Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   He Zhe <zhe.he@windriver.com>
To:     keescook@chromium.org, linux-kernel@vger.kernel.org,
        zhe.he@windriver.com
Subject: [PATCH] lkdtm: usercopy: Make USERCOPY_STACK_FRAME_x able to work for all archs
Date:   Mon, 25 Apr 2022 14:28:35 +0800
Message-Id: <20220425062835.3945462-1-zhe.he@windriver.com>
Content-Transfer-Encoding: 8bit
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?bDRCSUFrpZrCVIOtV+JUTK4s9/KR3nAHE+XjEUwHraTa0DL04QuAaQxSUvTo?=
 =?us-ascii?Q?8ZPtKMAsI1FZIrvmsSVnOGawkjDAhNEa8uHP0Odkr5youWmU7ppffSiFj/74?=
 =?us-ascii?Q?6IdULJIaz+Nyj9PxT20TXVf+WOIZu4IE9XlqimnY4HV2FLfnDQyQGpGcr5R1?=
 =?us-ascii?Q?kxTJKZP/a2gWaqmNQEkOhaoSWf1FpdzcidP8krfQ2WOqTXPLsHySp67AVu8A?=
 =?us-ascii?Q?aaJpBKeW5YtRlDVqjAL6EYhHlp4zC6CEU+OKY+BGwqMIMllHwcQRSnuWQus4?=
 =?us-ascii?Q?isHTbvQ8AV/Hq2ZWWrCnKs/79qP5in7pMDkGU5Jk2tZw8yjQrLVPC7lw0cY6?=
 =?us-ascii?Q?FIt85hqYrIlH7S7T3kaCIZ1qT49B1xOiwdj2eslwUtOB0Soxy3YmqTilJzBl?=
 =?us-ascii?Q?NYc1wSVr4oGpXIb9sFoobIlbgE8YcWLlNztzwB9sQdQIBY171F/myg/bVA06?=
 =?us-ascii?Q?HFXcqL45YqVt3BrR0pOk5ZHQTEn9YBahAJQHK7bUmdFlOahyiVhzIWsmLZXj?=
 =?us-ascii?Q?1yfUgw2lPH4shYfddi/VlcnyRgPnRd2y3X+m+nemlIFVWognrwkXLBIE3yes?=
 =?us-ascii?Q?Y5MGg/zldvAtWsh9H4RgEGww7QHf8oO0Jq/fPCBcUtlCfN8/knA9jWdl0c1w?=
 =?us-ascii?Q?QW6Owy6DoH8FMW+TJVT6Y8eNZzJiUF9dASalmwvs6KVgjaB4tk+Dg/GaTZ8i?=
 =?us-ascii?Q?h5UIgjEt1vA1gGfv40B5NyOa7ZC0sQQVU7kQNIvGcGWuvt9jtAnKidYEvuiq?=
 =?us-ascii?Q?s/ttRqJYMsH/ljlzqRn6ZngkJwTCPth4QpUITBoHI0MoM/9/lXV+Yw5VfqxU?=
 =?us-ascii?Q?Lu98LOt7mDoK3OkLXmC5p05TRehJjtWLGidcRJtWMaduwSVJsfi2997BfTme?=
 =?us-ascii?Q?jgXO+3/IpOa+NZaSXGwHx/HqWYoBaAmGFgQWTIC90IOJf0in7ylW0GTqjHvu?=
 =?us-ascii?Q?VfO1wcF9CgOa4oQniwk/HTytQgsC3RpY1VI1OMUfS8cvNhtlGvVFkuLRBACj?=
 =?us-ascii?Q?0QNdSVU+EItd4r/caaX6chKZgqZOtNSMXz4bGPJ3EgFqfdrwr8JKHyHN0pPj?=
 =?us-ascii?Q?w8PwON/+E0fftDVGxlmHOtaGJYZXCQVam78ji+6TUdDlbGt6BtdiVTt8cOku?=
 =?us-ascii?Q?+UPGvHIdRATbxzH5+zrVWDDW+V/PLoF+g1kyJ7R5ttwOosQmNtnasUglLwPm?=
 =?us-ascii?Q?CUZOKD/KxxysTd75tCUPBaAJSA0VgWXaJDNkRyhuciu6r4J3pMgmeBNIUZWb?=
 =?us-ascii?Q?/lN/E7ogBJhdT+NDZUPIVFeOLjQIqsoi7BJ/AyqAOTMXk5GfMqwQRaJPAf5f?=
 =?us-ascii?Q?Wr+dmeZHmk+pF5XyBhBQa81aFaFnfC5DIEOuOSMob+Q3f1//1vBV6k/1XK7C?=
 =?us-ascii?Q?LQft/vZkhmnH3mY/xrB/Kj7xEBwbJS0yDH69xnmrb4WPlpndqsf6+58bfBQq?=
 =?us-ascii?Q?JMq/JEz2we84l545YxdbQc2YjkyNzPo36bCp1gAYIQGL4LiOB2aS2SCCWT0d?=
 =?us-ascii?Q?uEFCVGl+akiJX9n7fzQjanbxesmYySEKBDtY25tz0Z+KBSWi1I+iQCTZgyq0?=
 =?us-ascii?Q?e8kxX2kvxE3e5F0L6JgPLP9DHXkapvSXkiKO/MgLXyugaFk0xv5rks78gd21?=
 =?us-ascii?Q?sMLFVN7GVv7Y8RYhZoqO2MSHin380HW5iMA+046dkl7o9NGLoLbXRtMC5saD?=
 =?us-ascii?Q?xj+An8yBUW1K7eQV5kG/n8G49AqtXaQOaGYYgZxD2LQ0tg21Vvi76C8TGyC6?=
 =?us-ascii?Q?WpHq2URNSw=3D=3D?=
X-OriginatorOrg: windriver.com
X-MS-Exchange-CrossTenant-Network-Message-Id: e4f1c39f-c7cd-4856-741e-08da2684dfd1
X-MS-Exchange-CrossTenant-AuthSource: MWHPR11MB1358.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Apr 2022 06:28:56.1430
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 8ddb2873-a1ad-4a18-ae4e-4644631433be
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: /m4f5R8MicvSP/VCnXlABxYYUmTtKgeIpdpFOVVKikEiOC2bJmuKiWPRJnZhpUftJNz+nZQkHC7eLT8533K+Og==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR11MB2749
X-Proofpoint-GUID: Wn-Ibqcr5RBndaFcoGCXcxmNXMWXRJvB
X-Proofpoint-ORIG-GUID: Wn-Ibqcr5RBndaFcoGCXcxmNXMWXRJvB
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.205,Aquarius:18.0.858,Hydra:6.0.486,FMLib:17.11.64.514
 definitions=2022-04-25_02,2022-04-22_01,2022-02-23_01
X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 clxscore=1015 bulkscore=0
 mlxlogscore=941 lowpriorityscore=0 spamscore=0 suspectscore=0 mlxscore=0
 adultscore=0 malwarescore=0 impostorscore=0 priorityscore=1501
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2202240000 definitions=main-2204250028
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,SPF_HELO_NONE,
        SPF_PASS autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Currently the way to generate bad frame depends on stack layout of the
architecture and compiler. It happens to work with x86 but does not work
with arm64 since it ruins the stack.

On x86, the original do_usercopy_stack_callee returns the start address of
its local buffer which is located deeply enough in the stack, so that the
following arch_within_stack_frames finds that the address is out of the
frame under check and gives the warning.

While on arm64, the local buffer of do_usercopy_stack_callee is just not
deep enough and happens to land in the range of a frame so that
arch_within_stack_frames cannot detect it with current algorithm. And worse
in USERCOPY_STACK_FRAME_FROM, the immediate _copy_from_user writing 0 to
the returned buffer just overwrites the return address of the call chain.

$ echo USERCOPY_STACK_FRAME_FROM > /sys/kernel/debug/provoke-crash/DIRECT
lkdtm: Performing direct entry USERCOPY_STACK_FRAME_FROM
lkdtm: attempting good copy_from_user of local stack
lkdtm: attempting bad copy_from_user of distant stack
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

The detection algorithm may be improved in the future, but before that
let's tune the test case to validate current one. We can simply use
__builtin_frame_address(0) as a bad start address that can be detected for 
all architectures.

Signed-off-by: He Zhe <zhe.he@windriver.com>
---
 drivers/misc/lkdtm/usercopy.c | 24 +-----------------------
 1 file changed, 1 insertion(+), 23 deletions(-)

diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
index 9161ce7ed47a..000a1be15200 100644
--- a/drivers/misc/lkdtm/usercopy.c
+++ b/drivers/misc/lkdtm/usercopy.c
@@ -24,28 +24,6 @@ static struct kmem_cache *whitelist_cache;
 
 static const unsigned char test_text[] = "This is a test.\n";
 
-/*
- * Instead of adding -Wno-return-local-addr, just pass the stack address
- * through a function to obfuscate it from the compiler.
- */
-static noinline unsigned char *trick_compiler(unsigned char *stack)
-{
-	return stack + 0;
-}
-
-static noinline unsigned char *do_usercopy_stack_callee(int value)
-{
-	unsigned char buf[32];
-	int i;
-
-	/* Exercise stack to avoid everything living in registers. */
-	for (i = 0; i < sizeof(buf); i++) {
-		buf[i] = value & 0xff;
-	}
-
-	return trick_compiler(buf);
-}
-
 static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
 {
 	unsigned long user_addr;
@@ -59,7 +37,7 @@ static noinline void do_usercopy_stack(bool to_user, bool bad_frame)
 
 	/* This is a pointer to outside our current stack frame. */
 	if (bad_frame) {
-		bad_stack = do_usercopy_stack_callee((uintptr_t)&bad_stack);
+		bad_stack = __builtin_frame_address(0);
 	} else {
 		/* Put start address just inside stack. */
 		bad_stack = task_stack_page(current) + THREAD_SIZE;
-- 
2.25.1