DF-4147 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 | --- a/sys/dev/misc/cuse/cuse.c +++ b/sys/dev/misc/cuse/cuse.c @@ -52,6 +52,9 @@ #include <vm/vm.h> #include <vm/pmap.h> +#include <vm/vm_map.h> +#include <vm/vm_extern.h> +#include <vm/vm_kern.h> #include <vm/vm_object.h> #include <vm/vm_page.h> #include <vm/vm_pager.h> @@ -877,17 +880,86 @@ return (error); } +/* + * Copy between the current process and another process's USER address + * space. The peer address (uio_offset) belongs to the target process + * and must never be used as a raw kernel pointer: copyin()/copyout() + * only validate their user-side argument, so passing the peer address as + * the kernel side turns a server-chosen peer_ptr into an arbitrary + * kernel read/write primitive (DF-4147). + * + * Walk the target's vm map page-by-page through a temporary kernel + * mapping, exactly like procfs_rwmem() (sys/vfs/procfs/procfs_mem.c). + * Unmapped or kernel addresses fail with EFAULT. + */ static int proc_rwmem_dfly(struct proc *p, struct uio *uio) { - struct iovec *iov = uio->uio_iov; - int error = 0; + struct vmspace *vm; + vm_map_t map; + vm_offset_t kva; + vm_offset_t uva; + vm_prot_t reqprot; + int error; + int writing; + int busy; + vm_page_t m; - if (uio->uio_rw == UIO_WRITE) { - error = copyin(iov->iov_base, (void *)uio->uio_offset, iov->iov_len); - } else { - error = copyout((void *)uio->uio_offset, iov->iov_base, iov->iov_len); - } + if (uio->uio_resid == 0) + return (0); + + uva = (vm_offset_t)uio->uio_offset; + + /* the peer address must be a user address of the target process */ + if (uva >= VM_MAX_USER_ADDRESS || + uva + uio->uio_resid > VM_MAX_USER_ADDRESS || + uva + uio->uio_resid < uva) + return (EFAULT); + + if (p->p_stat == SIDL || p->p_stat == SZOMB) + return (EFAULT); + if (p->p_flags & (P_WEXIT | P_INEXEC)) + return (EFAULT); + + vm = p->p_vmspace; + if (vmspace_getrefs(vm) < 0) + return (EFAULT); + vmspace_hold(vm); + map = &vm->vm_map; + + writing = (uio->uio_rw == UIO_WRITE); + reqprot = VM_PROT_READ; + if (writing) + reqprot |= VM_PROT_WRITE | VM_PROT_OVERRIDE_WRITE; + + kva = kmem_alloc_pageable(kernel_map, PAGE_SIZE, VM_SUBSYS_PROC); + error = 0; + + do { + vm_offset_t page_off = uva - trunc_page(uva); + size_t len = szmin(PAGE_SIZE - page_off, uio->uio_resid); + + m = vm_fault_page(map, trunc_page(uva), reqprot, + VM_FAULT_NORMAL, &error, &busy); + if (error) { + KKASSERT(m == NULL); + error = EFAULT; + break; + } + pmap_kenter_quick(kva, VM_PAGE_TO_PHYS(m)); + error = uiomove((caddr_t)(kva + page_off), len, uio); + pmap_kremove_quick(kva); + + if (busy) + vm_page_wakeup(m); + else + vm_page_unhold(m); + + uva = (vm_offset_t)uio->uio_offset; + } while (error == 0 && uio->uio_resid > 0); + + vmspace_drop(vm); + kmem_free(kernel_map, kva, PAGE_SIZE); return error; } |