Re: usercopy: kernel memory exposure attempt detected

[Kees Cook]

On Wed, Aug 17, 2016 at 5:13 AM, Geert Uytterhoeven
<geert@xxxxxxxxxxxxxx> wrote:
> Hi Kees, Al,
>
> Saw this when using NFS root on r8a7791/koelsch, using a tree based on
> renesas-drivers-2016-08-16-v4.8-rc2:
>
> usercopy: kernel memory exposure attempt detected from c01ff000
> (<kernel text>) (4096 bytes)

Hmmm, the kernel text exposure on ARM usually means the hardened
usercopy patchset was applied to an ARM tree without the _etext patch:
http://git.kernel.org/linus/14c4a533e0996f95a0a64dfd0b6252d788cebc74

If you _do_ have this patch already (and based on the comment below, I
suspect you do: usually the missing _etext makes the system entirely
unbootable), then we need to dig further.

> ------------[ cut here ]------------
> kernel BUG at mm/usercopy.c:75!
> Internal error: Oops - BUG: 0 [#1] SMP ARM
> Modules linked in:
> CPU: 1 PID: 1636 Comm: exim4 Not tainted
> 4.8.0-rc2-koelsch-00407-g7a4ab698caefa57a-dirty #2901
> Hardware name: Generic R8A7791 (Flattened Device Tree)
> task: eeae7100 task.stack: eeace000
> PC is at __check_object_size+0x2d0/0x390
> LR is at __check_object_size+0x2d0/0x390
> pc : [<c02d33fc>]    lr : [<c02d33fc>]    psr: 600f0013
> sp : eeacfe28  ip : 00000000  fp : c0200000
> r10: b6f9c000  r9 : eeacff0c  r8 : 00000001
> r7 : c0e05444  r6 : c01fffff  r5 : 00001000  r4 : c01ff000
> r3 : 00000001  r2 : 2ed71000  r1 : ef9b43f0  r0 : 0000005c
> Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment user
> Control: 30c5387d  Table: 6dcd62c0  DAC: 55555555
> Process exim4 (pid: 1636, stack limit = 0xeeace210)
> Stack: (0xeeacfe28 to 0xeead0000)
> fe20:                   c095c004 00001000 00000002 ef9fcc80 eeacfe38 00001000
> fe40: c01ff000 00001000 00000000 eeacff14 eeacff0c b6f9c000 ef22d4ac c03eea60
> fe60: 00000001 00000000 00000000 ee78bf00 eeacff28 ef9fcfe0 00001000 c029c914
> fe80: 00000004 00000001 00000000 eeacff14 00000000 ef22d3b8 00001000 00000000
> fea0: ee78bf88 00000002 ef22d3b8 c06afb3c 00000000 c038a9c8 c0c4b780 c02a0cd8
> fec0: effce060 eeacff28 ef22d3b8 00000000 eeacff14 c0206ce4 eeace000 00000000
> fee0: 00000000 c0387698 c0387644 00000000 ee78bf00 eeacff88 00001000 c02d5550
> ff00: 00001000 c06afb3c 00000001 b6f9c000 00001000 00000000 00000000 00001000
> ff20: eeacff0c 00000001 ee78bf00 00000000 00001000 00000000 00000000 00000000
> ff40: 00000000 00000000 ef365e38 00001000 ee78bf00 b6f9c000 eeacff88 c02d6080
> ff60: ee78bf00 b6f9c000 00001000 ee78bf00 ee78bf00 00001000 b6f9c000 c0206ce4
> ff80: eeace000 c02d6cd8 00001000 00000000 00001000 7f723250 b6c2bbfc 00003fdf
> ffa0: 00000003 c0206b40 7f723250 b6c2bbfc 00000004 b6f9c000 00001000 00000000
> ffc0: 7f723250 b6c2bbfc 00003fdf 00000003 7f71efdf 0000000a 7f71efc0 00000000
> ffe0: 00000000 be80f4ac b6b90817 b6bcadd6 400f0030 00000004 30133e52 60547340
> [<c02d33fc>] (__check_object_size) from [<c03eea60>]
> (copy_page_to_iter+0x114/0x1f0)
> [<c03eea60>] (copy_page_to_iter) from [<c029c914>]
> (generic_file_read_iter+0x3a0/0x7e8)
> [<c029c914>] (generic_file_read_iter) from [<c0387698>]
> (nfs_file_read+0x54/0x98)
> [<c0387698>] (nfs_file_read) from [<c02d5550>] (__vfs_read+0xdc/0x104)
> [<c02d5550>] (__vfs_read) from [<c02d6080>] (vfs_read+0x94/0x100)
> [<c02d6080>] (vfs_read) from [<c02d6cd8>] (SyS_read+0x40/0x80)
> [<c02d6cd8>] (SyS_read) from [<c0206b40>] (ret_fast_syscall+0x0/0x34)
> Code: e88d0021 e1a03004 e59f00b0 ebff176b (e7f001f2)
>
> Despite the BUG(), the system continues working.

I assume exim4 got killed, though?

If you can figure out what bytes are present at c01ff000, that may
give us a clue.

-Kees

>
> Gr{oetje,eeting}s,
>
>                         Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx
>
> In personal conversations with technical people, I call myself a hacker. But
> when I'm talking to journalists I just say "programmer" or something like that.
>                                 -- Linus Torvalds



-- 
Kees Cook
Nexus Security