Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CONFIG_HARDENED_USERCOPY detects kernel memory overwrite attempt to kernel text #15

Closed
EvgeniiDidin opened this issue Mar 2, 2020 · 5 comments
Closed

CONFIG_HARDENED_USERCOPY detects kernel memory overwrite attempt to kernel text #15

EvgeniiDidin opened this issue Mar 2, 2020 · 5 comments
Assignees
@vineetgarc
Labels
bug component: linux kernel

Comments

@EvgeniiDidin
Copy link
Member

EvgeniiDidin commented Mar 2, 2020 •
edited by abrodkin

Starting Linux kernel v5.4.22 on both HSDK & nSIM with ARC HS with enabled CONFIG_HARDENED_USERCOPY option ends up with hang with the next message:

usercopy: Kernel memory overwrite attempt detected to kernel text (offset 155633, size 11)!
usercopy: BUG: failure at mm/usercopy.c:99/usercopy_abort()!

gcc generated __builtin_trap
Path: /bin/busybox
CPU: 0 PID: 84 Comm: init Not tainted 5.4.22 

[ECR ]: 0x00090005 => gcc generated __builtin_trap
[EFA ]: 0x9024fcaa
[BLINK ]: usercopy_abort+0x8a/0x8c
[ERET ]: memfd_fcntl+0x0/0x470
[STAT32]: 0x80080802 : IE K  
BTA: 0x901ba38c SP: 0xbe161ecc FP: 0xbf9fe950
LPS: 0x90677408 LPE: 0x9067740c LPC: 0x00000000
r00: 0x0000003c r01: 0xbf0ed280 r02: 0x00000000
r03: 0xbe15fa30 r04: 0x00d2803e r05: 0x00000000
r06: 0x675d7000 r07: 0x00000000 r08: 0x675d9c00
r09: 0x00000000 r10: 0x0000035c r11: 0x61206572
r12: 0x9024fcaa r13: 0x0000000b r14: 0x0000000b
r15: 0x00000000 r16: 0x90169ffc r17: 0x90168000
r18: 0x00000000 r19: 0xbf092010 r20: 0x00000001
r21: 0x00000011 r22: 0x5ffffff1 r23: 0x90169ff1
r24: 0xbe196c00 r25: 0xbf0ed280

Stack Trace:
 memfd_fcntl+0x0/0x470
 usercopy_abort+0x8a/0x8c
 __check_object_size+0x10e/0x138
 copy_strings+0x1f4/0x38c
 __do_execve_file+0x352/0x848
 EV_Trap+0xcc/0xd0
@vineetgarc
Copy link

vineetgarc commented Mar 11, 2020 •
edited

@Palmyr3 care to take a look at this one ?
Adding @abrodkin to mix as well

@abrodkin
Copy link
Member

@EvgeniiDidin could you please elaborate a bit on how important is that one for us? I.e. is it required by some project like OpenWrt etc? That will help us to prioritize it properly.

@abrodkin abrodkin changed the title Linux kernel option CONFIG_HARDENED_USERCOPY cause hang on HSDK/nsim_hs. CONFIG_HARDENED_USERCOPY detects kernel memory overwrite attempt to kernel text Mar 12, 2020
@EvgeniiDidin
Copy link
Member Author

EvgeniiDidin commented Mar 13, 2020 •
edited by abrodkin

In OpenWrt CONFIG_HARDENED_USERCOPY=y option was added for all targets in generic Linux configuration files, see: openwrt/openwrt@9b12394

Disabling this option in target/linux/archs38/config-* file we can work-around this issue (specific target config is of higher priority).

@vineetgarc
Copy link

Fix posted: http://lists.infradead.org/pipermail/linux-snps-arc/2021-June/005203.html

roxell pushed a commit to roxell/linux that referenced this issue Jun 11, 2021
@vineetgarc
ARC: fix CONFIG_HARDENED_USERCOPY
0113da2 
Currently enabling this triggers a warning

| usercopy: Kernel memory overwrite attempt detected to kernel text (offset 155633, size 11)!
| usercopy: BUG: failure at mm/usercopy.c:99/usercopy_abort()!
|
|gcc generated __builtin_trap
|Path: /bin/busybox
|CPU: 0 PID: 84 Comm: init Not tainted 5.4.22
|
|[ECR ]: 0x00090005 => gcc generated __builtin_trap
|[EFA ]: 0x9024fcaa
|[BLINK ]: usercopy_abort+0x8a/0x8c
|[ERET ]: memfd_fcntl+0x0/0x470
|[STAT32]: 0x80080802 : IE K
|BTA: 0x901ba38c SP: 0xbe161ecc FP: 0xbf9fe950
|LPS: 0x90677408 LPE: 0x9067740c LPC: 0x00000000
|r00: 0x0000003c r01: 0xbf0ed280 r02: 0x00000000
|r03: 0xbe15fa30 r04: 0x00d2803e r05: 0x00000000
|r06: 0x675d7000 r07: 0x00000000 r08: 0x675d9c00
|r09: 0x00000000 r10: 0x0000035c r11: 0x61206572
|r12: 0x9024fcaa r13: 0x0000000b r14: 0x0000000b
|r15: 0x00000000 r16: 0x90169ffc r17: 0x90168000
|r18: 0x00000000 r19: 0xbf092010 r20: 0x00000001
|r21: 0x00000011 r22: 0x5ffffff1 r23: 0x90169ff1
|r24: 0xbe196c00 r25: 0xbf0ed280
|
|Stack Trace:
| memfd_fcntl+0x0/0x470
| usercopy_abort+0x8a/0x8c
| __check_object_size+0x10e/0x138
| copy_strings+0x1f4/0x38c
| __do_execve_file+0x352/0x848
| EV_Trap+0xcc/0xd0

Fixes: foss-for-synopsys-dwc-arc-processors#15
Reported-by: Evgeniy Didin <didin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
ColinIanKing pushed a commit to ColinIanKing/linux-next that referenced this issue Jun 15, 2021
@vineetgarc
ARC: fix CONFIG_HARDENED_USERCOPY
110febc 
Currently enabling this triggers a warning

| usercopy: Kernel memory overwrite attempt detected to kernel text (offset 155633, size 11)!
| usercopy: BUG: failure at mm/usercopy.c:99/usercopy_abort()!
|
|gcc generated __builtin_trap
|Path: /bin/busybox
|CPU: 0 PID: 84 Comm: init Not tainted 5.4.22
|
|[ECR ]: 0x00090005 => gcc generated __builtin_trap
|[EFA ]: 0x9024fcaa
|[BLINK ]: usercopy_abort+0x8a/0x8c
|[ERET ]: memfd_fcntl+0x0/0x470
|[STAT32]: 0x80080802 : IE K
|...
|...
|Stack Trace:
| memfd_fcntl+0x0/0x470
| usercopy_abort+0x8a/0x8c
| __check_object_size+0x10e/0x138
| copy_strings+0x1f4/0x38c
| __do_execve_file+0x352/0x848
| EV_Trap+0xcc/0xd0

The issue is triggered by an allocation in "init reclaimed" region.
ARC _stext emcompasses the init region (for historical reasons we wanted
the init.text to be under .text as well). This however trips up
__check_object_size()->check_kernel_text_object() which treats this as
object bleeding into kernel text.

Fix that by rezoning _stext to start from regular kernel .text and leave
out .init altogether.

Fixes: foss-for-synopsys-dwc-arc-processors/linux#15
Reported-by: Evgeniy Didin <didin@synopsys.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
fengguang pushed a commit to 0day-ci/linux that referenced this issue Jun 16, 2021
@intel-lab-lkp
ARC: fix CONFIG_HARDENED_USERCOPY
2653d3d 
Currently enabling this triggers a warning

| usercopy: Kernel memory overwrite attempt detected to kernel text (offset 155633, size 11)!
| usercopy: BUG: failure at mm/usercopy.c:99/usercopy_abort()!
|
|gcc generated __builtin_trap
|Path: /bin/busybox
|CPU: 0 PID: 84 Comm: init Not tainted 5.4.22
|
|[ECR ]: 0x00090005 => gcc generated __builtin_trap
|[EFA ]: 0x9024fcaa
|[BLINK ]: usercopy_abort+0x8a/0x8c
|[ERET ]: memfd_fcntl+0x0/0x470
|[STAT32]: 0x80080802 : IE K
|BTA: 0x901ba38c SP: 0xbe161ecc FP: 0xbf9fe950
|LPS: 0x90677408 LPE: 0x9067740c LPC: 0x00000000
|r00: 0x0000003c r01: 0xbf0ed280 r02: 0x00000000
|r03: 0xbe15fa30 r04: 0x00d2803e r05: 0x00000000
|r06: 0x675d7000 r07: 0x00000000 r08: 0x675d9c00
|r09: 0x00000000 r10: 0x0000035c r11: 0x61206572
|r12: 0x9024fcaa r13: 0x0000000b r14: 0x0000000b
|r15: 0x00000000 r16: 0x90169ffc r17: 0x90168000
|r18: 0x00000000 r19: 0xbf092010 r20: 0x00000001
|r21: 0x00000011 r22: 0x5ffffff1 r23: 0x90169ff1
|r24: 0xbe196c00 r25: 0xbf0ed280
|
|Stack Trace:
| memfd_fcntl+0x0/0x470
| usercopy_abort+0x8a/0x8c
| __check_object_size+0x10e/0x138
| copy_strings+0x1f4/0x38c
| __do_execve_file+0x352/0x848
| EV_Trap+0xcc/0xd0

Fixes: foss-for-synopsys-dwc-arc-processors#15
Reported-by: Evgeniy Didin <didin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
@vineetgarc
Copy link

Merged upstream for 5.13-rc7 inclusion.
2021-02-26 110febc ARC: fix CONFIG_HARDENED_USERCOPY

mkopec pushed a commit to mkopec/linux that referenced this issue Jun 20, 2021
@vineetgarc @mkopec
ARC: fix CONFIG_HARDENED_USERCOPY
08ce9b8 
Currently enabling this triggers a warning

| usercopy: Kernel memory overwrite attempt detected to kernel text (offset 155633, size 11)!
| usercopy: BUG: failure at mm/usercopy.c:99/usercopy_abort()!
|
|gcc generated __builtin_trap
|Path: /bin/busybox
|CPU: 0 PID: 84 Comm: init Not tainted 5.4.22
|
|[ECR ]: 0x00090005 => gcc generated __builtin_trap
|[EFA ]: 0x9024fcaa
|[BLINK ]: usercopy_abort+0x8a/0x8c
|[ERET ]: memfd_fcntl+0x0/0x470
|[STAT32]: 0x80080802 : IE K
|...
|...
|Stack Trace:
| memfd_fcntl+0x0/0x470
| usercopy_abort+0x8a/0x8c
| __check_object_size+0x10e/0x138
| copy_strings+0x1f4/0x38c
| __do_execve_file+0x352/0x848
| EV_Trap+0xcc/0xd0

The issue is triggered by an allocation in "init reclaimed" region.
ARC _stext emcompasses the init region (for historical reasons we wanted
the init.text to be under .text as well). This however trips up
__check_object_size()->check_kernel_text_object() which treats this as
object bleeding into kernel text.

Fix that by rezoning _stext to start from regular kernel .text and leave
out .init altogether.

Fixes: foss-for-synopsys-dwc-arc-processors#15
Reported-by: Evgeniy Didin <didin@synopsys.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
hauke added a commit to hauke/openwrt that referenced this issue Apr 22, 2023
@hauke
kernel: Activate CONFIG_HARDENED_USERCOPY for all targets
f13f996 
This activates CONFIG_HARDENED_USERCOPY for the remaining targets. This
adds additional checks in the copy_from_user() and copy_to_user()
functions.

This was not activated for ARCHS38 before because of a bug in the Linux
kernel 5.4 till 5.14, which as fixed and is described here:
foss-for-synopsys-dwc-arc-processors/linux#15

I do not know why this was deactivated for mt7629 and rockchip.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
@hauke hauke mentioned this issue Apr 22, 2023
Closed
Vladdrako pushed a commit to Vladdrako/openwrt that referenced this issue Apr 25, 2023
@hauke @Vladdrako
kernel: Activate CONFIG_HARDENED_USERCOPY for all targets
010f7e3 
This activates CONFIG_HARDENED_USERCOPY for the remaining targets. This
adds additional checks in the copy_from_user() and copy_to_user()
functions.

This was not activated for ARCHS38 before because of a bug in the Linux
kernel 5.4 till 5.14, which as fixed and is described here:
foss-for-synopsys-dwc-arc-processors/linux#15

I do not know why this was deactivated for mt7629 and rockchip.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
hauke added a commit to hauke/openwrt that referenced this issue Apr 29, 2023
@hauke
kernel: Activate CONFIG_HARDENED_USERCOPY for all targets
626b37d 
This activates CONFIG_HARDENED_USERCOPY for the remaining targets. This
adds additional checks in the copy_from_user() and copy_to_user()
functions.

This was not activated for ARCHS38 before because of a bug in the Linux
kernel 5.4 till 5.14, which as fixed and is described here:
foss-for-synopsys-dwc-arc-processors/linux#15

I do not know why this was deactivated for mt7629 and rockchip.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@vineetgarc vineetgarc

Labels
bug component: linux kernel
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@vineetgarc @abrodkin @evgeniy-paltsev @EvgeniiDidin