x86/extable: Introduce _ASM_EXTABLE_UA for uaccess fixups
Currently, most fixups for attempting to access userspace memory are handled using _ASM_EXTABLE, which is also used for various other types of fixups (e.g. safe MSR access, IRET failures, and a bunch of other things). In order to make it possible to add special safety checks to uaccess fixups (in particular, checking whether the fault address is actually in userspace), introduce a new exception table handler ex_handler_uaccess() and wire it up to all the user access fixups (excluding ones that already use _ASM_EXTABLE_EX). Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Tested-by: Kees Cook <keescook@chromium.org> Cc: Andy Lutomirski <luto@kernel.org> Cc: kernel-hardening@lists.openwall.com Cc: dvyukov@google.com Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com> Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Cc: Borislav Petkov <bp@alien8.de> Link: https://lkml.kernel.org/r/20180828201421.157735-5-jannh@google.com
此提交包含在:
@@ -92,26 +92,26 @@ ENTRY(copy_user_generic_unrolled)
|
||||
60: jmp copy_user_handle_tail /* ecx is zerorest also */
|
||||
.previous
|
||||
|
||||
_ASM_EXTABLE(1b,30b)
|
||||
_ASM_EXTABLE(2b,30b)
|
||||
_ASM_EXTABLE(3b,30b)
|
||||
_ASM_EXTABLE(4b,30b)
|
||||
_ASM_EXTABLE(5b,30b)
|
||||
_ASM_EXTABLE(6b,30b)
|
||||
_ASM_EXTABLE(7b,30b)
|
||||
_ASM_EXTABLE(8b,30b)
|
||||
_ASM_EXTABLE(9b,30b)
|
||||
_ASM_EXTABLE(10b,30b)
|
||||
_ASM_EXTABLE(11b,30b)
|
||||
_ASM_EXTABLE(12b,30b)
|
||||
_ASM_EXTABLE(13b,30b)
|
||||
_ASM_EXTABLE(14b,30b)
|
||||
_ASM_EXTABLE(15b,30b)
|
||||
_ASM_EXTABLE(16b,30b)
|
||||
_ASM_EXTABLE(18b,40b)
|
||||
_ASM_EXTABLE(19b,40b)
|
||||
_ASM_EXTABLE(21b,50b)
|
||||
_ASM_EXTABLE(22b,50b)
|
||||
_ASM_EXTABLE_UA(1b, 30b)
|
||||
_ASM_EXTABLE_UA(2b, 30b)
|
||||
_ASM_EXTABLE_UA(3b, 30b)
|
||||
_ASM_EXTABLE_UA(4b, 30b)
|
||||
_ASM_EXTABLE_UA(5b, 30b)
|
||||
_ASM_EXTABLE_UA(6b, 30b)
|
||||
_ASM_EXTABLE_UA(7b, 30b)
|
||||
_ASM_EXTABLE_UA(8b, 30b)
|
||||
_ASM_EXTABLE_UA(9b, 30b)
|
||||
_ASM_EXTABLE_UA(10b, 30b)
|
||||
_ASM_EXTABLE_UA(11b, 30b)
|
||||
_ASM_EXTABLE_UA(12b, 30b)
|
||||
_ASM_EXTABLE_UA(13b, 30b)
|
||||
_ASM_EXTABLE_UA(14b, 30b)
|
||||
_ASM_EXTABLE_UA(15b, 30b)
|
||||
_ASM_EXTABLE_UA(16b, 30b)
|
||||
_ASM_EXTABLE_UA(18b, 40b)
|
||||
_ASM_EXTABLE_UA(19b, 40b)
|
||||
_ASM_EXTABLE_UA(21b, 50b)
|
||||
_ASM_EXTABLE_UA(22b, 50b)
|
||||
ENDPROC(copy_user_generic_unrolled)
|
||||
EXPORT_SYMBOL(copy_user_generic_unrolled)
|
||||
|
||||
@@ -156,8 +156,8 @@ ENTRY(copy_user_generic_string)
|
||||
jmp copy_user_handle_tail
|
||||
.previous
|
||||
|
||||
_ASM_EXTABLE(1b,11b)
|
||||
_ASM_EXTABLE(3b,12b)
|
||||
_ASM_EXTABLE_UA(1b, 11b)
|
||||
_ASM_EXTABLE_UA(3b, 12b)
|
||||
ENDPROC(copy_user_generic_string)
|
||||
EXPORT_SYMBOL(copy_user_generic_string)
|
||||
|
||||
@@ -189,7 +189,7 @@ ENTRY(copy_user_enhanced_fast_string)
|
||||
jmp copy_user_handle_tail
|
||||
.previous
|
||||
|
||||
_ASM_EXTABLE(1b,12b)
|
||||
_ASM_EXTABLE_UA(1b, 12b)
|
||||
ENDPROC(copy_user_enhanced_fast_string)
|
||||
EXPORT_SYMBOL(copy_user_enhanced_fast_string)
|
||||
|
||||
@@ -319,27 +319,27 @@ ENTRY(__copy_user_nocache)
|
||||
jmp copy_user_handle_tail
|
||||
.previous
|
||||
|
||||
_ASM_EXTABLE(1b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(2b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(3b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(4b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(5b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(6b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(7b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(8b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(9b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(10b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(11b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(12b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(13b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(14b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(15b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(16b,.L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE(20b,.L_fixup_8b_copy)
|
||||
_ASM_EXTABLE(21b,.L_fixup_8b_copy)
|
||||
_ASM_EXTABLE(30b,.L_fixup_4b_copy)
|
||||
_ASM_EXTABLE(31b,.L_fixup_4b_copy)
|
||||
_ASM_EXTABLE(40b,.L_fixup_1b_copy)
|
||||
_ASM_EXTABLE(41b,.L_fixup_1b_copy)
|
||||
_ASM_EXTABLE_UA(1b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(2b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(3b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(4b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(5b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(6b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(7b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(8b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(9b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(10b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(11b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(12b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(13b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(14b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(15b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(16b, .L_fixup_4x8b_copy)
|
||||
_ASM_EXTABLE_UA(20b, .L_fixup_8b_copy)
|
||||
_ASM_EXTABLE_UA(21b, .L_fixup_8b_copy)
|
||||
_ASM_EXTABLE_UA(30b, .L_fixup_4b_copy)
|
||||
_ASM_EXTABLE_UA(31b, .L_fixup_4b_copy)
|
||||
_ASM_EXTABLE_UA(40b, .L_fixup_1b_copy)
|
||||
_ASM_EXTABLE_UA(41b, .L_fixup_1b_copy)
|
||||
ENDPROC(__copy_user_nocache)
|
||||
EXPORT_SYMBOL(__copy_user_nocache)
|
||||
|
新增問題並參考
封鎖使用者