From patchwork Wed Aug 9 20:07:55 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tycho Andersen X-Patchwork-Id: 9891905 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 331AC60363 for ; Wed, 9 Aug 2017 20:11:29 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 25CFD289E2 for ; Wed, 9 Aug 2017 20:11:29 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1A37F28A9A; Wed, 9 Aug 2017 20:11:29 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 28DB1289E2 for ; Wed, 9 Aug 2017 20:11:27 +0000 (UTC) Received: (qmail 3108 invoked by uid 550); 9 Aug 2017 20:09:33 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 32499 invoked from network); 9 Aug 2017 20:09:18 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=docker.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=2f5Gx6/LFRPN5lR7hTOP3vc45oV/Am6nsrm+ow+YxWQ=; b=SEeCRPDJGwDv+oCjXm9wxmrZi0rURx8oY2MWc9uVTIDSWpjC4KJQhYVLPTri+D+Q92 PQXGLKBVr4rWmoRTgStxHyaGF8vv1U5GM1ebvkA/nKvzDq7Wss9UlERVUbSkDeF+OdIW t++Ao4R7qg0lm/N6rDadAKDF5q1428FEurVoc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=2f5Gx6/LFRPN5lR7hTOP3vc45oV/Am6nsrm+ow+YxWQ=; b=AzebnighyAsRZLc0Re2uyqRROviNT25kWU12A4Pp3PwGkyZsQ4rj9OaM9b63KMr+dk ME3hhiOYcTs14pyrtE81tbdAIQ1hiBcI5eO9uvs/y9kSkZYa2Yx5MrEdwPvxK+hHXz5M nPYfbyjlqZbYvq1gIkXRdxV6KIPKE3vndEVTOf3Zn0qdbjI4diX4Ib5Ib8vEBwMvkYJX ET7nQ8O4D5j40GT65KYt71mCEnkwk0R2rjBVOK12mdVazn6g6+BLr4+605aYqBmjjfws tRJZ6mWPETLOddz4c6n5fh7CsfdVwrNqImH0eiouVV1xJ5BXBkDXt7RqUMIpnYgzPAIy Y/yg== X-Gm-Message-State: AIVw110eQJQioA5mvU5ag5CT/g63k1QZNO9HXx5657y4Bcz+PfAwJ6nl BzriIfaVUe+t5dmO X-Received: by 10.107.15.149 with SMTP id 21mr7080424iop.53.1502309347146; Wed, 09 Aug 2017 13:09:07 -0700 (PDT) From: Tycho Andersen To: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org, kernel-hardening@lists.openwall.com, Marco Benatto , Juerg Haefliger , Juerg Haefliger , Tycho Andersen Date: Wed, 9 Aug 2017 14:07:55 -0600 Message-Id: <20170809200755.11234-11-tycho@docker.com> X-Mailer: git-send-email 2.11.0 In-Reply-To: <20170809200755.11234-1-tycho@docker.com> References: <20170809200755.11234-1-tycho@docker.com> Subject: [kernel-hardening] [PATCH v5 10/10] lkdtm: Add test for XPFO X-Virus-Scanned: ClamAV using ClamSMTP From: Juerg Haefliger This test simply reads from userspace memory via the kernel's linear map. hugepages is only supported on x86 right now, hence the ifdef. Signed-off-by: Juerg Haefliger Signed-off-by: Tycho Andersen Tested-by: Marco Benatto --- drivers/misc/Makefile | 1 + drivers/misc/lkdtm.h | 4 +++ drivers/misc/lkdtm_core.c | 4 +++ drivers/misc/lkdtm_xpfo.c | 62 +++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 71 insertions(+) diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile index b0b766416306..8447b42a447d 100644 --- a/drivers/misc/Makefile +++ b/drivers/misc/Makefile @@ -62,6 +62,7 @@ lkdtm-$(CONFIG_LKDTM) += lkdtm_heap.o lkdtm-$(CONFIG_LKDTM) += lkdtm_perms.o lkdtm-$(CONFIG_LKDTM) += lkdtm_rodata_objcopy.o lkdtm-$(CONFIG_LKDTM) += lkdtm_usercopy.o +lkdtm-$(CONFIG_LKDTM) += lkdtm_xpfo.o KCOV_INSTRUMENT_lkdtm_rodata.o := n diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h index 3b4976396ec4..fc53546113c1 100644 --- a/drivers/misc/lkdtm.h +++ b/drivers/misc/lkdtm.h @@ -64,4 +64,8 @@ void lkdtm_USERCOPY_STACK_FRAME_FROM(void); void lkdtm_USERCOPY_STACK_BEYOND(void); void lkdtm_USERCOPY_KERNEL(void); +/* lkdtm_xpfo.c */ +void lkdtm_XPFO_READ_USER(void); +void lkdtm_XPFO_READ_USER_HUGE(void); + #endif diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c index 42d2b8e31e6b..9431f80886bc 100644 --- a/drivers/misc/lkdtm_core.c +++ b/drivers/misc/lkdtm_core.c @@ -235,6 +235,10 @@ struct crashtype crashtypes[] = { CRASHTYPE(USERCOPY_STACK_FRAME_FROM), CRASHTYPE(USERCOPY_STACK_BEYOND), CRASHTYPE(USERCOPY_KERNEL), + CRASHTYPE(XPFO_READ_USER), +#ifdef CONFIG_X86 + CRASHTYPE(XPFO_READ_USER_HUGE), +#endif }; diff --git a/drivers/misc/lkdtm_xpfo.c b/drivers/misc/lkdtm_xpfo.c new file mode 100644 index 000000000000..c72509128eb3 --- /dev/null +++ b/drivers/misc/lkdtm_xpfo.c @@ -0,0 +1,62 @@ +/* + * This is for all the tests related to XPFO (eXclusive Page Frame Ownership). + */ + +#include "lkdtm.h" + +#include +#include +#include + +void read_user_with_flags(unsigned long flags) +{ + unsigned long user_addr, user_data = 0xdeadbeef; + phys_addr_t phys_addr; + void *virt_addr; + + user_addr = vm_mmap(NULL, 0, PAGE_SIZE, + PROT_READ | PROT_WRITE | PROT_EXEC, + flags, 0); + if (user_addr >= TASK_SIZE) { + pr_warn("Failed to allocate user memory\n"); + return; + } + + if (copy_to_user((void __user *)user_addr, &user_data, + sizeof(user_data))) { + pr_warn("copy_to_user failed\n"); + goto free_user; + } + + phys_addr = user_virt_to_phys(user_addr); + if (!phys_addr) { + pr_warn("Failed to get physical address of user memory\n"); + goto free_user; + } + + virt_addr = phys_to_virt(phys_addr); + if (phys_addr != virt_to_phys(virt_addr)) { + pr_warn("Physical address of user memory seems incorrect\n"); + goto free_user; + } + + pr_info("Attempting bad read from kernel address %p\n", virt_addr); + if (*(unsigned long *)virt_addr == user_data) + pr_info("Huh? Bad read succeeded?!\n"); + else + pr_info("Huh? Bad read didn't fail but data is incorrect?!\n"); + + free_user: + vm_munmap(user_addr, PAGE_SIZE); +} + +/* Read from userspace via the kernel's linear map. */ +void lkdtm_XPFO_READ_USER(void) +{ + read_user_with_flags(MAP_PRIVATE | MAP_ANONYMOUS); +} + +void lkdtm_XPFO_READ_USER_HUGE(void) +{ + read_user_with_flags(MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB); +}