On Thu, Sep 29, 2016 at 3:44 PM, Sami Tolvanen [off-list ref] wrote:

On Thu, Sep 15, 2016 at 05:20:45PM +0100, Mark Rutland wrote:

quoted

Likewise, how do we handle __flush_cache_user_range and
flush_icache_range? Some callers (e.g. __do_compat_cache_op) pass in
__user addresses.

Also EXEC_USERSPACE in lkdtm passes a user space address to flush_icache_range
and causes the process to hang when I tested these patches on HiKey.

Adding uaccess_{enable,disable}_not_uao to __flush_cache_user_range appears to
fix the problem.

I had a thought just now on this: is lkdtm maybe doing the wrong thing
here? i.e. should lkdtm be the one do to the uaccess_en/disable
instead of flush_icache_range() itself, since it's the one abusing the
API?

-Kees

-- 
Kees Cook
Nexus Security