linux_dsm_epyc7002/arch/arm/kernel
Thomas Garnier 73ac5d6a2b arm/syscalls: Check address limit on user-mode return
Ensure the address limit is a user-mode segment before returning to
user-mode. Otherwise a process can corrupt kernel-mode memory and
elevate privileges [1].

The set_fs function sets the TIF_SETFS flag to force a slow path on
return. In the slow path, the address limit is checked to be USER_DS if
needed.

The TIF_SETFS flag is added to _TIF_WORK_MASK shifting _TIF_SYSCALL_WORK
for arm instruction immediate support. The global work mask is too big
to used on a single instruction so adapt ret_fast_syscall.

[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=990

Signed-off-by: Thomas Garnier <thgarnie@google.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: kernel-hardening@lists.openwall.com
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: Miroslav Benes <mbenes@suse.cz>
Cc: Chris Metcalf <cmetcalf@mellanox.com>
Cc: Pratyush Anand <panand@redhat.com>
Cc: Russell King <linux@armlinux.org.uk>
Cc: Petr Mladek <pmladek@suse.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: Will Drewry <wad@chromium.org>
Cc: linux-api@vger.kernel.org
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Link: http://lkml.kernel.org/r/20170615011203.144108-2-thgarnie@google.com
2017-07-08 14:05:33 +02:00
..
.gitignore
arch_timer.c arch_timer: Move to generic sched_clock framework 2013-10-09 16:54:10 -07:00
armksyms.c arm: kernel: Add SMC structure parameter 2017-02-03 18:46:33 +00:00
asm-offsets.c ARM: save and reset the address limit when entering an exception 2016-07-07 16:01:01 +01:00
atags_compat.c ARM: convert printk(KERN_* to pr_* 2014-11-21 15:24:50 +00:00
atags_parse.c ARM: convert printk(KERN_* to pr_* 2014-11-21 15:24:50 +00:00
atags_proc.c ARM: convert printk(KERN_* to pr_* 2014-11-21 15:24:50 +00:00
atags.h ARM: 8495/1: ATAGS: move save_atags() to arch/arm/include/asm/setup.h 2016-01-04 11:26:00 +00:00
bios32.c ARM/PCI: Use generic pci_mmap_resource_range() 2017-04-20 08:47:47 -05:00
cpuidle.c ARM: 8595/2: apply more __ro_after_init 2016-08-12 16:47:06 +01:00
crash_dump.c ARM: 8012/1: kdump: Avoid overflow when converting pfn to physaddr 2014-04-07 12:10:00 +01:00
debug.S ARM: unify MMU/!MMU addruart calls 2015-05-20 23:09:51 +02:00
devtree.c ARM: 8616/1: dt: Respect property size when parsing CPUs 2016-09-29 16:57:43 +01:00
dma-isa.c ARM: convert printk(KERN_* to pr_* 2014-11-21 15:24:50 +00:00
dma.c ARM: convert printk(KERN_* to pr_* 2014-11-21 15:24:50 +00:00
early_printk.c early_printk: consolidate random copies of identical code 2013-04-29 18:28:13 -07:00
efi.c ARM/efi: Apply strict permissions for UEFI Runtime Services regions 2016-04-28 11:33:53 +02:00
elf.c Disintegrate asm/system.h for ARM 2012-03-28 18:30:01 +01:00
entry-armv.S ARM: fix address limit restoration for undefined instructions 2016-08-09 22:57:59 +01:00
entry-common.S arm/syscalls: Check address limit on user-mode return 2017-07-08 14:05:33 +02:00
entry-ftrace.S Revert "arm: move exports to definitions" 2016-11-23 10:00:03 +00:00
entry-header.S ARM: save and reset the address limit when entering an exception 2016-07-07 16:01:01 +01:00
entry-v7m.S ARM: rename S_FRAME_SIZE to PT_REGS_SIZE 2016-06-22 19:54:28 +01:00
fiq.c ARM: convert printk(KERN_* to pr_* 2014-11-21 15:24:50 +00:00
fiqasm.S ARM: convert all "mov.* pc, reg" to "bx reg" for ARMv6+ 2014-07-18 12:29:04 +01:00
ftrace.c Merge branch 'akpm' (patches from Andrew) 2017-05-08 18:17:56 -07:00
head-common.S ARM: convert all "mov.* pc, reg" to "bx reg" for ARMv6+ 2014-07-18 12:29:04 +01:00
head-nommu.S ARM: 8649/2: nommu: remove Hivecs configuration is asm 2017-02-28 11:06:15 +00:00
head.S Revert "arm: move exports to definitions" 2016-11-23 10:00:03 +00:00
hibernate.c ARM: use virt_to_idmap() for soft_restart() 2016-02-08 15:48:32 +00:00
hw_breakpoint.c ARM/hw_breakpoint: Fix possible recursive locking for arch_hw_breakpoint_init 2017-06-20 12:25:22 +02:00
hyp-stub.S ARM: hyp-stub: Fix Thumb-2 compilation 2017-04-20 12:58:53 +02:00
insn.c ARM: fix missing bug.h include in arch/arm/kernel/insn.c 2012-03-30 11:51:46 +01:00
io.c ARM: io.c: clean up EXPORT_SYMBOL()s 2014-11-21 15:25:02 +00:00
irq.c ARM: 8499/1: irq: l2c: do not print error in case of missing l2c from 2016-01-26 23:49:02 +00:00
isa.c arm: convert use of typedef ctl_table to struct ctl_table 2014-06-06 16:08:15 -07:00
iwmmxt.S ARM: 8221/1: PJ4: allow building in Thumb-2 mode 2014-12-03 16:08:00 +00:00
jump_label.c jump_label: Rename JUMP_LABEL_{EN,DIS}ABLE to JUMP_LABEL_{JMP,NOP} 2015-08-03 11:34:12 +02:00
kgdb.c scripts/spelling.txt: add regsiter -> register spelling mistake 2017-05-08 17:15:13 -07:00
machine_kexec.c arm: use set_memory.h header 2017-05-08 17:15:13 -07:00
Makefile Revert "arm: move exports to definitions" 2016-11-23 10:00:03 +00:00
module-plts.c ARM: 8662/1: module: split core and init PLT sections 2017-03-17 10:01:28 +00:00
module.c ARM: Silence first allocation with CONFIG_ARM_MODULE_PLTS=y 2017-05-11 14:43:31 +01:00
module.lds ARM: 8662/1: module: split core and init PLT sections 2017-03-17 10:01:28 +00:00
opcodes.c ARM: 7206/1: Add generic ARM instruction set condition code checks. 2011-12-13 08:52:02 +00:00
paravirt.c arm: introduce CONFIG_PARAVIRT, PARAVIRT_TIME_ACCOUNTING and pv_time_ops 2015-12-21 14:40:54 +00:00
patch.c arm: Prevent hotplug rwsem recursion 2017-05-26 10:10:46 +02:00
perf_callchain.c perf core: Add a 'nr' field to perf_event_callchain_context 2016-05-16 23:11:51 -03:00
perf_event_v6.c arm: perf: use builtin_platform_driver 2017-02-03 18:46:42 +00:00
perf_event_v7.c arm: perf: use builtin_platform_driver 2017-02-03 18:46:42 +00:00
perf_event_xscale.c arm: perf: use builtin_platform_driver 2017-02-03 18:46:42 +00:00
perf_regs.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h> 2017-03-02 08:42:36 +01:00
pj4-cp0.c ARM: 8452/3: PJ4: make coprocessor access sequences buildable in Thumb2 mode 2016-01-04 11:12:10 +00:00
process.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h> 2017-03-02 08:42:36 +01:00
psci_smp.c ARM: use const and __initconst for smp_operations 2015-12-01 22:17:45 +01:00
ptrace.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h> 2017-03-02 08:42:36 +01:00
reboot.c ARM: soft-reboot into same mode that we entered the kernel 2017-04-09 07:49:24 -07:00
reboot.h ARM: move reboot code to arch/arm/kernel/reboot.c 2015-04-02 09:50:45 +01:00
relocate_kernel.S ARM: convert all "mov.* pc, reg" to "bx reg" for ARMv6+ 2014-07-18 12:29:04 +01:00
return_address.c ARM: 8328/1: remove empty preprocessor #else branch 2015-03-28 16:54:53 +00:00
setup.c ARM: 8682/1: V7M: Set cacheid iff DminLine or IminLine is nonzero 2017-06-12 15:47:29 +01:00
signal.c arm/syscalls: Check address limit on user-mode return 2017-07-08 14:05:33 +02:00
sigreturn_codes.S ARM: 7895/1: signal: fix armv7-m build issue in sigreturn_codes.S 2013-11-30 22:21:00 +00:00
sleep.S ARM: fix new BSYM() usage introduced via for-arm-soc branch 2015-06-12 21:19:35 +01:00
smccc-call.S arm: kernel: Add SMC structure parameter 2017-02-03 18:46:33 +00:00
smp_scu.c ARM: 8122/1: smp_scu: enable SCU standby support 2014-08-02 08:51:53 +01:00
smp_tlb.c ARM: 8613/1: Fix the uaccess crash on PB11MPCore 2017-01-16 17:30:46 +00:00
smp_twd.c clocksource/drivers: Rename CLOCKSOURCE_OF_DECLARE to TIMER_OF_DECLARE 2017-06-14 11:58:45 +02:00
smp.c arm: Adjust system_state check 2017-05-23 10:01:35 +02:00
stacktrace.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/debug.h> 2017-03-02 08:42:34 +01:00
suspend.c sched/headers: Prepare to remove the <linux/mm_types.h> dependency from <linux/sched.h> 2017-03-02 08:42:37 +01:00
swp_emulate.c sched/headers: Prepare to remove the <linux/mm_types.h> dependency from <linux/sched.h> 2017-03-02 08:42:37 +01:00
sys_arm.c arm: switch to generic fork/vfork/clone 2012-11-28 22:13:54 -05:00
sys_oabi-compat.c sched/headers: Prepare to remove <linux/cred.h> inclusion from <linux/sched.h> 2017-03-02 08:42:31 +01:00
tcm.c ARM: 8388/1: tcm: Don't crash when TCM banks are protected by TrustZone 2015-06-06 10:37:28 +01:00
thumbee.c ARM: convert printk(KERN_* to pr_* 2014-11-21 15:24:50 +00:00
time.c clocksource/drivers: Rename clocksource_probe to timer_probe 2017-06-14 11:59:16 +02:00
topology.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/topology.h> 2017-03-02 08:42:26 +01:00
traps.c sched/headers: Prepare for new header dependencies before moving code to <linux/sched/task_stack.h> 2017-03-02 08:42:36 +01:00
unwind.c ARM: 8176/1: Use current_stack_pointer in unwind_backtrace 2014-11-13 23:58:09 +00:00
v7m.c ARM: 7828/1: ARMv7-M: implement restart routine common to all v7-M machines 2013-09-02 13:49:29 +01:00
vdso.c Merge branch 'for-linus' of git://git.armlinux.org.uk/~rmk/linux-arm 2016-10-06 07:59:37 -07:00
vmlinux-xip.lds.S debug: Fix __bug_table[] in arch linker scripts 2017-04-03 10:22:40 +02:00
vmlinux.lds.S debug: Fix __bug_table[] in arch linker scripts 2017-04-03 10:22:40 +02:00
xscale-cp0.c ARM: make xscale iwmmxt code multiplatform aware 2015-12-01 21:44:24 +01:00