From patchwork Wed Jun 7 21:16:52 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tycho Andersen X-Patchwork-Id: 9772847 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id C16AB6034B for ; Wed, 7 Jun 2017 21:18:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id CD1E12847A for ; Wed, 7 Jun 2017 21:18:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C1D8A2848F; Wed, 7 Jun 2017 21:18:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id A43532847A for ; Wed, 7 Jun 2017 21:18:14 +0000 (UTC) Received: (qmail 11694 invoked by uid 550); 7 Jun 2017 21:18:12 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 10014 invoked from network); 7 Jun 2017 21:18:04 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=docker.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=jlskOS7p8p8p4AWSKza4ni+KcxQWa8hjZn0tEgmesmw=; b=ENG7G+9pnN+NjBA+bMgMDgFpNRpYe5MyWET3idmZanRtVkutQZHBrL9/urgxxIpX7q tMb6xBS/2+rKn3yuFtFgazdlLMUZ8zH1dba/jD8Q1aW5+zGtcXvcqt1Y+4AQYaL2/Jr3 nYKMEuPeuQMiD2iN2NRx8OyfENCCoaC5CamgU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=jlskOS7p8p8p4AWSKza4ni+KcxQWa8hjZn0tEgmesmw=; b=uBA2lfUj5FjXfcXZH/BIyCb35A+mOXn6I6AISPAAZ27OzVxipdQv9JTHSs5QLKjLRW MuLhfnHP8d/BDkNYJd+PmB5rMdJA79eEktXl/XArb7RYdCM/4Xq6/xQaZdECWJImFtyO e/uZBTPdbpzySYRLs7enyxzwHAwNgsgApcLSrlMsP0M7BuX7pp+MbXxNWTGdoGoynXYP gh+ZWONlyh1bYxCjtgsEMCdC1Wi/xZ+N12Fq9CpjMkJ9gXdZjWZeerXhiIznd32tJCZ/ Ze0OtFLBtBc4QA66YPe2MDdmf4n3d4XX2oTlI6lQx6Y9HkZ1S/F+moVZf0X37q4Dfqhu B7+Q== X-Gm-Message-State: AODbwcDlApM0FhsvFhGEWQEbhi6/VqbzXG1gGf0xpnNQKSWa8FkgoVuG 2JzaWFfz5zcTg7hR X-Received: by 10.107.13.148 with SMTP id 142mr26610688ion.158.1496870272576; Wed, 07 Jun 2017 14:17:52 -0700 (PDT) From: Tycho Andersen To: linux-mm@kvack.org Cc: Juerg Haefliger , kernel-hardening@lists.openwall.com, Juerg Haefliger , Tycho Andersen Date: Wed, 7 Jun 2017 15:16:52 -0600 Message-Id: <20170607211653.14536-3-tycho@docker.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170607211653.14536-1-tycho@docker.com> References: <20170607211653.14536-1-tycho@docker.com> Subject: [kernel-hardening] [RFC v4 2/3] lkdtm: Add tests for XPFO X-Virus-Scanned: ClamAV using ClamSMTP From: Juerg Haefliger Signed-off-by: Juerg Haefliger minor fixups for 5-level paging, whitespace Signed-off-by: Tycho Andersen --- drivers/misc/Makefile | 1 + drivers/misc/lkdtm.h | 3 ++ drivers/misc/lkdtm_core.c | 1 + drivers/misc/lkdtm_xpfo.c | 105 ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 110 insertions(+) diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile index 81ef3e67acc9..e0b5065478be 100644 --- a/drivers/misc/Makefile +++ b/drivers/misc/Makefile @@ -61,6 +61,7 @@ lkdtm-$(CONFIG_LKDTM) += lkdtm_heap.o lkdtm-$(CONFIG_LKDTM) += lkdtm_perms.o lkdtm-$(CONFIG_LKDTM) += lkdtm_rodata_objcopy.o lkdtm-$(CONFIG_LKDTM) += lkdtm_usercopy.o +lkdtm-$(CONFIG_LKDTM) += lkdtm_xpfo.o KCOV_INSTRUMENT_lkdtm_rodata.o := n diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h index 3b4976396ec4..ed9c3131bf41 100644 --- a/drivers/misc/lkdtm.h +++ b/drivers/misc/lkdtm.h @@ -64,4 +64,7 @@ void lkdtm_USERCOPY_STACK_FRAME_FROM(void); void lkdtm_USERCOPY_STACK_BEYOND(void); void lkdtm_USERCOPY_KERNEL(void); +/* lkdtm_xpfo.c */ +void lkdtm_XPFO_READ_USER(void); + #endif diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index 42d2b8e31e6b..4f3b60bb2d31 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -235,6 +235,7 @@ struct crashtype crashtypes[] = { CRASHTYPE(USERCOPY_STACK_FRAME_FROM), CRASHTYPE(USERCOPY_STACK_BEYOND), CRASHTYPE(USERCOPY_KERNEL), + CRASHTYPE(XPFO_READ_USER), }; diff --git a/drivers/misc/lkdtm_xpfo.c b/drivers/misc/lkdtm_xpfo.c new file mode 100644 index 000000000000..540a2539a88b --- /dev/null +++ b/drivers/misc/lkdtm_xpfo.c @@ -0,0 +1,105 @@ +/* + * This is for all the tests related to XPFO (eXclusive Page Frame Ownership). + */ + +#include "lkdtm.h" + +#include +#include + +/* This is hacky... */ +#ifdef CONFIG_ARM64 +#define pud_large(pud) (pud_sect(pud)) +#define pmd_large(pmd) (pmd_sect(pmd)) +#define PUD_PAGE_MASK PUD_MASK +#define PMD_PAGE_MASK PMD_MASK +#endif + +static phys_addr_t user_virt_to_phys(unsigned long addr) +{ + phys_addr_t phys_addr; + unsigned long offset; + pgd_t *pgd; + pud_t *pud; + pmd_t *pmd; + pte_t *pte; + p4d_t *p4d; + + pgd = pgd_offset(current->mm, addr); + if (pgd_none(*pgd)) + return 0; + + p4d = p4d_offset(pgd, addr); + if (p4d_none(*p4d)) + return 0; + + pud = pud_offset(p4d, addr); + if (pud_none(*pud)) + return 0; + + if (pud_large(*pud) || !pud_present(*pud)) { + phys_addr = (unsigned long)pud_pfn(*pud) << PAGE_SHIFT; + offset = addr & ~PUD_PAGE_MASK; + goto out; + } + + pmd = pmd_offset(pud, addr); + if (pmd_none(*pmd)) + return 0; + + if (pmd_large(*pmd) || !pmd_present(*pmd)) { + phys_addr = (unsigned long)pmd_pfn(*pmd) << PAGE_SHIFT; + offset = addr & ~PMD_PAGE_MASK; + goto out; + } + + pte = pte_offset_kernel(pmd, addr); + phys_addr = (phys_addr_t)pte_pfn(*pte) << PAGE_SHIFT; + offset = addr & ~PAGE_MASK; + +out: + return (phys_addr_t)(phys_addr | offset); +} + +/* Read from userspace via the kernel's linear map */ +void lkdtm_XPFO_READ_USER(void) +{ + unsigned long user_addr, user_data = 0xdeadbeef; + phys_addr_t phys_addr; + void *virt_addr; + + user_addr = vm_mmap(NULL, 0, PAGE_SIZE, + PROT_READ | PROT_WRITE | PROT_EXEC, + MAP_ANONYMOUS | MAP_PRIVATE, 0); + if (user_addr >= TASK_SIZE) { + pr_warn("Failed to allocate user memory\n"); + return; + } + + if (copy_to_user((void __user *)user_addr, &user_data, + sizeof(user_data))) { + pr_warn("copy_to_user failed\n"); + goto free_user; + } + + phys_addr = user_virt_to_phys(user_addr); + if (!phys_addr) { + pr_warn("Failed to get physical address of user memory\n"); + goto free_user; + } + + virt_addr = phys_to_virt(phys_addr); + if (phys_addr != virt_to_phys(virt_addr)) { + pr_warn("Physical address of user memory seems incorrect\n"); + goto free_user; + } + + pr_info("Attempting bad read from kernel address %p\n", virt_addr); + if (*(unsigned long *)virt_addr == user_data) + pr_info("Huh? Bad read succeeded?!\n"); + else + pr_info("Huh? Bad read didn't fail but data is incorrect?!\n"); + + free_user: + vm_munmap(user_addr, PAGE_SIZE); +}