + * From userspace's point of view, kernel-only mappings don't exist + * at all, so we report them as level 0 translation faults. + * (This is not quite the way that "no mapping there at all" behaves: + * an alignment fault not caused by the memory type would take + * precedence over translation fault for a real access to empty + * space. Unfortunately we can't easily distinguish "alignment fault + * not caused by memory type" from "alignment fault caused by memory + * type", so we ignore this wrinkle and just return the translation + * fault.) + */ + if (current->thread.fault_address >= TASK_SIZE) { + switch (ESR_ELx_EC(esr)) { + case ESR_ELx_EC_DABT_LOW: + /* + * These bits provide only information about the + * faulting instruction, which userspace knows already. + * We explicitly clear bits which are architecturally + * RES0 in case they are given meanings in future. + */ + if (esr & ESR_ELx_ISV) + esr &= ESR_ELx_EC_MASK | ESR_ELx_IL | + ESR_ELx_ISV | ESR_ELx_SAS | + ESR_ELx_SSE | ESR_ELx_SRT_MASK | + ESR_ELx_SF | ESR_ELx_AR | ESR_ELx_CM | + ESR_ELx_WNR; + else + esr &= ESR_ELx_EC_MASK | ESR_ELx_IL | + ESR_ELx_CM | ESR_ELx_WNR; + esr |= ESR_ELx_FSC_FAULT; + break; + case ESR_ELx_EC_IABT_LOW: + /* + * Claim a level 0 translation fault. + * All other bits are architecturally RES0 for faults + * reported with that DFSC value, so we clear them. + */ + esr &= ESR_ELx_EC_MASK | ESR_ELx_IL; + esr |= ESR_ELx_FSC_FAULT; + break; + default: + /* + * This should never happen (entry.S only brings us + * into this code for insn and data aborts from a lower + * exception level). Fail safe by not providing an ESR + * context record at all. + */ + WARN(1, "ESR 0x%x is not DABT or IABT from EL0\n", esr); + esr = 0; + break; + } + } + current->thread.fault_code = esr; arm64_force_sig_info(info, esr_to_fault_info(esr)->name, current); }