ARM: software-based priviledged-no-access support

Provide a software-based implementation of the priviledged no access
support found in ARMv8.1.

Userspace pages are mapped using a different domain number from the
kernel and IO mappings.  If we switch the user domain to "no access"
when we enter the kernel, we can prevent the kernel from touching
userspace.

However, the kernel needs to be able to access userspace via the
various user accessor functions.  With the wrapping in the previous
patch, we can temporarily enable access when the kernel needs user
access, and re-disable it afterwards.

This allows us to trap non-intended accesses to userspace, eg, caused
by an inadvertent dereference of the LIST_POISON* values, which, with
appropriate user mappings setup, can be made to succeed.  This in turn
can allow use-after-free bugs to be further exploited than would
otherwise be possible.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

1 files changed, 30 insertions, 6 deletions

diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index e722f9b3c9b1..3f18098dfd08 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -129,12 +129,36 @@ void __show_regs(struct pt_regs *regs)
         buf[4] = '\0';
 
 #ifndef CONFIG_CPU_V7M
-        printk("Flags: %s  IRQs o%s  FIQs o%s  Mode %s  ISA %s  Segment %s\n",
-                buf, interrupts_enabled(regs) ? "n" : "ff",
-                fast_interrupts_enabled(regs) ? "n" : "ff",
-                processor_modes[processor_mode(regs)],
-                isa_modes[isa_mode(regs)],
-                get_fs() == get_ds() ? "kernel" : "user");
+        {
+                unsigned int domain = get_domain();
+                const char *segment;
+
+#ifdef CONFIG_CPU_SW_DOMAIN_PAN
+                /*
+                 * Get the domain register for the parent context. In user
+                 * mode, we don't save the DACR, so lets use what it should
+                 * be. For other modes, we place it after the pt_regs struct.
+                 */
+                if (user_mode(regs))
+                        domain = DACR_UACCESS_ENABLE;
+                else
+                        domain = *(unsigned int *)(regs + 1);
+#endif
+
+                if ((domain & domain_mask(DOMAIN_USER)) ==
+                    domain_val(DOMAIN_USER, DOMAIN_NOACCESS))
+                        segment = "none";
+                else if (get_fs() == get_ds())
+                        segment = "kernel";
+                else
+                        segment = "user";
+
+                printk("Flags: %s  IRQs o%s  FIQs o%s  Mode %s  ISA %s  Segment %s\n",
+                        buf, interrupts_enabled(regs) ? "n" : "ff",
+                        fast_interrupts_enabled(regs) ? "n" : "ff",
+                        processor_modes[processor_mode(regs)],
+                        isa_modes[isa_mode(regs)], segment);
+        }
 #else
         printk("xPSR: %08lx\n", regs->ARM_cpsr);
 #endif