1 files changed, 39 insertions, 10 deletions

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 887f11bcf330..b5d3578d9f65 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -44,6 +44,7 @@
 #include <asm/mmu_context.h>
 #include <asm/siginfo.h>
 #include <asm/debug.h>
+#include <asm/kup.h>
 
 static inline bool notify_page_fault(struct pt_regs *regs)
 {
@@ -223,19 +224,46 @@ static int mm_fault_error(struct pt_regs *regs, unsigned long addr,
 }
 
 /* Is this a bad kernel fault ? */
-static bool bad_kernel_fault(bool is_exec, unsigned long error_code,
-                             unsigned long address)
+static bool bad_kernel_fault(struct pt_regs *regs, unsigned long error_code,
+                             unsigned long address, bool is_write)
 {
+        int is_exec = TRAP(regs) == 0x400;
+
         /* NX faults set DSISR_PROTFAULT on the 8xx, DSISR_NOEXEC_OR_G on others */
         if (is_exec && (error_code & (DSISR_NOEXEC_OR_G | DSISR_KEYFAULT |
                                       DSISR_PROTFAULT))) {
-                printk_ratelimited(KERN_CRIT "kernel tried to execute"
-                                   " exec-protected page (%lx) -"
-                                   "exploit attempt? (uid: %d)\n",
-                                   address, from_kuid(&init_user_ns,
-                                                      current_uid()));
+                pr_crit_ratelimited("kernel tried to execute %s page (%lx) - exploit attempt? (uid: %d)\n",
+                                    address >= TASK_SIZE ? "exec-protected" : "user",
+                                    address,
+                                    from_kuid(&init_user_ns, current_uid()));
+
+                // Kernel exec fault is always bad
+                return true;
         }
-        return is_exec || (address >= TASK_SIZE);
+
+        if (!is_exec && address < TASK_SIZE && (error_code & DSISR_PROTFAULT) &&
+            !search_exception_tables(regs->nip)) {
+                pr_crit_ratelimited("Kernel attempted to access user page (%lx) - exploit attempt? (uid: %d)\n",
+                                    address,
+                                    from_kuid(&init_user_ns, current_uid()));
+        }
+
+        // Kernel fault on kernel address is bad
+        if (address >= TASK_SIZE)
+                return true;
+
+        // Fault on user outside of certain regions (eg. copy_tofrom_user()) is bad
+        if (!search_exception_tables(regs->nip))
+                return true;
+
+        // Read/write fault in a valid region (the exception table search passed
+        // above), but blocked by KUAP is bad, it can never succeed.
+        if (bad_kuap_fault(regs, is_write))
+                return true;
+
+        // What's left? Kernel fault on user in well defined regions (extable
+        // matched), and allowed by KUAP in the faulting context.
+        return false;
 }
 
 static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address,
@@ -455,9 +483,10 @@ static int __do_page_fault(struct pt_regs *regs, unsigned long address,
 
         /*
          * The kernel should never take an execute fault nor should it
-         * take a page fault to a kernel address.
+         * take a page fault to a kernel address or a page fault to a user
+         * address outside of dedicated places
          */
-        if (unlikely(!is_user && bad_kernel_fault(is_exec, error_code, address)))
+        if (unlikely(!is_user && bad_kernel_fault(regs, error_code, address, is_write)))
                 return SIGSEGV;
 
         /*