Commit 3656dca3 authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman

lkdtm/usercopy: Moves the KERNEL_DS test to non-canonical

[ Upstream commit 2bf8496f ]

The prior implementation of the KERNEL_DS fault checking would work on
any unmapped kernel address, but this was narrowed to the non-canonical
range instead. This adjusts the LKDTM test to match.

Fixes: 00c42373 ("x86-64: add warning for non-canonical user access address dereferences")
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 226fe899
...@@ -324,14 +324,16 @@ void lkdtm_USERCOPY_KERNEL(void) ...@@ -324,14 +324,16 @@ void lkdtm_USERCOPY_KERNEL(void)
void lkdtm_USERCOPY_KERNEL_DS(void) void lkdtm_USERCOPY_KERNEL_DS(void)
{ {
char __user *user_ptr = (char __user *)ERR_PTR(-EINVAL); char __user *user_ptr =
(char __user *)(0xFUL << (sizeof(unsigned long) * 8 - 4));
mm_segment_t old_fs = get_fs(); mm_segment_t old_fs = get_fs();
char buf[10] = {0}; char buf[10] = {0};
pr_info("attempting copy_to_user on unmapped kernel address\n"); pr_info("attempting copy_to_user() to noncanonical address: %px\n",
user_ptr);
set_fs(KERNEL_DS); set_fs(KERNEL_DS);
if (copy_to_user(user_ptr, buf, sizeof(buf))) if (copy_to_user(user_ptr, buf, sizeof(buf)) == 0)
pr_info("copy_to_user un unmapped kernel address failed\n"); pr_err("copy_to_user() to noncanonical address succeeded!?\n");
set_fs(old_fs); set_fs(old_fs);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment