2012-03-05 11:49:32 +00:00
|
|
|
/*
|
|
|
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
|
|
|
*
|
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
|
|
|
* published by the Free Software Foundation.
|
|
|
|
|
*
|
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
|
*
|
|
|
|
|
* You should have received a copy of the GNU General Public License
|
|
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
#include <linux/linkage.h>
|
2015-07-22 18:05:54 +00:00
|
|
|
|
2015-09-23 18:55:39 +00:00
|
|
|
#include <asm/cache.h>
|
2016-12-26 09:10:19 +00:00
|
|
|
#include <asm/asm-uaccess.h>
|
2012-03-05 11:49:32 +00:00
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Copy to user space from a kernel buffer (alignment handled by the hardware)
|
|
|
|
|
*
|
|
|
|
|
* Parameters:
|
|
|
|
|
* x0 - to
|
|
|
|
|
* x1 - from
|
|
|
|
|
* x2 - n
|
|
|
|
|
* Returns:
|
|
|
|
|
* x0 - bytes not copied
|
|
|
|
|
*/
|
2015-09-23 18:55:39 +00:00
|
|
|
.macro ldrb1 ptr, regB, val
|
|
|
|
|
ldrb \ptr, [\regB], \val
|
|
|
|
|
.endm
|
|
|
|
|
|
|
|
|
|
.macro strb1 ptr, regB, val
|
2016-02-05 14:58:48 +00:00
|
|
|
uao_user_alternative 9998f, strb, sttrb, \ptr, \regB, \val
|
2015-09-23 18:55:39 +00:00
|
|
|
.endm
|
|
|
|
|
|
|
|
|
|
.macro ldrh1 ptr, regB, val
|
|
|
|
|
ldrh \ptr, [\regB], \val
|
|
|
|
|
.endm
|
|
|
|
|
|
|
|
|
|
.macro strh1 ptr, regB, val
|
2016-02-05 14:58:48 +00:00
|
|
|
uao_user_alternative 9998f, strh, sttrh, \ptr, \regB, \val
|
2015-09-23 18:55:39 +00:00
|
|
|
.endm
|
|
|
|
|
|
|
|
|
|
.macro ldr1 ptr, regB, val
|
|
|
|
|
ldr \ptr, [\regB], \val
|
|
|
|
|
.endm
|
|
|
|
|
|
|
|
|
|
.macro str1 ptr, regB, val
|
2016-02-05 14:58:48 +00:00
|
|
|
uao_user_alternative 9998f, str, sttr, \ptr, \regB, \val
|
2015-09-23 18:55:39 +00:00
|
|
|
.endm
|
|
|
|
|
|
|
|
|
|
.macro ldp1 ptr, regB, regC, val
|
|
|
|
|
ldp \ptr, \regB, [\regC], \val
|
|
|
|
|
.endm
|
|
|
|
|
|
|
|
|
|
.macro stp1 ptr, regB, regC, val
|
2016-02-05 14:58:48 +00:00
|
|
|
uao_stp 9998f, \ptr, \regB, \regC, \val
|
2015-09-23 18:55:39 +00:00
|
|
|
.endm
|
|
|
|
|
|
|
|
|
|
end .req x5
|
2016-06-08 21:40:56 +00:00
|
|
|
ENTRY(__arch_copy_to_user)
|
2017-08-10 12:58:16 +00:00
|
|
|
uaccess_enable_not_uao x3, x4, x5
|
2015-09-23 18:55:39 +00:00
|
|
|
add end, x0, x2
|
|
|
|
|
#include "copy_template.S"
|
2018-01-10 13:18:30 +00:00
|
|
|
uaccess_disable_not_uao x3, x4
|
2015-09-23 18:55:39 +00:00
|
|
|
mov x0, #0
|
2012-03-05 11:49:32 +00:00
|
|
|
ret
|
2016-06-08 21:40:56 +00:00
|
|
|
ENDPROC(__arch_copy_to_user)
|
2012-03-05 11:49:32 +00:00
|
|
|
|
|
|
|
|
.section .fixup,"ax"
|
|
|
|
|
.align 2
|
2015-09-23 18:55:39 +00:00
|
|
|
9998: sub x0, end, dst // bytes not copied
|
arm64: uaccess: Ensure PAN is re-enabled after unhandled uaccess fault
commit 94bb804e1e6f0a9a77acf20d7c70ea141c6c821e upstream.
A number of our uaccess routines ('__arch_clear_user()' and
'__arch_copy_{in,from,to}_user()') fail to re-enable PAN if they
encounter an unhandled fault whilst accessing userspace.
For CPUs implementing both hardware PAN and UAO, this bug has no effect
when both extensions are in use by the kernel.
For CPUs implementing hardware PAN but not UAO, this means that a kernel
using hardware PAN may execute portions of code with PAN inadvertently
disabled, opening us up to potential security vulnerabilities that rely
on userspace access from within the kernel which would usually be
prevented by this mechanism. In other words, parts of the kernel run the
same way as they would on a CPU without PAN implemented/emulated at all.
For CPUs not implementing hardware PAN and instead relying on software
emulation via 'CONFIG_ARM64_SW_TTBR0_PAN=y', the impact is unfortunately
much worse. Calling 'schedule()' with software PAN disabled means that
the next task will execute in the kernel using the page-table and ASID
of the previous process even after 'switch_mm()', since the actual
hardware switch is deferred until return to userspace. At this point, or
if there is a intermediate call to 'uaccess_enable()', the page-table
and ASID of the new process are installed. Sadly, due to the changes
introduced by KPTI, this is not an atomic operation and there is a very
small window (two instructions) where the CPU is configured with the
page-table of the old task and the ASID of the new task; a speculative
access in this state is disastrous because it would corrupt the TLB
entries for the new task with mappings from the previous address space.
As Pavel explains:
| I was able to reproduce memory corruption problem on Broadcom's SoC
| ARMv8-A like this:
|
| Enable software perf-events with PERF_SAMPLE_CALLCHAIN so userland's
| stack is accessed and copied.
|
| The test program performed the following on every CPU and forking
| many processes:
|
| unsigned long *map = mmap(NULL, PAGE_SIZE, PROT_READ|PROT_WRITE,
| MAP_SHARED | MAP_ANONYMOUS, -1, 0);
| map[0] = getpid();
| sched_yield();
| if (map[0] != getpid()) {
| fprintf(stderr, "Corruption detected!");
| }
| munmap(map, PAGE_SIZE);
|
| From time to time I was getting map[0] to contain pid for a
| different process.
Ensure that PAN is re-enabled when returning after an unhandled user
fault from our uaccess routines.
Cc: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
Fixes: 338d4f49d6f7 ("arm64: kernel: Add support for Privileged Access Never")
Signed-off-by: Pavel Tatashin <pasha.tatashin@soleen.com>
[will: rewrote commit message]
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-19 22:10:06 +00:00
|
|
|
uaccess_disable_not_uao x3, x4
|
2012-03-05 11:49:32 +00:00
|
|
|
ret
|
|
|
|
|
.previous
|