From: Kees Cook <keescook@chromium.org>
To: linux-kernel@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
David Windsor <dave@nullcore.net>, Ingo Molnar <mingo@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Thomas Gleixner <tglx@linutronix.de>,
Andy Lutomirski <luto@kernel.org>,
linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org,
linux-mm@kvack.org, kernel-hardening@lists.openwall.com
Subject: [PATCH v3 25/31] fork: Define usercopy region in thread_stack slab caches
Date: Wed, 20 Sep 2017 13:45:31 -0700 [thread overview]
Message-ID: <1505940337-79069-26-git-send-email-keescook@chromium.org> (raw)
In-Reply-To: <1505940337-79069-1-git-send-email-keescook@chromium.org>
From: David Windsor <dave@nullcore.net>
In support of usercopy hardening, this patch defines a region in the
thread_stack slab caches in which userspace copy operations are allowed.
Since the entire thread_stack needs to be available to userspace, the
entire slab contents are whitelisted. Note that the slab-based thread
stack is only present on systems with THREAD_SIZE < PAGE_SIZE and
!CONFIG_VMAP_STACK.
cache object allocation:
kernel/fork.c:
alloc_thread_stack_node(...):
return kmem_cache_alloc_node(thread_stack_cache, ...)
dup_task_struct(...):
...
stack = alloc_thread_stack_node(...)
...
tsk->stack = stack;
copy_process(...):
...
dup_task_struct(...)
_do_fork(...):
...
copy_process(...)
This region is known as the slab cache's usercopy region. Slab caches
can now check that each copy operation involving cache-managed memory
falls entirely within the slab's usercopy region.
This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY
whitelisting code in the last public patch of grsecurity/PaX based on my
understanding of the code. Changes or omissions from the original code are
mine and don't reflect the original grsecurity/PaX code.
Signed-off-by: David Windsor <dave@nullcore.net>
[kees: adjust commit log, split patch, provide usage trace]
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Rik van Riel <riel@redhat.com>
---
I wasn't able to test this, so anyone with a system that can try running
with a large PAGE_SIZE and without VMAP_STACK would be appreciated.
---
kernel/fork.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index dc1437f8b702..720109dc723a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -278,8 +278,9 @@ static void free_thread_stack(struct task_struct *tsk)
void thread_stack_cache_init(void)
{
- thread_stack_cache = kmem_cache_create("thread_stack", THREAD_SIZE,
- THREAD_SIZE, 0, NULL);
+ thread_stack_cache = kmem_cache_create_usercopy("thread_stack",
+ THREAD_SIZE, THREAD_SIZE, 0, 0,
+ THREAD_SIZE, NULL);
BUG_ON(thread_stack_cache == NULL);
}
# endif
--
2.7.4
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org>
To: linux-kernel@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
David Windsor <dave@nullcore.net>, Ingo Molnar <mingo@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Thomas Gleixner <tglx@linutronix.de>,
Andy Lutomirski <luto@kernel.org>,
linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org,
linux-mm@kvack.org, kernel-hardening@lists.openwall.com
Subject: [PATCH v3 25/31] fork: Define usercopy region in thread_stack slab caches
Date: Wed, 20 Sep 2017 13:45:31 -0700 [thread overview]
Message-ID: <1505940337-79069-26-git-send-email-keescook@chromium.org> (raw)
In-Reply-To: <1505940337-79069-1-git-send-email-keescook@chromium.org>
From: David Windsor <dave@nullcore.net>
In support of usercopy hardening, this patch defines a region in the
thread_stack slab caches in which userspace copy operations are allowed.
Since the entire thread_stack needs to be available to userspace, the
entire slab contents are whitelisted. Note that the slab-based thread
stack is only present on systems with THREAD_SIZE < PAGE_SIZE and
!CONFIG_VMAP_STACK.
cache object allocation:
kernel/fork.c:
alloc_thread_stack_node(...):
return kmem_cache_alloc_node(thread_stack_cache, ...)
dup_task_struct(...):
...
stack = alloc_thread_stack_node(...)
...
tsk->stack = stack;
copy_process(...):
...
dup_task_struct(...)
_do_fork(...):
...
copy_process(...)
This region is known as the slab cache's usercopy region. Slab caches
can now check that each copy operation involving cache-managed memory
falls entirely within the slab's usercopy region.
This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY
whitelisting code in the last public patch of grsecurity/PaX based on my
understanding of the code. Changes or omissions from the original code are
mine and don't reflect the original grsecurity/PaX code.
Signed-off-by: David Windsor <dave@nullcore.net>
[kees: adjust commit log, split patch, provide usage trace]
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Rik van Riel <riel@redhat.com>
---
I wasn't able to test this, so anyone with a system that can try running
with a large PAGE_SIZE and without VMAP_STACK would be appreciated.
---
kernel/fork.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index dc1437f8b702..720109dc723a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -278,8 +278,9 @@ static void free_thread_stack(struct task_struct *tsk)
void thread_stack_cache_init(void)
{
- thread_stack_cache = kmem_cache_create("thread_stack", THREAD_SIZE,
- THREAD_SIZE, 0, NULL);
+ thread_stack_cache = kmem_cache_create_usercopy("thread_stack",
+ THREAD_SIZE, THREAD_SIZE, 0, 0,
+ THREAD_SIZE, NULL);
BUG_ON(thread_stack_cache == NULL);
}
# endif
--
2.7.4
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org>
To: linux-kernel@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>,
David Windsor <dave@nullcore.net>, Ingo Molnar <mingo@kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Thomas Gleixner <tglx@linutronix.de>,
Andy Lutomirski <luto@kernel.org>,
linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org,
linux-mm@kvack.org, kernel-hardening@lists.openwall.com
Subject: [kernel-hardening] [PATCH v3 25/31] fork: Define usercopy region in thread_stack slab caches
Date: Wed, 20 Sep 2017 13:45:31 -0700 [thread overview]
Message-ID: <1505940337-79069-26-git-send-email-keescook@chromium.org> (raw)
In-Reply-To: <1505940337-79069-1-git-send-email-keescook@chromium.org>
From: David Windsor <dave@nullcore.net>
In support of usercopy hardening, this patch defines a region in the
thread_stack slab caches in which userspace copy operations are allowed.
Since the entire thread_stack needs to be available to userspace, the
entire slab contents are whitelisted. Note that the slab-based thread
stack is only present on systems with THREAD_SIZE < PAGE_SIZE and
!CONFIG_VMAP_STACK.
cache object allocation:
kernel/fork.c:
alloc_thread_stack_node(...):
return kmem_cache_alloc_node(thread_stack_cache, ...)
dup_task_struct(...):
...
stack = alloc_thread_stack_node(...)
...
tsk->stack = stack;
copy_process(...):
...
dup_task_struct(...)
_do_fork(...):
...
copy_process(...)
This region is known as the slab cache's usercopy region. Slab caches
can now check that each copy operation involving cache-managed memory
falls entirely within the slab's usercopy region.
This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY
whitelisting code in the last public patch of grsecurity/PaX based on my
understanding of the code. Changes or omissions from the original code are
mine and don't reflect the original grsecurity/PaX code.
Signed-off-by: David Windsor <dave@nullcore.net>
[kees: adjust commit log, split patch, provide usage trace]
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Andy Lutomirski <luto@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Rik van Riel <riel@redhat.com>
---
I wasn't able to test this, so anyone with a system that can try running
with a large PAGE_SIZE and without VMAP_STACK would be appreciated.
---
kernel/fork.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/kernel/fork.c b/kernel/fork.c
index dc1437f8b702..720109dc723a 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -278,8 +278,9 @@ static void free_thread_stack(struct task_struct *tsk)
void thread_stack_cache_init(void)
{
- thread_stack_cache = kmem_cache_create("thread_stack", THREAD_SIZE,
- THREAD_SIZE, 0, NULL);
+ thread_stack_cache = kmem_cache_create_usercopy("thread_stack",
+ THREAD_SIZE, THREAD_SIZE, 0, 0,
+ THREAD_SIZE, NULL);
BUG_ON(thread_stack_cache == NULL);
}
# endif
--
2.7.4
next prev parent reply other threads:[~2017-09-20 20:53 UTC|newest]
Thread overview: 133+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-20 20:45 [PATCH v3 00/31] Hardened usercopy whitelisting Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 01/31] usercopy: Prepare for " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-21 15:21 ` Christopher Lameter
2017-09-21 15:21 ` [kernel-hardening] " Christopher Lameter
2017-09-20 20:45 ` [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region boundaries Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-21 15:23 ` Christopher Lameter
2017-09-21 15:23 ` [kernel-hardening] " Christopher Lameter
2017-09-20 20:45 ` [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-21 15:27 ` Christopher Lameter
2017-09-21 15:27 ` [kernel-hardening] " Christopher Lameter
2017-09-21 15:40 ` Kees Cook
2017-09-21 15:40 ` Kees Cook
2017-09-21 15:40 ` Kees Cook
2017-09-21 16:04 ` Christopher Lameter
2017-09-21 16:04 ` Christopher Lameter
2017-09-21 18:26 ` Kees Cook
2017-09-21 18:26 ` Kees Cook
2017-09-21 18:26 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 04/31] dcache: Define usercopy region in dentry_cache slab cache Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 05/31] vfs: Define usercopy region in names_cache slab caches Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 06/31] vfs: Copy struct mount.mnt_id to userspace using put_user() Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 07/31] ext4: Define usercopy region in ext4_inode_cache slab cache Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 08/31] ext2: Define usercopy region in ext2_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 09/31] jfs: Define usercopy region in jfs_ip " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-22 2:54 ` Dave Kleikamp
2017-09-22 2:54 ` [kernel-hardening] " Dave Kleikamp
2017-09-22 2:54 ` Dave Kleikamp
2017-09-20 20:45 ` [PATCH v3 10/31] befs: Define usercopy region in befs_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-21 9:34 ` Luis de Bethencourt
2017-09-21 9:34 ` [kernel-hardening] " Luis de Bethencourt
2017-09-21 9:34 ` Luis de Bethencourt
2017-09-20 20:45 ` [PATCH v3 11/31] exofs: Define usercopy region in exofs_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 12/31] orangefs: Define usercopy region in orangefs_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 13/31] ufs: Define usercopy region in ufs_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 14/31] vxfs: Define usercopy region in vxfs_inode " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:56 ` Christoph Hellwig
2017-09-20 20:56 ` [kernel-hardening] " Christoph Hellwig
2017-09-20 20:56 ` Christoph Hellwig
2017-09-20 21:21 ` Kees Cook
2017-09-20 21:21 ` [kernel-hardening] " Kees Cook
2017-09-20 21:21 ` Kees Cook
2017-09-20 23:22 ` Christoph Hellwig
2017-09-20 23:22 ` [kernel-hardening] " Christoph Hellwig
2017-09-20 23:22 ` Christoph Hellwig
2017-09-20 23:22 ` Christoph Hellwig
2017-09-20 20:45 ` [PATCH v3 15/31] xfs: Define usercopy region in xfs_inode " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
[not found] ` <1505940337-79069-1-git-send-email-keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
2017-09-20 20:45 ` [PATCH v3 16/31] cifs: Define usercopy region in cifs_request " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 17/31] scsi: Define usercopy region in scsi_sense_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 18/31] net: Define usercopy region in struct proto " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 19/31] ip: Define usercopy region in IP " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 20/31] caif: Define usercopy region in caif " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 21/31] sctp: Define usercopy region in SCTP " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 22/31] sctp: Copy struct sctp_sock.autoclose to userspace using put_user() Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 23/31] net: Restrict unwhitelisted proto caches to size 0 Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 24/31] fork: Define usercopy region in mm_struct slab caches Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook [this message]
2017-09-20 20:45 ` [kernel-hardening] [PATCH v3 25/31] fork: Define usercopy region in thread_stack " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 26/31] fork: Provide usercopy whitelisting for task_struct Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 27/31] x86: Implement thread_struct whitelist for hardened usercopy Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 28/31] arm64: " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 29/31] arm: " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 30/31] usercopy: Restrict non-usercopy caches to size 0 Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 31/31] lkdtm: Update usercopy tests for whitelisting Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1505940337-79069-26-git-send-email-keescook@chromium.org \
--to=keescook@chromium.org \
--cc=akpm@linux-foundation.org \
--cc=dave@nullcore.net \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mingo@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.