From patchwork Wed Nov 15 10:56:26 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jinjie Ruan X-Patchwork-Id: 165277 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:b909:0:b0:403:3b70:6f57 with SMTP id t9csp2456685vqg; Wed, 15 Nov 2023 02:57:22 -0800 (PST) X-Google-Smtp-Source: AGHT+IFHeK0cwduLIown1W0+F5jwCvw2hvTmm87z296UHhqoW3drK4Nq5Q6SMVg2F2MjTmiK+Z24 X-Received: by 2002:a05:6358:591d:b0:16b:d072:b3e3 with SMTP id g29-20020a056358591d00b0016bd072b3e3mr5347447rwf.24.1700045842098; Wed, 15 Nov 2023 02:57:22 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1700045842; cv=none; d=google.com; s=arc-20160816; b=KhQaMlhc7YQECnAfxAWQNOQtcN6AasqNfsnba7oaOzyOtzc74yoAcdY6C2ybTz9uZn 74x9ai/Fmay1Ir4vKSjJiuJgsqrx8OUNRpsqGPk5ECJ9Zt7q8MydezBepUc4+ar85Q/k 11dj7CkrjvrlcFeAZc1MGgL9HwGp7xChmLR4J8ZFlhA8THEO5qzQoZWagKXVP8vL8iLG CB0y9hy75NLP6pRfSI4t6wQSRn3sVtXKJapq2zcnR6vkVR9qzWfzuejbi3J+3P5zFae/ 0GrAn9bkrGPx7BDDzZPG8pm7wDtUUGglukzChyPfkMO+LBa/JX2Nt4icPvlzGpHcWr6P 3z+w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=gvSPxi6HTKHpHB5wWZj94JAruMWRznin2m1NWDt64tI=; fh=7BOi/73s2IkizVQO/PFWQ8g+wW0LO0SC3S+AOahzHVs=; b=fgWx7Vf/waUE2+1yuGd13qB3mU+3LbYjXVK4d3HL7Ck3Tf8sgplRTayUaV22gTs+Zl B+el82FuLb36QMWjKUUEyxhXWnm1O5yno4YzHSt5lPnu0W85P+e1Z2Cdi+FoI3eu5nVH 3XQj1Jssh2w1UQlog0IiqLDdbHJt/dab/pYYOoQm/XayhroPlv9hoyoXYEZmckh9gF3S ne+gBbOJ6hkvOT69wsO9wP1uytPEAsg4DCJzhuTIQuRaEPuLFvxXYHAnW1x84u8XjbrL J/an/adthFhK/RNDrINJmaBppYegUvSBPpciqBi5kJ9ZEFT7Ow8WeycCvknRHk/Y3zQq e69A== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from lipwig.vger.email (lipwig.vger.email. [2620:137:e000::3:3]) by mx.google.com with ESMTPS id f12-20020a63e30c000000b005aa644010a6si9723888pgh.205.2023.11.15.02.57.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Nov 2023 02:57:22 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) client-ip=2620:137:e000::3:3; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:3 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=huawei.com Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by lipwig.vger.email (Postfix) with ESMTP id 9AB8980278DC; Wed, 15 Nov 2023 02:57:18 -0800 (PST) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.11 at lipwig.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234885AbjKOK5M (ORCPT + 28 others); Wed, 15 Nov 2023 05:57:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234098AbjKOK5L (ORCPT ); Wed, 15 Nov 2023 05:57:11 -0500 Received: from szxga02-in.huawei.com (szxga02-in.huawei.com [45.249.212.188]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 05CF5DA for ; Wed, 15 Nov 2023 02:57:05 -0800 (PST) Received: from kwepemi500008.china.huawei.com (unknown [172.30.72.57]) by szxga02-in.huawei.com (SkyGuard) with ESMTP id 4SVg4338DpzNmJ3; Wed, 15 Nov 2023 18:52:51 +0800 (CST) Received: from huawei.com (10.90.53.73) by kwepemi500008.china.huawei.com (7.221.188.139) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.31; Wed, 15 Nov 2023 18:57:03 +0800 From: Jinjie Ruan To: , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , , "H. Peter Anvin" CC: Subject: [PATCH] x86: Fix 32-bit compatible userspace write size overflow error Date: Wed, 15 Nov 2023 18:56:26 +0800 Message-ID: <20231115105626.953273-1-ruanjinjie@huawei.com> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Originating-IP: [10.90.53.73] X-ClientProxiedBy: dggems705-chm.china.huawei.com (10.3.19.182) To kwepemi500008.china.huawei.com (7.221.188.139) X-CFilter-Loop: Reflected X-Spam-Status: No, score=-0.8 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lipwig.vger.email Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (lipwig.vger.email [0.0.0.0]); Wed, 15 Nov 2023 02:57:18 -0800 (PST) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1782627269148753567 X-GMAIL-MSGID: 1782627269148753567 For 32-bit compatible userspace program, write with size = -1 return not -1 but unexpected other values, which is due to the __access_ok() check is insufficient. The specified "ptr + size" is greater than 32-bit limit and should return -EFAULT, but it is not checked and can not catch the overflow error. Fix above error by checking 32-bit limit if it is 32-bit compatible userspace program. How to reproduce: The test program is as below: root@syzkaller:~# cat test.c #include #include #include #include #include #include #define pinfo(fmt, args...) \ fprintf(stderr, "[INFO][%s][%d][%s]:"fmt, \ __FILE__,__LINE__,__func__,##args) #undef SIZE_MAX #define SIZE_MAX -1 int main() { char wbuf[3] = { 'x', 'y', 'z' }; char *path = "write.tmp"; int ret; int fd = open(path, O_RDWR | O_CREAT); if (fd<0) { pinfo("fd=%d\n", fd); exit(-1); } assert(write(fd, wbuf, 3) == 3); ret = write (fd, wbuf, SIZE_MAX); pinfo("ret=%d\n", ret); pinfo("size_max=%d\n",SIZE_MAX); assert(ret==-1); close(fd); pinfo("INFO: end\n"); return 0; } Before applying this patch, userspace 32-bit program return 3799 if the write size = -1 as below: root@syzkaller:~# gcc test.c -o test root@syzkaller:~# gcc -m32 test.c -o test32 root@syzkaller:~# ./test [INFO][test.c][32][main]:ret=-1 [INFO][test.c][33][main]:size_max=-1 [INFO][test.c][36][main]:INFO: end root@syzkaller:~# ./test32 [INFO][test.c][32][main]:ret=3799 [INFO][test.c][33][main]:size_max=-1 test32: test.c:34: main: Assertion `ret==-1' failed. Aborted After applying this patch, userspace 32-bit program return -1 if the write size = -1 as expected as below: root@syzkaller:~# gcc test.c -o test root@syzkaller:~# gcc -m32 test.c -o test32 root@syzkaller:~# ./test [INFO][test.c][32][main]:ret=-1 [INFO][test.c][33][main]:size_max=-1 [INFO][test.c][36][main]:INFO: end root@syzkaller:~# ./test32 [INFO][test.c][32][main]:ret=-1 [INFO][test.c][33][main]:size_max=-1 [INFO][test.c][36][main]:INFO: end Fixes: b9bd9f605c4a ("x86: uaccess: move 32-bit and 64-bit parts into proper header") Signed-off-by: Jinjie Ruan --- arch/x86/include/asm/uaccess_64.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h index f2c02e4469cc..9febfbca3a88 100644 --- a/arch/x86/include/asm/uaccess_64.h +++ b/arch/x86/include/asm/uaccess_64.h @@ -88,6 +88,12 @@ static inline bool __access_ok(const void __user *ptr, unsigned long size) return valid_user_address(ptr); } else { unsigned long sum = size + (unsigned long)ptr; + +#ifdef CONFIG_COMPAT + if (in_ia32_syscall()) + return valid_user_address(sum) && + sum >= (unsigned long)ptr && sum < UL(0x100000000); +#endif return valid_user_address(sum) && sum >= (unsigned long)ptr; } }