android: fiq_debugger: restrict access to critical commands.
Mark Salyzyn [Mon, 27 Feb 2017 09:13:25 +0000 (14:13 +0530)]
Sysrq must be enabled via /proc/sys/kernel/sysrq as a security
measure to enable various critical fiq debugger commands that
either leak information or can be used as a system attack.

Default disabled, this will leave the reboot, reset, irqs, sleep,
nosleep, console and ps commands.  Reboot and reset commands
will be restricted from taking any parameters.  We will also
switch to showing the limited command set in this mode.

CVE-2017-0510 A-32402555
Bug 1880704

Signed-off-by: Mark Salyzyn <salyzyn@google.com>
Bug: 32402555
Change-Id: I3f74b1ff5e4971d619bcb37a911fed68fbb538d5
Signed-off-by: Gagan Grover <ggrover@nvidia.com>
Reviewed-on: http://git-master/r/1311806
(cherry picked from commit a079fb27cbb54535e3aa68429d3928dc3d1d8b5b)
Reviewed-on: http://git-master/r/1330545
Reviewed-by: Manish Tuteja <mtuteja@nvidia.com>

drivers/staging/android/fiq_debugger/fiq_debugger.c
drivers/tty/sysrq.c
include/linux/sysrq.h

index 09bd692..1a309c9 100644 (file)
@@ -31,6 +31,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/smp.h>
+#include <linux/sysrq.h>
 #include <linux/timer.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
@@ -409,7 +410,7 @@ static void fiq_debugger_work(struct work_struct *work)
                cmd += 6;
                while (*cmd == ' ')
                        cmd++;
-               if (cmd != '\0')
+               if ((cmd != '\0') && sysrq_on())
                        kernel_restart(cmd);
                else
                        kernel_restart(NULL);
@@ -440,25 +441,33 @@ static void fiq_debugger_help(struct fiq_debugger_state *state)
 {
 #define        P(s)    fiq_debugger_printf(&state->output, s)
        P("FIQ Debugger commands:\n");
-       P(" pc            PC status\n");
-       P(" regs          Register dump\n");
-       P(" allregs       Extended Register dump\n");
-       P(" bt            Stack trace\n");
-       P(" reboot [<c>]  Reboot with command <c>\n");
-       P(" reset [<c>]   Hard reset with command <c>\n");
-       P(" irqs          Interupt status\n");
-       P(" kmsg          Kernel log\n");
-       P(" version       Kernel version\n");
+       if (sysrq_on()) {
+               P(" pc            PC status\n");
+               P(" regs          Register dump\n");
+               P(" allregs       Extended Register dump\n");
+               P(" bt            Stack trace\n");
+               P(" reboot [<c>]  Reboot with command <c>\n");
+               P(" reset [<c>]   Hard reset with command <c>\n");
+               P(" irqs          Interupt status\n");
+               P(" kmsg          Kernel log\n");
+               P(" version       Kernel version\n");
+               P(" cpu           Current CPU\n");
+               P(" cpu <number>  Switch to CPU<number>\n");
+               P(" sysrq         sysrq options\n");
+               P(" sysrq <param> Execute sysrq with <param>\n");
+       } else {
+               P(" reboot        Reboot\n");
+               P(" reset         Hard reset\n");
+               P(" irqs          Interrupt status\n");
+       }
        P(" sleep         Allow sleep while in FIQ\n");
        P(" nosleep       Disable sleep while in FIQ\n");
        P(" console       Switch terminal to console\n");
-       P(" cpu           Current CPU\n");
-       P(" cpu <number>  Switch to CPU<number>\n");
        P(" ps            Process list\n");
-       P(" sysrq         sysrq options\n");
-       P(" sysrq <param> Execute sysrq with <param>\n");
 #ifdef CONFIG_KGDB
-       P(" kgdb          Enter kernel debugger\n");
+       if (fiq_kgdb_enable) {
+               P(" kgdb          Enter kernel debugger\n");
+       }
 #endif
 #undef P(s)
 }
@@ -491,18 +500,23 @@ static bool fiq_debugger_fiq_exec(struct fiq_debugger_state *state,
        if (!strcmp(cmd, "help") || !strcmp(cmd, "?")) {
                fiq_debugger_help(state);
        } else if (!strcmp(cmd, "pc")) {
-               fiq_debugger_dump_pc(&state->output, regs);
+               if (sysrq_on())
+                       fiq_debugger_dump_pc(&state->output, regs);
        } else if (!strcmp(cmd, "regs")) {
-               fiq_debugger_dump_regs(&state->output, regs);
+               if (sysrq_on())
+                       fiq_debugger_dump_regs(&state->output, regs);
        } else if (!strcmp(cmd, "allregs")) {
-               fiq_debugger_dump_allregs(&state->output, regs);
+               if (sysrq_on())
+                       fiq_debugger_dump_allregs(&state->output, regs);
        } else if (!strcmp(cmd, "bt")) {
-               fiq_debugger_dump_stacktrace(&state->output, regs, 100, svc_sp);
+               if (sysrq_on())
+                       fiq_debugger_dump_stacktrace(&state->output, regs,
+                                       100, svc_sp);
        } else if (!strncmp(cmd, "reset", 5)) {
                cmd += 5;
                while (*cmd == ' ')
                        cmd++;
-               if (*cmd) {
+               if (*cmd && sysrq_on()) {
                        char tmp_cmd[32];
                        strlcpy(tmp_cmd, cmd, sizeof(tmp_cmd));
                        machine_restart(tmp_cmd);
@@ -512,9 +526,12 @@ static bool fiq_debugger_fiq_exec(struct fiq_debugger_state *state,
        } else if (!strcmp(cmd, "irqs")) {
                fiq_debugger_dump_irqs(state);
        } else if (!strcmp(cmd, "kmsg")) {
-               fiq_debugger_dump_kernel_log(state);
+               if (sysrq_on())
+                       fiq_debugger_dump_kernel_log(state);
        } else if (!strcmp(cmd, "version")) {
-               fiq_debugger_printf(&state->output, "%s\n", linux_banner);
+               if (sysrq_on())
+                       fiq_debugger_printf(&state->output, "%s\n",
+                               linux_banner);
        } else if (!strcmp(cmd, "sleep")) {
                state->no_sleep = false;
                fiq_debugger_printf(&state->output, "enabling sleep\n");
@@ -526,14 +543,17 @@ static bool fiq_debugger_fiq_exec(struct fiq_debugger_state *state,
                fiq_debugger_uart_flush(state);
                state->console_enable = true;
        } else if (!strcmp(cmd, "cpu")) {
-               fiq_debugger_printf(&state->output, "cpu %d\n", state->current_cpu);
-       } else if (!strncmp(cmd, "cpu ", 4)) {
+               if (sysrq_on())
+                       fiq_debugger_printf(&state->output, "cpu %d\n",
+                               state->current_cpu);
+       } else if (!strncmp(cmd, "cpu ", 4) && sysrq_on()) {
                unsigned long cpu = 0;
                if (strict_strtoul(cmd + 4, 10, &cpu) == 0)
                        fiq_debugger_switch_cpu(state, cpu);
                else
                        fiq_debugger_printf(&state->output, "invalid cpu\n");
-               fiq_debugger_printf(&state->output, "cpu %d\n", state->current_cpu);
+               fiq_debugger_printf(&state->output, "cpu %d\n",
+                               state->current_cpu);
        } else {
                if (state->debug_busy) {
                        fiq_debugger_printf(&state->output,
index b51c154..08c9406 100644 (file)
@@ -55,10 +55,11 @@ static bool __read_mostly sysrq_always_enabled;
 unsigned short platform_sysrq_reset_seq[] __weak = { KEY_RESERVED };
 int sysrq_reset_downtime_ms __weak;
 
-static bool sysrq_on(void)
+bool sysrq_on(void)
 {
        return sysrq_enabled || sysrq_always_enabled;
 }
+EXPORT_SYMBOL(sysrq_on);
 
 /*
  * A value of 1 means 'all', other nonzero values are an op mask:
index 7faf933..5a0bd93 100644 (file)
@@ -45,6 +45,7 @@ struct sysrq_key_op {
  * are available -- else NULL's).
  */
 
+bool sysrq_on(void);
 void handle_sysrq(int key);
 void __handle_sysrq(int key, bool check_mask);
 int register_sysrq_key(int key, struct sysrq_key_op *op);