From: Paul Burton > Sent: 03 December 2019 20:50 > Our FPU emulator currently uses __get_user() & __put_user() to perform > emulated loads & stores. This is problematic because __get_user() & > __put_user() are only suitable for naturally aligned memory accesses, > and the address we're accessing is entirely under the control of > userland. > > This allows userland to cause a kernel panic by simply performing an > unaligned floating point load or store - the kernel will handle the > address error exception by attempting to emulate the instruction, and in > the process it may generate another address error exception itself. > This time the exception is taken with EPC pointing at the kernels FPU > emulation code, and we hit a die_if_kernel() in > emulate_load_store_insn(). Won't this be true of almost all code that uses get_user() and put_user() (with or without the leading __). > Fix this up by using __copy_from_user() instead of __get_user() and > __copy_to_user() instead of __put_user(). These replacements will handle > arbitrary alignment without problems. They'll also kill performance..... David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
