Commit bf29ed15 authored Sep 07, 2017 by Thomas Garnier Committed by Thomas Gleixner Sep 17, 2017

syscalls: Use CHECK_DATA_CORRUPTION for addr_limit_user_check



Use CHECK_DATA_CORRUPTION instead of BUG_ON to provide more flexibility
on address limit failures. By default, send a SIGKILL signal to kill the
current process preventing exploitation of a bad address limit.

Make the TIF_FSCHECK flag optional so ARM can use this function.

Signed-off-by: Thomas Garnier <thgarnie@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Pratyush Anand <panand@redhat.com>
Cc: Dave Martin <Dave.Martin@arm.com>
Cc: Will Drewry <wad@chromium.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: David Howells <dhowells@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-api@vger.kernel.org
Cc: Yonghong Song <yhs@fb.com>
Cc: linux-arm-kernel@lists.infradead.org
Link: http://lkml.kernel.org/r/1504798247-48833-2-git-send-email-keescook@chromium.org

parent 0666f560

include/linux/syscalls.h

+8 −4

Original line number	Diff line number	Diff line
		@@ -221,21 +221,25 @@ static inline int is_syscall_trace_event(struct trace_event_call *tp_event)
		} \
		static inline long SYSC##name(__MAP(x,__SC_DECL,__VA_ARGS__))

		#ifdef TIF_FSCHECK
		/*
		* Called before coming back to user-mode. Returning to user-mode with an
		* address limit different than USER_DS can allow to overwrite kernel memory.
		*/
		static inline void addr_limit_user_check(void)
		{

		#ifdef TIF_FSCHECK
		if (!test_thread_flag(TIF_FSCHECK))
		return;
		#endif

		BUG_ON(!segment_eq(get_fs(), USER_DS));
		if (CHECK_DATA_CORRUPTION(!segment_eq(get_fs(), USER_DS),
		"Invalid address limit on user-mode return"))
		force_sig(SIGKILL, current);

		#ifdef TIF_FSCHECK
		clear_thread_flag(TIF_FSCHECK);
		}
		#endif
		}

		asmlinkage long sys32_quotactl(unsigned int cmd, const char __user *special,
		qid_t id, void __user *addr);