path: root/mm/usercopy.c (plain)
blob: 705490baa7e46ff6d174b3fce94f22cc0d5933ba

1	/*
2	* This implements the various checks for CONFIG_HARDENED_USERCOPY*,
3	* which are designed to protect kernel memory from needless exposure
4	* and overwrite under many unintended conditions. This code is based
5	* on PAX_USERCOPY, which is:
6	*
7	* Copyright (C) 2001-2016 PaX Team, Bradley Spengler, Open Source
8	* Security Inc.
9	*
10	* This program is free software; you can redistribute it and/or modify
11	* it under the terms of the GNU General Public License version 2 as
12	* published by the Free Software Foundation.
13	*
14	*/
15	#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
16
17	#include <linux/mm.h>
18	#include <linux/slab.h>
19	#include <asm/sections.h>
20
21	enum {
22	BAD_STACK = -1,
23	NOT_STACK = 0,
24	GOOD_FRAME,
25	GOOD_STACK,
26	};
27
28	/*
29	* Checks if a given pointer and length is contained by the current
30	* stack frame (if possible).
31	*
32	* Returns:
33	* NOT_STACK: not at all on the stack
34	* GOOD_FRAME: fully within a valid stack frame
35	* GOOD_STACK: fully on the stack (when can't do frame-checking)
36	* BAD_STACK: error condition (invalid stack position or bad stack frame)
37	*/
38	static noinline int check_stack_object(const void *obj, unsigned long len)
39	{
40	const void * const stack = task_stack_page(current);
41	const void * const stackend = stack + THREAD_SIZE;
42	int ret;
43
44	/* Object is not on the stack at all. */
45	if (obj + len <= stack || stackend <= obj)
46	return NOT_STACK;
47
48	/*
49	* Reject: object partially overlaps the stack (passing the
50	* the check above means at least one end is within the stack,
51	* so if this check fails, the other end is outside the stack).
52	*/
53	if (obj < stack || stackend < obj + len)
54	return BAD_STACK;
55
56	/* Check if object is safely within a valid frame. */
57	ret = arch_within_stack_frames(stack, stackend, obj, len);
58	if (ret)
59	return ret;
60
61	return GOOD_STACK;
62	}
63
64	static void report_usercopy(unsigned long len, bool to_user, const char *type)
65	{
66	pr_emerg("kernel memory %s attempt detected %s '%s' (%lu bytes)\n",
67	to_user ? "exposure" : "overwrite",
68	to_user ? "from" : "to", type ? : "unknown", len);
69	/*
70	* For greater effect, it would be nice to do do_group_exit(),
71	* but BUG() actually hooks all the lock-breaking and per-arch
72	* Oops code, so that is used here instead.
73	*/
74	BUG();
75	}
76
77	/* Returns true if any portion of [ptr,ptr+n) over laps with [low,high). */
78	static bool overlaps(const void *ptr, unsigned long n, unsigned long low,
79	unsigned long high)
80	{
81	unsigned long check_low = (uintptr_t)ptr;
82	unsigned long check_high = check_low + n;
83
84	/* Does not overlap if entirely above or entirely below. */
85	if (check_low >= high || check_high <= low)
86	return false;
87
88	return true;
89	}
90
91	/* Is this address range in the kernel text area? */
92	static inline const char *check_kernel_text_object(const void *ptr,
93	unsigned long n)
94	{
95	unsigned long textlow = (unsigned long)_stext;
96	unsigned long texthigh = (unsigned long)_etext;
97	unsigned long textlow_linear, texthigh_linear;
98
99	if (overlaps(ptr, n, textlow, texthigh))
100	return "<kernel text>";
101
102	/*
103	* Some architectures have virtual memory mappings with a secondary
104	* mapping of the kernel text, i.e. there is more than one virtual
105	* kernel address that points to the kernel image. It is usually
106	* when there is a separate linear physical memory mapping, in that
107	* __pa() is not just the reverse of __va(). This can be detected
108	* and checked:
109	*/
110	textlow_linear = (unsigned long)__va(__pa(textlow));
111	/* No different mapping: we're done. */
112	if (textlow_linear == textlow)
113	return NULL;
114
115	/* Check the secondary mapping... */
116	texthigh_linear = (unsigned long)__va(__pa(texthigh));
117	if (overlaps(ptr, n, textlow_linear, texthigh_linear))
118	return "<linear kernel text>";
119
120	return NULL;
121	}
122
123	static inline const char *check_bogus_address(const void *ptr, unsigned long n)
124	{
125	/* Reject if object wraps past end of memory. */
126	if ((unsigned long)ptr + n < (unsigned long)ptr)
127	return "<wrapped address>";
128
129	/* Reject if NULL or ZERO-allocation. */
130	if (ZERO_OR_NULL_PTR(ptr))
131	return "<null>";
132
133	return NULL;
134	}
135
136	/* Checks for allocs that are marked in some way as spanning multiple pages. */
137	static inline const char *check_page_span(const void *ptr, unsigned long n,
138	struct page *page, bool to_user)
139	{
140	#ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN
141	const void *end = ptr + n - 1;
142	struct page *endpage;
143	bool is_reserved, is_cma;
144
145	/*
146	* Sometimes the kernel data regions are not marked Reserved (see
147	* check below). And sometimes [_sdata,_edata) does not cover
148	* rodata and/or bss, so check each range explicitly.
149	*/
150
151	/* Allow reads of kernel rodata region (if not marked as Reserved). */
152	if (ptr >= (const void *)__start_rodata &&
153	end <= (const void *)__end_rodata) {
154	if (!to_user)
155	return "<rodata>";
156	return NULL;
157	}
158
159	/* Allow kernel data region (if not marked as Reserved). */
160	if (ptr >= (const void *)_sdata && end <= (const void *)_edata)
161	return NULL;
162
163	/* Allow kernel bss region (if not marked as Reserved). */
164	if (ptr >= (const void *)__bss_start &&
165	end <= (const void *)__bss_stop)
166	return NULL;
167
168	/* Is the object wholly within one base page? */
169	if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) ==
170	((unsigned long)end & (unsigned long)PAGE_MASK)))
171	return NULL;
172
173	/* Allow if fully inside the same compound (__GFP_COMP) page. */
174	endpage = virt_to_head_page(end);
175	if (likely(endpage == page))
176	return NULL;
177
178	/*
179	* Reject if range is entirely either Reserved (i.e. special or
180	* device memory), or CMA. Otherwise, reject since the object spans
181	* several independently allocated pages.
182	*/
183	is_reserved = PageReserved(page);
184	is_cma = is_migrate_cma_page(page);
185	if (!is_reserved && !is_cma)
186	return "<spans multiple pages>";
187
188	for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) {
189	page = virt_to_head_page(ptr);
190	if (is_reserved && !PageReserved(page))
191	return "<spans Reserved and non-Reserved pages>";
192	if (is_cma && !is_migrate_cma_page(page))
193	return "<spans CMA and non-CMA pages>";
194	}
195	#endif
196
197	return NULL;
198	}
199
200	static inline const char *check_heap_object(const void *ptr, unsigned long n,
201	bool to_user)
202	{
203	struct page *page;
204
205	/*
206	* Some architectures (arm64) return true for virt_addr_valid() on
207	* vmalloced addresses. Work around this by checking for vmalloc
208	* first.
209	*
210	* We also need to check for module addresses explicitly since we
211	* may copy static data from modules to userspace
212	*/
213	if (is_vmalloc_or_module_addr(ptr))
214	return NULL;
215
216	if (!virt_addr_valid(ptr))
217	return NULL;
218
219	page = virt_to_head_page(ptr);
220
221	/* Check slab allocator for flags and size. */
222	if (PageSlab(page))
223	return __check_heap_object(ptr, n, page);
224
225	/* Verify object does not incorrectly span multiple pages. */
226	return check_page_span(ptr, n, page, to_user);
227	}
228
229	/*
230	* Validates that the given object is:
231	* - not bogus address
232	* - known-safe heap or stack object
233	* - not in kernel text
234	*/
235	void __check_object_size(const void *ptr, unsigned long n, bool to_user)
236	{
237	const char *err;
238
239	/* Skip all tests if size is zero. */
240	if (!n)
241	return;
242
243	/* Check for invalid addresses. */
244	err = check_bogus_address(ptr, n);
245	if (err)
246	goto report;
247
248	/* Check for bad heap object. */
249	err = check_heap_object(ptr, n, to_user);
250	if (err)
251	goto report;
252
253	/* Check for bad stack object. */
254	switch (check_stack_object(ptr, n)) {
255	case NOT_STACK:
256	/* Object is not touching the current process stack. */
257	break;
258	case GOOD_FRAME:
259	case GOOD_STACK:
260	/*
261	* Object is either in the correct frame (when it
262	* is possible to check) or just generally on the
263	* process stack (when frame checking not available).
264	*/
265	return;
266	default:
267	err = "<process stack>";
268	goto report;
269	}
270
271	/* Check for object in kernel to avoid text exposure. */
272	err = check_kernel_text_object(ptr, n);
273	if (!err)
274	return;
275
276	report:
277	report_usercopy(n, to_user, err);
278	}
279	EXPORT_SYMBOL(__check_object_size);
280