public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-08-05 16:54:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
linux/arch/riscv/kernel
History
Stefan O'Rear d14fa1fcf6
riscv: process: Fix kernel gp leakage 
childregs represents the registers which are active for the new thread
in user context. For a kernel thread, childregs->gp is never used since
the kernel gp is not touched by switch_to. For a user mode helper, the
gp value can be observed in user space after execve or possibly by other
means.

[From the email thread]

The /* Kernel thread */ comment is somewhat inaccurate in that it is also used
for user_mode_helper threads, which exec a user process, e.g. /sbin/init or
when /proc/sys/kernel/core_pattern is a pipe. Such threads do not have
PF_KTHREAD set and are valid targets for ptrace etc. even before they exec.

childregs is the *user* context during syscall execution and it is observable
from userspace in at least five ways:

1. kernel_execve does not currently clear integer registers, so the starting
   register state for PID 1 and other user processes started by the kernel has
   sp = user stack, gp = kernel __global_pointer$, all other integer registers
   zeroed by the memset in the patch comment.

   This is a bug in its own right, but I'm unwilling to bet that it is the only
   way to exploit the issue addressed by this patch.

2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread
   before it execs, but ptrace requires SIGSTOP to be delivered which can only
   happen at user/kernel boundaries.

3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for
   user_mode_helpers before the exec completes, but gp is not one of the
   registers it returns.

4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel
   addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses
   are also exposed via PERF_SAMPLE_REGS_USER which is permitted under
   LOCKDOWN_PERF. I have not attempted to write exploit code.

5. Much of the tracing infrastructure allows access to user registers. I have
   not attempted to determine which forms of tracing allow access to user
   registers without already allowing access to kernel registers.

Fixes: 7db91e57a0 ("RISC-V: Task implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Stefan O'Rear <sorear@fastmail.com>
Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Link: https://lore.kernel.org/r/20240327061258.2370291-1-sorear@fastmail.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
2024-04-04 12:35:05 -07:00
..
compat_vdso riscv: compat_vdso: align VDSOAS build log 2024-03-27 07:08:38 -07:00
pi RISC-V: build: Allow LTO to be selected 2024-01-22 10:06:29 -08:00
probes riscv: Use SYM_*() assembly macros instead of deprecated ones 2023-11-06 09:42:47 -08:00
tests treewide: replace or remove redundant def_bool in Kconfig files 2024-02-20 20:47:45 +09:00
vdso riscv: hwprobe: do not produce frtace relocation 2024-03-26 14:06:59 -07:00
.gitignore
acpi.c RISC-V: ACPI: Enhance acpi_os_ioremap with MMIO remapping 2023-10-26 09:40:31 -07:00
alternative.c riscv: errata: Rename defines for Andes 2024-03-12 07:13:12 -07:00
asm-offsets.c riscv: Implement Shadow Call Stack 2023-10-27 14:43:08 -07:00
cacheinfo.c RISC-V Patches for the 6.4 Merge Window, Part 1 2023-04-28 16:55:39 -07:00
cfi.c bpf, riscv64/cfi: Support kCFI + BPF on riscv64 2024-03-06 15:18:16 -08:00
compat_signal.c
compat_syscall_table.c riscv: Implement syscall wrappers 2023-08-23 14:16:36 -07:00
copy-unaligned.h RISC-V: Probe for unaligned access speed 2023-09-01 09:06:25 -07:00
copy-unaligned.S riscv: Use SYM_*() assembly macros instead of deprecated ones 2023-11-06 09:42:47 -08:00
cpu-hotplug.c riscv: Use the same CPU operations for all CPUs 2024-01-04 15:03:07 -08:00
cpu.c Merge patch series "Linux RISC-V AIA Preparatory Series" 2023-11-08 18:57:17 -08:00
cpu_ops.c riscv: Use the same CPU operations for all CPUs 2024-01-04 15:03:07 -08:00
cpu_ops_sbi.c riscv: Remove unused members from struct cpu_operations 2024-01-04 15:03:06 -08:00
cpu_ops_spinwait.c riscv: Remove unused members from struct cpu_operations 2024-01-04 15:03:06 -08:00
cpufeature.c RISC-V Patches for the 6.9 Merge Window 2024-03-22 10:41:13 -07:00
crash_dump.c
crash_save_regs.S
efi-header.S riscv: Prepare EFI header for relocatable kernels 2023-04-19 07:46:28 -07:00
efi.c riscv: Use accessors to page table entries instead of direct dereference 2023-12-20 10:48:15 -08:00
elf_kexec.c riscv, crash: wrap crash dumping code into crash related ifdefs 2024-02-23 17:48:24 -08:00
entry.S riscv: blacklist assembly symbols for kprobe 2024-01-24 15:59:42 -08:00
fpu.S riscv: Use SYM_*() assembly macros instead of deprecated ones 2023-11-06 09:42:47 -08:00
ftrace.c riscv: ftrace: Make function graph use ftrace directly 2024-01-17 18:17:08 -08:00
head.h riscv: entry: Convert to generic entry 2023-03-23 08:47:00 -07:00
head.S Merge patch series "Fix XIP boot and make XIP testable in QEMU" 2024-01-09 20:10:39 -08:00
hibernate-asm.S riscv: Use SYM_*() assembly macros instead of deprecated ones 2023-11-06 09:42:47 -08:00
hibernate.c riscv: hibernate: remove WARN_ON in save_processor_state 2023-06-23 10:06:22 -07:00
image-vars.h efi: move screen_info into efi init code 2023-10-17 16:33:39 +02:00
irq.c Merge patch "drivers: perf: Do not broadcast to other cpus when starting a counter" 2023-11-09 06:44:13 -08:00
jump_label.c
kernel_mode_vector.c riscv: vector: allow kernel-mode Vector with preemption 2024-01-16 07:14:02 -08:00
kexec_relocate.S riscv: kexec: Cleanup riscv_kexec_relocate 2023-09-20 02:53:29 -07:00
kgdb.c
machine_kexec.c kexec_file, riscv: print out debugging message if required 2023-12-20 15:02:57 -08:00
machine_kexec_file.c
Makefile RISC-V Patches for the 6.9 Merge Window 2024-03-22 10:41:13 -07:00
mcount-dyn.S Merge patch series "riscv: ftrace: Miscellaneous ftrace improvements" 2024-01-17 18:17:29 -08:00
mcount.S riscv: remove MCOUNT_NAME workaround 2024-02-22 15:38:54 -08:00
module-sections.c
module.c riscv: optimize ELF relocation function in riscv 2024-01-17 18:21:10 -08:00
paravirt.c RISC-V: paravirt: Use correct restricted types 2024-02-09 11:53:10 +05:30
patch.c riscv: Disable preemption when using patch_map() 2024-04-04 12:33:38 -07:00
perf_callchain.c
perf_regs.c
process.c riscv: process: Fix kernel gp leakage 2024-04-04 12:35:05 -07:00
ptrace.c Merge patch series "riscv: Introduce compat-mode helpers & improve arch_get_mmap_end()" 2024-03-20 08:56:05 -07:00
reset.c
return_address.c riscv: add CALLER_ADDRx support 2024-02-22 12:17:47 -08:00
riscv_ksyms.c
sbi-ipi.c RISC-V: Allow marking IPIs as suitable for remote FENCEs 2023-04-08 11:26:24 +01:00
sbi.c RISC-V: Add SBI debug console helper routines 2024-01-10 07:04:03 -08:00
setup.c Driver core changes for 6.8-rc1 2024-01-18 09:48:40 -08:00
signal.c riscv: Fix vector state restore in rt_sigreturn() 2024-04-03 16:10:25 -07:00
smp.c riscv: Use the same CPU operations for all CPUs 2024-01-04 15:03:07 -08:00
smpboot.c RISC-V Patches for the 6.9 Merge Window 2024-03-22 10:41:13 -07:00
soc.c
stacktrace.c riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode 2023-03-09 14:50:35 -08:00
suspend.c RISC-V Patches for the 6.9 Merge Window 2024-03-22 10:41:13 -07:00
suspend_entry.S riscv: Use SYM_*() assembly macros instead of deprecated ones 2023-11-06 09:42:47 -08:00
sys_hwprobe.c riscv: Set unaligned access speed at compile time 2024-03-13 07:30:31 -07:00
sys_riscv.c riscv: hwprobe: export Zicond extension 2024-01-09 20:12:30 -08:00
syscall_table.c riscv: Implement syscall wrappers 2023-08-23 14:16:36 -07:00
time.c RISC-V: paravirt: Add skeleton for pv-time support 2023-12-30 11:25:03 +05:30
traps.c riscv: use KERN_INFO in do_trap 2024-04-04 12:12:14 -07:00
traps_misaligned.c riscv: Set unaligned access speed at compile time 2024-03-13 07:30:31 -07:00
unaligned_access_speed.c riscv: Use kcalloc() instead of kzalloc() 2024-03-20 08:56:07 -07:00
vdso.c riscv: vdso: Use generic union vdso_data_store 2024-02-20 20:56:00 +01:00
vector.c riscv: vector: allow kernel-mode Vector with preemption 2024-01-16 07:14:02 -08:00
vmcore_info.c crash: split vmcoreinfo exporting code out from crash_core.c 2024-02-23 17:48:22 -08:00
vmlinux-xip.lds.S riscv: Check if the code to patch lies in the exit section 2024-01-09 10:58:59 -08:00
vmlinux.lds.S riscv: Check if the code to patch lies in the exit section 2024-01-09 10:58:59 -08:00