diff options
| author | Kees Cook <keescook@chromium.org> | 2019-04-06 18:52:11 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-06-25 06:34:47 +0300 |
| commit | 3656dca39b5367ceb51bfd0fa448d9bfc7012972 (patch) | |
| tree | 43fdbce45f517d6d0b153c22afd0178da9b144f6 /drivers/misc | |
| parent | 226fe899656a6dddf35a336ac4df67d2224fdf91 (diff) | |
| download | linux-3656dca39b5367ceb51bfd0fa448d9bfc7012972.tar.xz | |
lkdtm/usercopy: Moves the KERNEL_DS test to non-canonical
[ Upstream commit 2bf8496f6e9b7e9a557f65eb95eab16fea7958c7 ]
The prior implementation of the KERNEL_DS fault checking would work on
any unmapped kernel address, but this was narrowed to the non-canonical
range instead. This adjusts the LKDTM test to match.
Fixes: 00c42373d397 ("x86-64: add warning for non-canonical user access address dereferences")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'drivers/misc')
| -rw-r--r-- | drivers/misc/lkdtm/usercopy.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c index d5a0e7f1813b..e172719dd86d 100644 --- a/drivers/misc/lkdtm/usercopy.c +++ b/drivers/misc/lkdtm/usercopy.c @@ -324,14 +324,16 @@ free_user: void lkdtm_USERCOPY_KERNEL_DS(void) { - char __user *user_ptr = (char __user *)ERR_PTR(-EINVAL); + char __user *user_ptr = + (char __user *)(0xFUL << (sizeof(unsigned long) * 8 - 4)); mm_segment_t old_fs = get_fs(); char buf[10] = {0}; - pr_info("attempting copy_to_user on unmapped kernel address\n"); + pr_info("attempting copy_to_user() to noncanonical address: %px\n", + user_ptr); set_fs(KERNEL_DS); - if (copy_to_user(user_ptr, buf, sizeof(buf))) - pr_info("copy_to_user un unmapped kernel address failed\n"); + if (copy_to_user(user_ptr, buf, sizeof(buf)) == 0) + pr_err("copy_to_user() to noncanonical address succeeded!?\n"); set_fs(old_fs); } |