Changbin Du
2c4f1fcbef
kprobe: Do not use uaccess functions to access kernel memory that can fault
The userspace can ask kprobe to intercept strings at any memory address,
including invalid kernel address. In this case, fetch_store_strlen()
would crash since it uses general usercopy function, and user access
functions are no longer allowed to access kernel memory.
For example, we can crash the kernel by doing something as below:
$ sudo kprobe 'p:do_sys_open +0(+0(%si)):string'
[ 103.620391] BUG: GPF in non-whitelisted uaccess (non-canonical address?)
[ 103.622104] general protection fault: 0000 [#1] SMP PTI
[ 103.623424] CPU: 10 PID: 1046 Comm: cat Not tainted 5.0.0-rc3-00130-gd73aba1-dirty #96
[ 103.625321] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-2-g628b2e6-dirty-20190104_103505-linux 04/01/2014
[ 103.628284] RIP: 0010:process_fetch_insn+0x1ab/0x4b0
[ 103.629518] Code: 10 83 80 28 2e 00 00 01 31 d2 31 ff 48 8b 74 24 28 eb 0c 81 fa ff 0f 00 00 7f 1c 85 c0 75 18 66 66 90 0f ae e8 48 63
ca 89 f8 <8a> 0c 31 66 66 90 83 c2 01 84 c9 75 dc 89 54 24 34 89 44 24 28 48
[ 103.634032] RSP: 0018:ffff88845eb37ce0 EFLAGS: 00010246
[ 103.635312] RAX: 0000000000000000 RBX: ffff888456c4e5a8 RCX: 0000000000000000
[ 103.637057] RDX: 0000000000000000 RSI: 2e646c2f6374652f RDI: 0000000000000000
[ 103.638795] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
[ 103.640556] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
[ 103.642297] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
[ 103.644040] FS: 0000000000000000(0000) GS:ffff88846f000000(0000) knlGS:0000000000000000
[ 103.646019] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 103.647436] CR2: 00007ffc79758038 CR3: 0000000463360006 CR4: 0000000000020ee0
[ 103.649147] Call Trace:
[ 103.649781] ? sched_clock_cpu+0xc/0xa0
[ 103.650747] ? do_sys_open+0x5/0x220
[ 103.651635] kprobe_trace_func+0x303/0x380
[ 103.652645] ? do_sys_open+0x5/0x220
[ 103.653528] kprobe_dispatcher+0x45/0x50
[ 103.654682] ? do_sys_open+0x1/0x220
[ 103.655875] kprobe_ftrace_handler+0x90/0xf0
[ 103.657282] ftrace_ops_assist_func+0x54/0xf0
[ 103.658564] ? __call_rcu+0x1dc/0x280
[ 103.659482] 0xffffffffc00000bf
[ 103.660384] ? __ia32_sys_open+0x20/0x20
[ 103.661682] ? do_sys_open+0x1/0x220
[ 103.662863] do_sys_open+0x5/0x220
[ 103.663988] do_syscall_64+0x60/0x210
[ 103.665201] entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 103.666862] RIP: 0033:0x7fc22fadccdd
[ 103.668034] Code: 48 89 54 24 e0 41 83 e2 40 75 32 89 f0 25 00 00 41 00 3d 00 00 41 00 74 24 89 f2 b8 01 01 00 00 48 89 fe bf 9c ff ff
ff 0f 05 <48> 3d 00 f0 ff ff 77 33 f3 c3 66 0f 1f 84 00 00 00 00 00 48 8d 44
[ 103.674029] RSP: 002b:00007ffc7972c3a8 EFLAGS: 00000287 ORIG_RAX: 0000000000000101
[ 103.676512] RAX: ffffffffffffffda RBX: 0000562f86147a21 RCX: 00007fc22fadccdd
[ 103.678853] RDX: 0000000000080000 RSI: 00007fc22fae1428 RDI: 00000000ffffff9c
[ 103.681151] RBP: ffffffffffffffff R08: 0000000000000000 R09: 0000000000000000
[ 103.683489] R10: 0000000000000000 R11: 0000000000000287 R12: 00007fc22fce90a8
[ 103.685774] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
[ 103.688056] Modules linked in:
[ 103.689131] ---[ end trace 43792035c28984a1 ]---
This can be fixed by using probe_mem_read() instead, as it can handle faulting
kernel memory addresses, which kprobes can legitimately do.
Link: http://lkml.kernel.org/r/20190125151051.7381-1-changbin.du@gmail.com
Cc: stable@vger.kernel.org
Fixes: 9da3f2b740 ("x86/fault: BUG() when uaccess helpers fault on kernel addresses")
Signed-off-by: Changbin Du <changbin.du@gmail.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
|
2019-02-15 12:41:23 -05:00 |
| .. |
|
bpf
|
Remove 'type' argument from access_ok() function
|
2019-01-03 18:57:57 -08:00 |
|
cgroup
|
Merge branch 'for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
|
2018-12-29 10:57:20 -08:00 |
|
configs
|
kvm_config: add CONFIG_VIRTIO_MENU
|
2018-10-24 20:55:56 -04:00 |
|
debug
|
kdb: use bool for binary state indicators
|
2018-12-30 08:31:52 +00:00 |
|
dma
|
dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING for remapped allocations
|
2019-01-05 08:28:29 +01:00 |
|
events
|
Remove 'type' argument from access_ok() function
|
2019-01-03 18:57:57 -08:00 |
|
gcov
|
|
|
|
irq
|
genirq/affinity: Add is_managed to struct irq_affinity_desc
|
2018-12-19 11:32:08 +01:00 |
|
livepatch
|
livepatch: Replace synchronize_sched() with synchronize_rcu()
|
2018-12-01 12:38:50 -08:00 |
|
locking
|
kernel/locking/mutex.c: remove caller signal_pending branch predictions
|
2019-01-04 13:13:48 -08:00 |
|
power
|
mm: convert totalram_pages and totalhigh_pages variables to atomic
|
2018-12-28 12:11:47 -08:00 |
|
printk
|
Remove 'type' argument from access_ok() function
|
2019-01-03 18:57:57 -08:00 |
|
rcu
|
rcutorture: Don't do busted forward-progress testing
|
2018-12-01 12:45:42 -08:00 |
|
sched
|
jump_label: move 'asm goto' support test to Kconfig
|
2019-01-06 09:46:51 +09:00 |
|
time
|
y2038: more syscalls and cleanups
|
2018-12-28 12:45:04 -08:00 |
|
trace
|
kprobe: Do not use uaccess functions to access kernel memory that can fault
|
2019-02-15 12:41:23 -05:00 |
|
.gitignore
|
|
|
|
acct.c
|
|
|
|
async.c
|
|
|
|
audit.c
|
audit: remove duplicated include from audit.c
|
2018-12-14 12:09:30 -05:00 |
|
audit.h
|
audit: use current whenever possible
|
2018-11-26 18:41:21 -05:00 |
|
audit_fsnotify.c
|
audit: minimize our use of audit_log_format()
|
2018-11-26 18:40:00 -05:00 |
|
audit_tree.c
|
audit: minimize our use of audit_log_format()
|
2018-11-26 18:40:00 -05:00 |
|
audit_watch.c
|
audit: minimize our use of audit_log_format()
|
2018-11-26 18:40:00 -05:00 |
|
auditfilter.c
|
|
|
|
auditsc.c
|
audit: use current whenever possible
|
2018-11-26 18:41:21 -05:00 |
|
backtracetest.c
|
|
|
|
bounds.c
|
kbuild: fix kernel/bounds.c 'W=1' warning
|
2018-10-31 08:54:14 -07:00 |
|
capability.c
|
|
|
|
compat.c
|
make 'user_access_begin()' do 'access_ok()'
|
2019-01-04 12:56:09 -08:00 |
|
configs.c
|
|
|
|
context_tracking.c
|
|
|
|
cpu.c
|
x86/speculation: Rework SMT state change
|
2018-11-28 11:57:07 +01:00 |
|
cpu_pm.c
|
|
|
|
crash_core.c
|
kernel/crash_core.c: print timestamp using time64_t
|
2018-08-22 10:52:47 -07:00 |
|
crash_dump.c
|
|
|
|
cred.c
|
cred: export get_task_cred().
|
2018-12-19 13:52:44 -05:00 |
|
delayacct.c
|
delayacct: track delays from thrashing cache pages
|
2018-10-26 16:26:32 -07:00 |
|
dma.c
|
|
|
|
elfcore.c
|
|
|
|
exec_domain.c
|
|
|
|
exit.c
|
make 'user_access_begin()' do 'access_ok()'
|
2019-01-04 12:56:09 -08:00 |
|
extable.c
|
|
|
|
fail_function.c
|
kernel/fail_function.c: remove meaningless null pointer check before debugfs_remove_recursive
|
2018-10-31 08:54:12 -07:00 |
|
fork.c
|
fork: fix some -Wmissing-prototypes warnings
|
2019-01-04 13:13:47 -08:00 |
|
freezer.c
|
PM / reboot: Eliminate race between reboot and suspend
|
2018-08-06 12:35:20 +02:00 |
|
futex.c
|
Remove 'type' argument from access_ok() function
|
2019-01-03 18:57:57 -08:00 |
|
groups.c
|
|
|
|
hung_task.c
|
kernel/hung_task.c: break RCU locks based on jiffies
|
2019-01-04 13:13:45 -08:00 |
|
iomem.c
|
|
|
|
irq_work.c
|
|
|
|
jump_label.c
|
jump_label: move 'asm goto' support test to Kconfig
|
2019-01-06 09:46:51 +09:00 |
|
kallsyms.c
|
kallsyms: reduce size a little on 64-bit
|
2018-09-10 22:54:33 +09:00 |
|
kcmp.c
|
|
|
|
Kconfig.freezer
|
|
|
|
Kconfig.hz
|
|
|
|
Kconfig.locks
|
|
|
|
Kconfig.preempt
|
kconfig: warn no new line at end of file
|
2018-12-15 17:44:35 +09:00 |
|
kcov.c
|
kernel/kcov.c: mark write_comp_data() as notrace
|
2019-01-04 13:13:47 -08:00 |
|
kexec.c
|
kexec: add call to LSM hook in original kexec_load syscall
|
2018-07-16 12:31:57 -07:00 |
|
kexec_core.c
|
mm: convert totalram_pages and totalhigh_pages variables to atomic
|
2018-12-28 12:11:47 -08:00 |
|
kexec_file.c
|
kexec_file: kexec_walk_memblock() only walks a dedicated region at kdump
|
2018-12-06 14:38:50 +00:00 |
|
kexec_internal.h
|
|
|
|
kmod.c
|
|
|
|
kprobes.c
|
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
|
2018-12-26 14:45:18 -08:00 |
|
ksysfs.c
|
|
|
|
kthread.c
|
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
|
2018-08-13 11:25:07 -07:00 |
|
latencytop.c
|
|
|
|
Makefile
|
kbuild: change filechk to surround the given command with { }
|
2019-01-06 09:46:51 +09:00 |
|
memremap.c
|
mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm
|
2018-12-28 12:11:52 -08:00 |
|
module-internal.h
|
|
|
|
module.c
|
jump_label: move 'asm goto' support test to Kconfig
|
2019-01-06 09:46:51 +09:00 |
|
module_signing.c
|
modsign: use all trusted keys to verify module signature
|
2018-11-07 14:41:41 +01:00 |
|
notifier.c
|
|
|
|
nsproxy.c
|
|
|
|
padata.c
|
padata: clean an indentation issue, remove extraneous space
|
2018-11-16 14:11:04 +08:00 |
|
panic.c
|
kernel/sysctl: add panic_print into sysctl
|
2019-01-04 13:13:47 -08:00 |
|
params.c
|
|
|
|
pid.c
|
Fix failure path in alloc_pid()
|
2018-12-28 12:42:30 -08:00 |
|
pid_namespace.c
|
signal: Use group_send_sig_info to kill all processes in a pid namespace
|
2018-09-16 16:08:25 +02:00 |
|
profile.c
|
mm: remove include/linux/bootmem.h
|
2018-10-31 08:54:16 -07:00 |
|
ptrace.c
|
Remove 'type' argument from access_ok() function
|
2019-01-03 18:57:57 -08:00 |
|
range.c
|
|
|
|
reboot.c
|
kernel/reboot.c: export pm_power_off_prepare
|
2018-09-11 16:13:24 +01:00 |
|
relay.c
|
|
|
|
resource.c
|
kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable
|
2018-12-28 12:11:49 -08:00 |
|
rseq.c
|
Remove 'type' argument from access_ok() function
|
2019-01-03 18:57:57 -08:00 |
|
seccomp.c
|
seccomp: fix poor type promotion
|
2018-12-13 16:49:01 -08:00 |
|
signal.c
|
Remove 'type' argument from access_ok() function
|
2019-01-03 18:57:57 -08:00 |
|
smp.c
|
smp,cpumask: introduce on_each_cpu_cond_mask
|
2018-10-09 16:51:11 +02:00 |
|
smpboot.c
|
|
|
|
smpboot.h
|
|
|
|
softirq.c
|
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
|
2018-10-25 11:43:47 -07:00 |
|
stackleak.c
|
stackleak: Mark stackleak_track_stack() as notrace
|
2018-12-05 19:31:44 -08:00 |
|
stacktrace.c
|
|
|
|
stop_machine.c
|
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
|
2018-08-13 11:25:07 -07:00 |
|
sys.c
|
Remove 'type' argument from access_ok() function
|
2019-01-03 18:57:57 -08:00 |
|
sys_ni.c
|
y2038: socket: Add compat_sys_recvmmsg_time64
|
2018-12-18 16:13:04 +01:00 |
|
sysctl.c
|
kernel/sysctl: add panic_print into sysctl
|
2019-01-04 13:13:47 -08:00 |
|
sysctl_binary.c
|
kernel/sysctl: add panic_print into sysctl
|
2019-01-04 13:13:47 -08:00 |
|
task_work.c
|
|
|
|
taskstats.c
|
|
|
|
test_kprobes.c
|
|
|
|
torture.c
|
torture: Remove unnecessary "ret" variables
|
2018-12-01 12:45:35 -08:00 |
|
tracepoint.c
|
tracing: Replace synchronize_sched() and call_rcu_sched()
|
2018-11-27 09:21:41 -08:00 |
|
tsacct.c
|
|
|
|
ucount.c
|
|
|
|
uid16.c
|
|
|
|
uid16.h
|
|
|
|
umh.c
|
umh: Add command line to user mode helpers
|
2018-10-22 19:37:36 -07:00 |
|
up.c
|
smp,cpumask: introduce on_each_cpu_cond_mask
|
2018-10-09 16:51:11 +02:00 |
|
user-return-notifier.c
|
|
|
|
user.c
|
userns: use irqsave variant of refcount_dec_and_lock()
|
2018-08-22 10:52:47 -07:00 |
|
user_namespace.c
|
userns: also map extents in the reverse map to kernel IDs
|
2018-11-07 23:51:16 -06:00 |
|
utsname.c
|
|
|
|
utsname_sysctl.c
|
sys: don't hold uts_sem while accessing userspace memory
|
2018-08-11 02:05:53 -05:00 |
|
watchdog.c
|
watchdog: Mark watchdog touch functions as notrace
|
2018-08-30 12:56:40 +02:00 |
|
watchdog_hld.c
|
watchdog: Mark watchdog touch functions as notrace
|
2018-08-30 12:56:40 +02:00 |
|
workqueue.c
|
workqueue: Replace call_rcu_sched() with call_rcu()
|
2018-11-27 09:21:44 -08:00 |
|
workqueue_internal.h
|
|
|