From patchwork Tue Jul 16 17:08:24 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Benjamin M Romer X-Patchwork-Id: 1132882 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 45p6LD10k3z9sNC; Wed, 17 Jul 2019 03:08:35 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1hnQwI-0007T6-9X; Tue, 16 Jul 2019 17:08:30 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.86_2) (envelope-from ) id 1hnQwG-0007SE-8C for kernel-team@lists.ubuntu.com; Tue, 16 Jul 2019 17:08:28 +0000 Received: from mail-qt1-f198.google.com ([209.85.160.198]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1hnQwF-0002XP-Ro for kernel-team@lists.ubuntu.com; Tue, 16 Jul 2019 17:08:27 +0000 Received: by mail-qt1-f198.google.com with SMTP id l9so18581816qtu.12 for ; Tue, 16 Jul 2019 10:08:27 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=ADUbAAHUbY5R2NDPRhNjcJnfx7V4sLOi7hbpXl8++Eg=; b=PBl8TwZ5BmBWmr7GiPwkkvR+pg0ZpQSmYRf/k5OT3xlZ+4e2tQc0+9bkacm+8P99lL 1MDHh/w4UNqyrZhXLlliNkL5djt0F03jL7XVXs7Mt451dFzwFiUyZrO38dK6sQutplCL veTodOm5Tu3KsZHERb0co4PZs+h4MKHhsSJckuPOScOPiv0vM1vPkVb6U3C/80B99nYV Ko2/syjhUB+3d4rgesXOTnOXzZ7rfIOCVw3dkaCiZruGEnfwL069ReRYh2xXAFXNr9kV 9i2ulCpUI/8/PZeunAjlu6SqspqAbrei+qXcReigN7i5y2fSFsyd9vbnSLUtZ+Ay43hx 8f5Q== X-Gm-Message-State: APjAAAWEJdR5klkosICTONf3WrOS31L8Z1Iw5QrBGOrPXOgj7HT56ooZ kWgsrBaicE8Y/Bl/JDARN/fsxl+bxPImfWSUU7ax4drqEQ6ok03M68yAi6G3QM8s7blPd6MC/ee mHHcK75NaVXVHMIyTvalX18tfitlZJshMJIvIUI1gLw== X-Received: by 2002:a0c:becb:: with SMTP id f11mr14122926qvj.33.1563296906790; Tue, 16 Jul 2019 10:08:26 -0700 (PDT) X-Google-Smtp-Source: APXvYqzxYDxnJZH3voQYxIZUbMZzkJznhivuEIs1w68rT9Lu4rsMRKCAqtRKxqoguWpsyZruCXGVAQ== X-Received: by 2002:a0c:becb:: with SMTP id f11mr14122902qvj.33.1563296906467; Tue, 16 Jul 2019 10:08:26 -0700 (PDT) Received: from beast (c-68-80-13-9.hsd1.pa.comcast.net. [68.80.13.9]) by smtp.gmail.com with ESMTPSA id b7sm9453789qtt.38.2019.07.16.10.08.25 for (version=TLS1_3 cipher=AEAD-AES256-GCM-SHA384 bits=256/256); Tue, 16 Jul 2019 10:08:25 -0700 (PDT) Received: from ben by beast with local (Exim 4.92) (envelope-from ) id 1hnQwC-00088d-Mq for kernel-team@lists.ubuntu.com; Tue, 16 Jul 2019 13:08:24 -0400 From: Benjamin M Romer To: kernel-team@lists.ubuntu.com Subject: [[b, c, d] [any]][PATCH 1/1] x86/insn-eval: Fix use-after-free access to LDT entry Date: Tue, 16 Jul 2019 13:08:24 -0400 Message-Id: <20190716170824.31242-2-benjamin.romer@canonical.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190716170824.31242-1-benjamin.romer@canonical.com> References: <20190716170824.31242-1-benjamin.romer@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jann Horn get_desc() computes a pointer into the LDT while holding a lock that protects the LDT from being freed, but then drops the lock and returns the (now potentially dangling) pointer to its caller. Fix it by giving the caller a copy of the LDT entry instead. Fixes: 670f928ba09b ("x86/insn-eval: Add utility function to get segment descriptor") Cc: stable@vger.kernel.org Signed-off-by: Jann Horn Signed-off-by: Linus Torvalds (cherry picked from commit de9f869616dd95e95c00bdd6b0fcd3421e8a4323) CVE-2019-13233 Signed-off-by: Benjamin M Romer Acked-by: Connor Kuehl Acked-by: Stefan Bader --- arch/x86/lib/insn-eval.c | 47 ++++++++++++++++++++-------------------- 1 file changed, 24 insertions(+), 23 deletions(-) diff --git a/arch/x86/lib/insn-eval.c b/arch/x86/lib/insn-eval.c index 9119d8e41f1f..87dcba101e56 100644 --- a/arch/x86/lib/insn-eval.c +++ b/arch/x86/lib/insn-eval.c @@ -555,7 +555,8 @@ static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs, } /** - * get_desc() - Obtain pointer to a segment descriptor + * get_desc() - Obtain contents of a segment descriptor + * @out: Segment descriptor contents on success * @sel: Segment selector * * Given a segment selector, obtain a pointer to the segment descriptor. @@ -563,18 +564,18 @@ static int get_reg_offset_16(struct insn *insn, struct pt_regs *regs, * * Returns: * - * Pointer to segment descriptor on success. + * True on success, false on failure. * * NULL on error. */ -static struct desc_struct *get_desc(unsigned short sel) +static bool get_desc(struct desc_struct *out, unsigned short sel) { struct desc_ptr gdt_desc = {0, 0}; unsigned long desc_base; #ifdef CONFIG_MODIFY_LDT_SYSCALL if ((sel & SEGMENT_TI_MASK) == SEGMENT_LDT) { - struct desc_struct *desc = NULL; + bool success = false; struct ldt_struct *ldt; /* Bits [15:3] contain the index of the desired entry. */ @@ -582,12 +583,14 @@ static struct desc_struct *get_desc(unsigned short sel) mutex_lock(¤t->active_mm->context.lock); ldt = current->active_mm->context.ldt; - if (ldt && sel < ldt->nr_entries) - desc = &ldt->entries[sel]; + if (ldt && sel < ldt->nr_entries) { + *out = ldt->entries[sel]; + success = true; + } mutex_unlock(¤t->active_mm->context.lock); - return desc; + return success; } #endif native_store_gdt(&gdt_desc); @@ -602,9 +605,10 @@ static struct desc_struct *get_desc(unsigned short sel) desc_base = sel & ~(SEGMENT_RPL_MASK | SEGMENT_TI_MASK); if (desc_base > gdt_desc.size) - return NULL; + return false; - return (struct desc_struct *)(gdt_desc.address + desc_base); + *out = *(struct desc_struct *)(gdt_desc.address + desc_base); + return true; } /** @@ -626,7 +630,7 @@ static struct desc_struct *get_desc(unsigned short sel) */ unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx) { - struct desc_struct *desc; + struct desc_struct desc; short sel; sel = get_segment_selector(regs, seg_reg_idx); @@ -664,11 +668,10 @@ unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx) if (!sel) return -1L; - desc = get_desc(sel); - if (!desc) + if (!get_desc(&desc, sel)) return -1L; - return get_desc_base(desc); + return get_desc_base(&desc); } /** @@ -690,7 +693,7 @@ unsigned long insn_get_seg_base(struct pt_regs *regs, int seg_reg_idx) */ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx) { - struct desc_struct *desc; + struct desc_struct desc; unsigned long limit; short sel; @@ -704,8 +707,7 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx) if (!sel) return 0; - desc = get_desc(sel); - if (!desc) + if (!get_desc(&desc, sel)) return 0; /* @@ -714,8 +716,8 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx) * not tested when checking the segment limits. In practice, * this means that the segment ends in (limit << 12) + 0xfff. */ - limit = get_desc_limit(desc); - if (desc->g) + limit = get_desc_limit(&desc); + if (desc.g) limit = (limit << 12) + 0xfff; return limit; @@ -739,7 +741,7 @@ static unsigned long get_seg_limit(struct pt_regs *regs, int seg_reg_idx) */ int insn_get_code_seg_params(struct pt_regs *regs) { - struct desc_struct *desc; + struct desc_struct desc; short sel; if (v8086_mode(regs)) @@ -750,8 +752,7 @@ int insn_get_code_seg_params(struct pt_regs *regs) if (sel < 0) return sel; - desc = get_desc(sel); - if (!desc) + if (!get_desc(&desc, sel)) return -EINVAL; /* @@ -759,10 +760,10 @@ int insn_get_code_seg_params(struct pt_regs *regs) * determines whether a segment contains data or code. If this is a data * segment, return error. */ - if (!(desc->type & BIT(3))) + if (!(desc.type & BIT(3))) return -EINVAL; - switch ((desc->l << 1) | desc->d) { + switch ((desc.l << 1) | desc.d) { case 0: /* * Legacy mode. CS.L=0, CS.D=0. Address and operand size are * both 16-bit.