From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753803AbcHQA1A (ORCPT ); Tue, 16 Aug 2016 20:27:00 -0400 Received: from mail-pa0-f51.google.com ([209.85.220.51]:34724 "EHLO mail-pa0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752325AbcHQA05 (ORCPT ); Tue, 16 Aug 2016 20:26:57 -0400 From: Kees Cook To: "Paul E . McKenney" Cc: Kees Cook , Laura Abbott , Steven Rostedt , Stephen Boyd , Daniel Micay , Joe Perches , Arnd Bergmann , Greg Kroah-Hartman , Josh Triplett , Mathieu Desnoyers , Lai Jiangshan , "Aneesh Kumar K.V" , "Kirill A. Shutemov" , Michael Ellerman , Dan Williams , Andrew Morton , Ingo Molnar , Thomas Gleixner , Josef Bacik , Andrey Ryabinin , Tejun Heo , Nikolay Aleksandrov , Dmitry Vyukov , linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: [PATCH v2 0/5] bug: Provide toggle for BUG on data corruption Date: Tue, 16 Aug 2016 17:20:24 -0700 Message-Id: <1471393229-27182-1-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This adds a CONFIG to trigger BUG()s when the kernel encounters unexpected data structure integrity as currently detected with CONFIG_DEBUG_LIST. Specifically list operations have been a target for widening flaws to gain "write anywhere" primitives for attackers, so this also consolidates the debug checking to avoid code and check duplication (e.g. RCU list debug was missing a check that got added to regular list debug). It also stops manipulations when corruption is detected, since worsening the corruption makes no sense. (Really, everyone should build with CONFIG_DEBUG_LIST since the checks are so inexpensive.) This is mostly a refactoring of similar code from PaX and Grsecurity, along with MSM kernel changes by Stephen Boyd. Along with the patches is a new lkdtm test to validate that setting CONFIG_DEBUG_LIST actually does what is desired. Thanks, -Kees From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com From: Kees Cook Date: Tue, 16 Aug 2016 17:20:24 -0700 Message-Id: <1471393229-27182-1-git-send-email-keescook@chromium.org> Subject: [kernel-hardening] [PATCH v2 0/5] bug: Provide toggle for BUG on data corruption To: "Paul E . McKenney" Cc: Kees Cook , Laura Abbott , Steven Rostedt , Stephen Boyd , Daniel Micay , Joe Perches , Arnd Bergmann , Greg Kroah-Hartman , Josh Triplett , Mathieu Desnoyers , Lai Jiangshan , "Aneesh Kumar K.V" , "Kirill A. Shutemov" , Michael Ellerman , Dan Williams , Andrew Morton , Ingo Molnar , Thomas Gleixner , Josef Bacik , Andrey Ryabinin , Tejun Heo , Nikolay Aleksandrov , Dmitry Vyukov , linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com List-ID: This adds a CONFIG to trigger BUG()s when the kernel encounters unexpected data structure integrity as currently detected with CONFIG_DEBUG_LIST. Specifically list operations have been a target for widening flaws to gain "write anywhere" primitives for attackers, so this also consolidates the debug checking to avoid code and check duplication (e.g. RCU list debug was missing a check that got added to regular list debug). It also stops manipulations when corruption is detected, since worsening the corruption makes no sense. (Really, everyone should build with CONFIG_DEBUG_LIST since the checks are so inexpensive.) This is mostly a refactoring of similar code from PaX and Grsecurity, along with MSM kernel changes by Stephen Boyd. Along with the patches is a new lkdtm test to validate that setting CONFIG_DEBUG_LIST actually does what is desired. Thanks, -Kees