lkdtm/usercopy: Moves the KERNEL_DS test to non-canonical

The prior implementation of the KERNEL_DS fault checking would work on
any unmapped kernel address, but this was narrowed to the non-canonical
range instead. This adjusts the LKDTM test to match.

Fixes: 00c42373d397 ("x86-64: add warning for non-canonical user access address dereferences")
Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/drivers/misc/lkdtm/usercopy.c b/drivers/misc/lkdtm/usercopy.c
index d5a0e7f..e172719 100644 (file)
--- a/drivers/misc/lkdtm/usercopy.c
+++ b/drivers/misc/lkdtm/usercopy.c
@@ -324,14 +324,16 @@ free_user:
 
 void lkdtm_USERCOPY_KERNEL_DS(void)
 {
-       char __user *user_ptr = (char __user *)ERR_PTR(-EINVAL);
+       char __user *user_ptr =
+               (char __user *)(0xFUL << (sizeof(unsigned long) * 8 - 4));
        mm_segment_t old_fs = get_fs();
        char buf[10] = {0};
 
-       pr_info("attempting copy_to_user on unmapped kernel address\n");
+       pr_info("attempting copy_to_user() to noncanonical address: %px\n",
+               user_ptr);
        set_fs(KERNEL_DS);
-       if (copy_to_user(user_ptr, buf, sizeof(buf)))
-               pr_info("copy_to_user un unmapped kernel address failed\n");
+       if (copy_to_user(user_ptr, buf, sizeof(buf)) == 0)
+               pr_err("copy_to_user() to noncanonical address succeeded!?\n");
        set_fs(old_fs);
 }