diff options
| author | Eric Lin <tesheng@andestech.com> | 2020-12-04 06:42:59 +0100 |
|---|---|---|
| committer | Palmer Dabbelt <palmerdabbelt@google.com> | 2021-01-08 02:19:19 +0100 |
| commit | 21855cac82d3264aa660deafa9c26b8eef548b7a (patch) | |
| tree | 394a5c31efdb214467a3988bb9292cd46ff69b36 /arch/riscv/mm | |
| parent | riscv/mm: Introduce a die_kernel_fault() helper function (diff) | |
| download | linux-21855cac82d3264aa660deafa9c26b8eef548b7a.tar.xz linux-21855cac82d3264aa660deafa9c26b8eef548b7a.zip | |
riscv/mm: Prevent kernel module to access user memory without uaccess routines
We found this issue in an legacy out-of-tree kernel module
which didn't properly access user space pointer by get/put_user().
Such an illegal access loops in the page fault handler.
To resolve this, let it die here.
Signed-off-by: Eric Lin <tesheng@andestech.com>
Reviewed-by: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Diffstat (limited to 'arch/riscv/mm')
| -rw-r--r-- | arch/riscv/mm/fault.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/arch/riscv/mm/fault.c b/arch/riscv/mm/fault.c index 0d5f06d6e3c7..33d284188f9a 100644 --- a/arch/riscv/mm/fault.c +++ b/arch/riscv/mm/fault.c @@ -243,6 +243,11 @@ asmlinkage void do_page_fault(struct pt_regs *regs) if (user_mode(regs)) flags |= FAULT_FLAG_USER; + if (!user_mode(regs) && addr < TASK_SIZE && + unlikely(!(regs->status & SR_SUM))) + die_kernel_fault("access to user memory without uaccess routines", + addr, regs); + perf_sw_event(PERF_COUNT_SW_PAGE_FAULTS, 1, regs, addr); if (cause == EXC_STORE_PAGE_FAULT) |