mm: Tighten x86 /dev/mem with zeroing reads
authorKees Cook <keescook@chromium.org>
Wed, 5 Apr 2017 16:39:08 +0000 (09:39 -0700)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 18 Jul 2017 17:38:44 +0000 (18:38 +0100)
commitb8f254aa17f720053054c4ecff3920973a83b9d6
tree83d50b0a93115a19eeb38369f0d13e7493770aa0
parentf95fb77e908a1efa2772f2155d1db87ca6664d67
mm: Tighten x86 /dev/mem with zeroing reads

commit a4866aa812518ed1a37d8ea0c881dc946409de94 upstream.

Under CONFIG_STRICT_DEVMEM, reading System RAM through /dev/mem is
disallowed. However, on x86, the first 1MB was always allowed for BIOS
and similar things, regardless of it actually being System RAM. It was
possible for heap to end up getting allocated in low 1MB RAM, and then
read by things like x86info or dd, which would trip hardened usercopy:

usercopy: kernel memory exposure attempt detected from ffff880000090000 (dma-kmalloc-256) (4096 bytes)

This changes the x86 exception for the low 1MB by reading back zeros for
System RAM areas instead of blindly allowing them. More work is needed to
extend this to mmap, but currently mmap doesn't go through usercopy, so
hardened usercopy won't Oops the kernel.

Reported-by: Tommi Rantala <tommi.t.rantala@nokia.com>
Tested-by: Tommi Rantala <tommi.t.rantala@nokia.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
arch/x86/mm/init.c
drivers/char/mem.c