Arm Linux Kernel Hacks

Quite interesting patch was released under the following url.

https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?h=rel/msm-3.18&id=a0039b1e721b7b3ee1cbe7f7f9d44d451ac74543

The detailed patch is to initialize the stack array with a different way as below.

-------------------------------------------------------------------------------------

usb : dwc3: Initialize kernel stack variables properly

If kernel stack variables are not initialized properly,

there  is a chance of kernel information disclosure.

So, initialize kernel stack variables with null characters.

-rw-r--r-- drivers/usb/dwc3/debugfs.c 10

1 files changed, 4 insertions, 6 deletions

diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c

index ce7cd96..fb252ec 100644

--- a/drivers/usb/dwc3/debugfs.c

+++ b/drivers/usb/dwc3/debugfs.c

@@ -402,7 +402,7 @@ static ssize_t dwc3_mode_write(struct file *file,

  struct dwc3 *dwc = s->private;

  unsigned long flags;

  u32 mode = 0;

- char buf[32];

+ char buf[32] = {0};

  if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))

  return -EFAULT;

@@ -482,7 +482,7 @@ static ssize_t dwc3_testmode_write(struct file *file,

  struct dwc3 *dwc = s->private;

  unsigned long flags;

  u32 testmode = 0;

- char buf[32];

+ char buf[32] = {0};

  if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))

  return -EFAULT;

@@ -589,7 +589,7 @@ static ssize_t dwc3_link_state_write(struct file *file,

  struct dwc3 *dwc = s->private;

  unsigned long flags;

  enum dwc3_link_state state = 0;

- char buf[32];

+ char buf[32] = {0};

  if (copy_from_user(&buf, ubuf, min_t(size_t, sizeof(buf) - 1, count)))

  return -EFAULT;

@@ -630,12 +630,10 @@ static ssize_t dwc3_store_ep_num(struct file *file, const char __user *ubuf,

 {

  struct seq_file *s = file->private_data;

  struct dwc3 *dwc = s->private;

- char kbuf[10];

+ char kbuf[10] = {0};

  unsigned int num, dir, temp;

  unsigned long flags;

- memset(kbuf, 0, 10);

-

  if (copy_from_user(kbuf, ubuf, count > 10 ? 10 : count))

  return -EFAULT;

-------------------------------------------------------------------------------------

In order to find out how the assemble code is updated after compling the patch-set, let me walk through more within dwc3_mode_write() .

The interesting debug information inside updated assemble code after "char buf[32] = {0};" is declared is that memset is appended by ARM-GCC compiler

[1]: R1 is updated as 0x0.

[2]: R2 is updated as 32 in decimal format.

[3]: R0 is belonging to stack memory area.

[4]: Call to memset is made.

memset(R0: buf, R1: 0x0, R2: 32)

[After]

  static ssize_t dwc3_mode_write(struct file *file,

                  const char __user *ubuf, size_t count, loff_t *ppos)

  {

 c0629d9c:       e1a0c00d        mov     ip, sp

 c0629da0:       e92ddbf0        push    {r4, r5, r6, r7, r8, r9, fp, ip, lr, pc}

 c0629da4:       e24cb004        sub     fp, ip, #4

 c0629da8:       e24dd028        sub     sp, sp, #40     ; 0x28

 c0629dac:       e52de004        push    {lr}            ; (str lr, [sp, #-4]!)

 c0629db0:       ebe7958c        bl      c000f3e8 <__gnu_mcount_nc>

 c0629db4:       e59f7130        ldr     r7, [pc, #304]  ; c0629eec <dwc3_mode_write+0x150>

 c0629db8:       e1a04001        mov     r4, r1

 c0629dbc:       e1a05002        mov     r5, r2

 c0629dc0:       e3a01000        mov     r1, #0  //<<--[1]

 c0629dc4:       e3a02020        mov     r2, #32  //<<--[2]

 c0629dc8:       e5973000        ldr     r3, [r7]

 c0629dcc:       e50b3028        str     r3, [fp, #-40]  ; 0xffffffd8

 c0629dd0:       e59030bc        ldr     r3, [r0, #188]  ; 0xbc

 c0629dd4:       e24b0048        sub     r0, fp, #72     ; 0x48  //<<--[3]

 c0629dd8:       e5936060        ldr     r6, [r3, #96]   ; 0x60    

 c0629ddc:       ebf2ec6f        bl      c02e4fa0 <memset>        //<<--[4]  

 c0629de0:       e1a0200d        mov     r2, sp                    

 c0629de4:       e3c21d7f        bic     r1, r2, #8128   ; 0x1fc0

[Before]

[1]: Assemble code before the patch is applied, the stack memory location mapped to buf[32] is saved into R0 without initilization.

 static ssize_t dwc3_mode_write(struct file *file,

                 const char __user *ubuf, size_t count, loff_t *ppos)

 {

 c0629d9c:       e1a0c00d        mov     ip, sp

 c0629da0:       e92ddbf0        push    {r4, r5, r6, r7, r8, r9, fp, ip, lr, pc}

 c0629da4:       e24cb004        sub     fp, ip, #4

 c0629da8:       e24dd028        sub     sp, sp, #40     ; 0x28

 c0629dac:       e52de004        push    {lr}            ; (str lr, [sp, #-4]!)

 c0629db0:       ebe7958c        bl      c000f3e8 <__gnu_mcount_nc>

 c0629db4:       e1a05002        mov     r5, r2

//.. skip ,,

 c0629dfc:       1a000005        bne     c0629e18 <dwc3_mode_write+0x7c>

 c0629e00:       e24b0048        sub     r0, fp, #72     ; 0x48  //<<--[1]

 c0629e04:       e1a02003        mov     r2, r3

 c0629e08:       ebf2e301        bl      c02e2a14 <__copy_from_user>

 c0629e0c:       e3500000        cmp     r0, #0

Let me make it a rule to initialize the stack array like char kbuf[10] = {0}; instead of char kbuf[10];