* [PATCH] Hardening memory maunipulation.
@ 2015-04-29 15:39 ` Shawn Chang
0 siblings, 0 replies; 4+ messages in thread
From: Shawn Chang @ 2015-04-29 15:39 UTC (permalink / raw)
To: linux-mm, linux-kernel; +Cc: spender, keescook, Shawn C
From: Shawn C <citypw@gmail.com>
Hi kernel maintainers,
It won't allow the address above the TASK_SIZE being mmap'ed( or mprotect'ed).
This patch is from PaX/Grsecurity.
Thanks for your review time!
Signed-off-by: Shawn C <citypw@gmail.com>
---
mm/madvise.c | 4 ++++
mm/mempolicy.c | 5 +++++
mm/mlock.c | 4 ++++
mm/mprotect.c | 5 +++++
4 files changed, 18 insertions(+)
diff --git a/mm/madvise.c b/mm/madvise.c
index d551475..3f5dd3d 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -484,6 +484,10 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
if (end < start)
return error;
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return error;
+
error = 0;
if (end == start)
return error;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index ede2629..56c2eed 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1161,6 +1161,11 @@ static long do_mbind(unsigned long start, unsigned long len,
if (end < start)
return -EINVAL;
+
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
if (end == start)
return 0;
diff --git a/mm/mlock.c b/mm/mlock.c
index 6fd2cf1..c7f6785 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -566,6 +566,10 @@ static int do_mlock(unsigned long start, size_t len, int on)
return -EINVAL;
if (end == start)
return 0;
+
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
vma = find_vma(current->mm, start);
if (!vma || vma->vm_start > start)
return -ENOMEM;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 8858483..cd58a31 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -351,6 +351,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
end = start + len;
if (end <= start)
return -ENOMEM;
+
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
if (!arch_validate_prot(prot))
return -EINVAL;
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [PATCH] Hardening memory maunipulation.
@ 2015-04-29 15:39 ` Shawn Chang
0 siblings, 0 replies; 4+ messages in thread
From: Shawn Chang @ 2015-04-29 15:39 UTC (permalink / raw)
To: linux-mm, linux-kernel; +Cc: spender, keescook, Shawn C
From: Shawn C <citypw@gmail.com>
Hi kernel maintainers,
It won't allow the address above the TASK_SIZE being mmap'ed( or mprotect'ed).
This patch is from PaX/Grsecurity.
Thanks for your review time!
Signed-off-by: Shawn C <citypw@gmail.com>
---
mm/madvise.c | 4 ++++
mm/mempolicy.c | 5 +++++
mm/mlock.c | 4 ++++
mm/mprotect.c | 5 +++++
4 files changed, 18 insertions(+)
diff --git a/mm/madvise.c b/mm/madvise.c
index d551475..3f5dd3d 100644
--- a/mm/madvise.c
+++ b/mm/madvise.c
@@ -484,6 +484,10 @@ SYSCALL_DEFINE3(madvise, unsigned long, start, size_t, len_in, int, behavior)
if (end < start)
return error;
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return error;
+
error = 0;
if (end == start)
return error;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index ede2629..56c2eed 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -1161,6 +1161,11 @@ static long do_mbind(unsigned long start, unsigned long len,
if (end < start)
return -EINVAL;
+
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
if (end == start)
return 0;
diff --git a/mm/mlock.c b/mm/mlock.c
index 6fd2cf1..c7f6785 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -566,6 +566,10 @@ static int do_mlock(unsigned long start, size_t len, int on)
return -EINVAL;
if (end == start)
return 0;
+
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
vma = find_vma(current->mm, start);
if (!vma || vma->vm_start > start)
return -ENOMEM;
diff --git a/mm/mprotect.c b/mm/mprotect.c
index 8858483..cd58a31 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -351,6 +351,11 @@ SYSCALL_DEFINE3(mprotect, unsigned long, start, size_t, len,
end = start + len;
if (end <= start)
return -ENOMEM;
+
+ /* We should never reach the kernel address space here */
+ if (end > TASK_SIZE)
+ return -EINVAL;
+
if (!arch_validate_prot(prot))
return -EINVAL;
--
1.9.1
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] Hardening memory maunipulation.
2015-04-29 15:39 ` Shawn Chang
@ 2015-04-29 22:09 ` Andy Lutomirski
-1 siblings, 0 replies; 4+ messages in thread
From: Andy Lutomirski @ 2015-04-29 22:09 UTC (permalink / raw)
To: Shawn Chang, linux-mm, linux-kernel; +Cc: spender, keescook
On 04/29/2015 08:39 AM, Shawn Chang wrote:
> From: Shawn C <citypw@gmail.com>
>
> Hi kernel maintainers,
>
> It won't allow the address above the TASK_SIZE being mmap'ed( or mprotect'ed).
> This patch is from PaX/Grsecurity.
>
> Thanks for your review time!
Does this actually reduce the attack surface of anything?
These functions all search for vmas. If there's a vma outside of the
user range, we have a problem.
Also, that use of TASK_SIZE is IMO ridiculous. Shouldn't be TASK_SIZE_MAX?
--Andy, who is annoyed every time another pointless TIF_IA32 reference,
even hidden in a macro, makes it into the kernel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] Hardening memory maunipulation.
@ 2015-04-29 22:09 ` Andy Lutomirski
0 siblings, 0 replies; 4+ messages in thread
From: Andy Lutomirski @ 2015-04-29 22:09 UTC (permalink / raw)
To: Shawn Chang, linux-mm, linux-kernel; +Cc: spender, keescook
On 04/29/2015 08:39 AM, Shawn Chang wrote:
> From: Shawn C <citypw@gmail.com>
>
> Hi kernel maintainers,
>
> It won't allow the address above the TASK_SIZE being mmap'ed( or mprotect'ed).
> This patch is from PaX/Grsecurity.
>
> Thanks for your review time!
Does this actually reduce the attack surface of anything?
These functions all search for vmas. If there's a vma outside of the
user range, we have a problem.
Also, that use of TASK_SIZE is IMO ridiculous. Shouldn't be TASK_SIZE_MAX?
--Andy, who is annoyed every time another pointless TIF_IA32 reference,
even hidden in a macro, makes it into the kernel
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2015-04-29 22:09 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-04-29 15:39 [PATCH] Hardening memory maunipulation Shawn Chang
2015-04-29 15:39 ` Shawn Chang
2015-04-29 22:09 ` Andy Lutomirski
2015-04-29 22:09 ` Andy Lutomirski
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.