From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752410AbcGGQfl (ORCPT ); Thu, 7 Jul 2016 12:35:41 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39754 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750808AbcGGQfb (ORCPT ); Thu, 7 Jul 2016 12:35:31 -0400 Message-ID: <1467909317.13253.17.camel@redhat.com> Subject: Re: [PATCH 1/9] mm: Hardened usercopy From: Rik van Riel To: Kees Cook , linux-kernel@vger.kernel.org Cc: Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , x86@kernel.org, Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Borislav Petkov , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , Laura Abbott , linux-arm-kernel@lists.infradead.org, linux-ia64@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, sparclinux@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com Date: Thu, 07 Jul 2016 12:35:17 -0400 In-Reply-To: <1467843928-29351-2-git-send-email-keescook@chromium.org> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-A8whchtqc1mx2jHwm8hg" Mime-Version: 1.0 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Thu, 07 Jul 2016 16:35:25 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-A8whchtqc1mx2jHwm8hg Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >=C2=A0 > + /* Allow kernel rodata region (if not marked as Reserved). > */ > + if (ptr >=3D (const void *)__start_rodata && > + =C2=A0=C2=A0=C2=A0=C2=A0end <=3D (const void *)__end_rodata) > + return NULL; >=20 One comment here. __check_object_size gets "to_user" as an argument. It may make sense to pass that to check_heap_object, and only allow copy_to_user from rodata, never copy_from_user, since that section should be read only. > +void __check_object_size(const void *ptr, unsigned long n, bool > to_user) > +{ >=C2=A0 --=20 All Rights Reversed. --=-A8whchtqc1mx2jHwm8hg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABCAAGBQJXfoTFAAoJEM553pKExN6DSm8H/03wOEjAiET+COdQLbDEWApC bEAOboYqibBhVsPZ557+S9y/UClhKOdBwA+nOKYw7ftj8gZZibkVBFbel7NV+s24 GHC3R1i1kGYK2YQflr2F2HGe1a8L1AWV7XuuxoBxqxP53zMrb9kAR3+vxRiz/bLc nd4uQ1VhgPHOn1Ny6SSO6Ss6kM3wrsJw0+b2LS6erOUeA0IV7Wi01AMaRvLYiARR yQEeIwn+lsENGCUMK/RGyiOJCW0m8FV6DrjtG3crG2CUtbjFnpMo225PrdOJMcBh p5XyisW8AiGPrKm3ykxzNhPbOtP+2r8fVGgcUv7apHt+oORVNmVeEO1mP/yJATo= =SHUM -----END PGP SIGNATURE----- --=-A8whchtqc1mx2jHwm8hg-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rik van Riel Subject: Re: [PATCH 1/9] mm: Hardened usercopy Date: Thu, 07 Jul 2016 12:35:17 -0400 Message-ID: <1467909317.13253.17.camel@redhat.com> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> Mime-Version: 1.0 Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-A8whchtqc1mx2jHwm8hg" Return-path: In-Reply-To: <1467843928-29351-2-git-send-email-keescook@chromium.org> Sender: owner-linux-mm@kvack.org To: Kees Cook , linux-kernel@vger.kernel.org Cc: Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , x86@kernel.org, Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Borislav Petkov , Mathias Krause List-Id: linux-arch.vger.kernel.org --=-A8whchtqc1mx2jHwm8hg Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >=C2=A0 > + /* Allow kernel rodata region (if not marked as Reserved). > */ > + if (ptr >=3D (const void *)__start_rodata && > + =C2=A0=C2=A0=C2=A0=C2=A0end <=3D (const void *)__end_rodata) > + return NULL; >=20 One comment here. __check_object_size gets "to_user" as an argument. It may make sense to pass that to check_heap_object, and only allow copy_to_user from rodata, never copy_from_user, since that section should be read only. > +void __check_object_size(const void *ptr, unsigned long n, bool > to_user) > +{ >=C2=A0 --=20 All Rights Reversed. --=-A8whchtqc1mx2jHwm8hg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABCAAGBQJXfoTFAAoJEM553pKExN6DSm8H/03wOEjAiET+COdQLbDEWApC bEAOboYqibBhVsPZ557+S9y/UClhKOdBwA+nOKYw7ftj8gZZibkVBFbel7NV+s24 GHC3R1i1kGYK2YQflr2F2HGe1a8L1AWV7XuuxoBxqxP53zMrb9kAR3+vxRiz/bLc nd4uQ1VhgPHOn1Ny6SSO6Ss6kM3wrsJw0+b2LS6erOUeA0IV7Wi01AMaRvLYiARR yQEeIwn+lsENGCUMK/RGyiOJCW0m8FV6DrjtG3crG2CUtbjFnpMo225PrdOJMcBh p5XyisW8AiGPrKm3ykxzNhPbOtP+2r8fVGgcUv7apHt+oORVNmVeEO1mP/yJATo= =SHUM -----END PGP SIGNATURE----- --=-A8whchtqc1mx2jHwm8hg-- -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 From: Rik van Riel Date: Thu, 07 Jul 2016 16:35:17 +0000 Subject: Re: [PATCH 1/9] mm: Hardened usercopy Message-Id: <1467909317.13253.17.camel@redhat.com> MIME-Version: 1 Content-Type: multipart/mixed; boundary="=-A8whchtqc1mx2jHwm8hg" List-Id: References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> In-Reply-To: <1467843928-29351-2-git-send-email-keescook@chromium.org> To: Kees Cook , linux-kernel@vger.kernel.org Cc: Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , x86@kernel.org, Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Borislav Petkov , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , Laura Abbott , linux-arm-kernel@lists.infradead.org, linux-ia64@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, sparclinux@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com --=-A8whchtqc1mx2jHwm8hg Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >=C2=A0 > + /* Allow kernel rodata region (if not marked as Reserved). > */ > + if (ptr >=3D (const void *)__start_rodata && > + =C2=A0=C2=A0=C2=A0=C2=A0end <=3D (const void *)__end_rodata) > + return NULL; >=20 One comment here. __check_object_size gets "to_user" as an argument. It may make sense to pass that to check_heap_object, and only allow copy_to_user from rodata, never copy_from_user, since that section should be read only. > +void __check_object_size(const void *ptr, unsigned long n, bool > to_user) > +{ >=C2=A0 --=20 All Rights Reversed. --=-A8whchtqc1mx2jHwm8hg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABCAAGBQJXfoTFAAoJEM553pKExN6DSm8H/03wOEjAiET+COdQLbDEWApC bEAOboYqibBhVsPZ557+S9y/UClhKOdBwA+nOKYw7ftj8gZZibkVBFbel7NV+s24 GHC3R1i1kGYK2YQflr2F2HGe1a8L1AWV7XuuxoBxqxP53zMrb9kAR3+vxRiz/bLc nd4uQ1VhgPHOn1Ny6SSO6Ss6kM3wrsJw0+b2LS6erOUeA0IV7Wi01AMaRvLYiARR yQEeIwn+lsENGCUMK/RGyiOJCW0m8FV6DrjtG3crG2CUtbjFnpMo225PrdOJMcBh p5XyisW8AiGPrKm3ykxzNhPbOtP+2r8fVGgcUv7apHt+oORVNmVeEO1mP/yJATo= =SHUM -----END PGP SIGNATURE----- --=-A8whchtqc1mx2jHwm8hg-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: riel@redhat.com (Rik van Riel) Date: Thu, 07 Jul 2016 12:35:17 -0400 Subject: [PATCH 1/9] mm: Hardened usercopy In-Reply-To: <1467843928-29351-2-git-send-email-keescook@chromium.org> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> Message-ID: <1467909317.13253.17.camel@redhat.com> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >? > + /* Allow kernel rodata region (if not marked as Reserved). > */ > + if (ptr >= (const void *)__start_rodata && > + ????end <= (const void *)__end_rodata) > + return NULL; > One comment here. __check_object_size gets "to_user" as an argument. It may make sense to pass that to check_heap_object, and only allow copy_to_user from rodata, never copy_from_user, since that section should be read only. > +void __check_object_size(const void *ptr, unsigned long n, bool > to_user) > +{ >? -- All Rights Reversed. -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 473 bytes Desc: This is a digitally signed message part URL: From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Message-ID: <1467909317.13253.17.camel@redhat.com> From: Rik van Riel Date: Thu, 07 Jul 2016 12:35:17 -0400 In-Reply-To: <1467843928-29351-2-git-send-email-keescook@chromium.org> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="=-A8whchtqc1mx2jHwm8hg" Mime-Version: 1.0 Subject: [kernel-hardening] Re: [PATCH 1/9] mm: Hardened usercopy To: Kees Cook , linux-kernel@vger.kernel.org Cc: Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , x86@kernel.org, Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Borislav Petkov , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , Laura Abbott , linux-arm-kernel@lists.infradead.org, linux-ia64@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, sparclinux@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com List-ID: --=-A8whchtqc1mx2jHwm8hg Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >=C2=A0 > + /* Allow kernel rodata region (if not marked as Reserved). > */ > + if (ptr >=3D (const void *)__start_rodata && > + =C2=A0=C2=A0=C2=A0=C2=A0end <=3D (const void *)__end_rodata) > + return NULL; >=20 One comment here. __check_object_size gets "to_user" as an argument. It may make sense to pass that to check_heap_object, and only allow copy_to_user from rodata, never copy_from_user, since that section should be read only. > +void __check_object_size(const void *ptr, unsigned long n, bool > to_user) > +{ >=C2=A0 --=20 All Rights Reversed. --=-A8whchtqc1mx2jHwm8hg Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part Content-Transfer-Encoding: 7bit -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAABCAAGBQJXfoTFAAoJEM553pKExN6DSm8H/03wOEjAiET+COdQLbDEWApC bEAOboYqibBhVsPZ557+S9y/UClhKOdBwA+nOKYw7ftj8gZZibkVBFbel7NV+s24 GHC3R1i1kGYK2YQflr2F2HGe1a8L1AWV7XuuxoBxqxP53zMrb9kAR3+vxRiz/bLc nd4uQ1VhgPHOn1Ny6SSO6Ss6kM3wrsJw0+b2LS6erOUeA0IV7Wi01AMaRvLYiARR yQEeIwn+lsENGCUMK/RGyiOJCW0m8FV6DrjtG3crG2CUtbjFnpMo225PrdOJMcBh p5XyisW8AiGPrKm3ykxzNhPbOtP+2r8fVGgcUv7apHt+oORVNmVeEO1mP/yJATo= =SHUM -----END PGP SIGNATURE----- --=-A8whchtqc1mx2jHwm8hg--