From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: multipart/mixed; boundary="===============3826787781737014170==" MIME-Version: 1.0 From: Christoph Hellwig To: mptcp at lists.01.org Subject: [MPTCP] Re: [PATCH 03/24] net: add a new sockptr_t type Date: Mon, 20 Jul 2020 19:43:22 +0200 Message-ID: <20200720174322.GA21785@lst.de> In-Reply-To: 20200720163748.GA1292162@gmail.com X-Status: X-Keywords: X-UID: 5130 --===============3826787781737014170== Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable On Mon, Jul 20, 2020 at 09:37:48AM -0700, Eric Biggers wrote: > How does this not introduce a massive security hole when > CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE? > = > AFAICS, userspace can pass in a pointer >=3D TASK_SIZE, > and this code makes it be treated as a kernel pointer. Yeah, we'll need to validate that before initializing the pointer. But thinking this a little further: doesn't this mean any set_fs(KERNEL_DS) that has other user pointers than the one it is intended for has the same issue? Pretty much all of these are gone in mainline now, but in older stable kernels there might be some interesting cases, especially in the compat ioctl handlers. --===============3826787781737014170==-- From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.5 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4F8BC433E5 for ; Mon, 20 Jul 2020 17:43:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AE43D20702 for ; Mon, 20 Jul 2020 17:43:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729786AbgGTRn3 (ORCPT ); Mon, 20 Jul 2020 13:43:29 -0400 Received: from verein.lst.de ([213.95.11.211]:48463 "EHLO verein.lst.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728966AbgGTRn2 (ORCPT ); Mon, 20 Jul 2020 13:43:28 -0400 Received: by verein.lst.de (Postfix, from userid 2407) id ED8356736F; Mon, 20 Jul 2020 19:43:22 +0200 (CEST) Date: Mon, 20 Jul 2020 19:43:22 +0200 From: Christoph Hellwig To: Eric Biggers Cc: Christoph Hellwig , "David S. Miller" , Jakub Kicinski , Alexei Starovoitov , Daniel Borkmann , Alexey Kuznetsov , Hideaki YOSHIFUJI , Eric Dumazet , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-sctp@vger.kernel.org, linux-hams@vger.kernel.org, linux-bluetooth@vger.kernel.org, bridge@lists.linux-foundation.org, linux-can@vger.kernel.org, dccp@vger.kernel.org, linux-decnet-user@lists.sourceforge.net, linux-wpan@vger.kernel.org, linux-s390@vger.kernel.org, mptcp@lists.01.org, lvs-devel@vger.kernel.org, rds-devel@oss.oracle.com, linux-afs@lists.infradead.org, tipc-discussion@lists.sourceforge.net, linux-x25@vger.kernel.org Subject: Re: [PATCH 03/24] net: add a new sockptr_t type Message-ID: <20200720174322.GA21785@lst.de> References: <20200720124737.118617-1-hch@lst.de> <20200720124737.118617-4-hch@lst.de> <20200720163748.GA1292162@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200720163748.GA1292162@gmail.com> User-Agent: Mutt/1.5.17 (2007-11-01) Sender: linux-crypto-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org On Mon, Jul 20, 2020 at 09:37:48AM -0700, Eric Biggers wrote: > How does this not introduce a massive security hole when > CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE? > > AFAICS, userspace can pass in a pointer >= TASK_SIZE, > and this code makes it be treated as a kernel pointer. Yeah, we'll need to validate that before initializing the pointer. But thinking this a little further: doesn't this mean any set_fs(KERNEL_DS) that has other user pointers than the one it is intended for has the same issue? Pretty much all of these are gone in mainline now, but in older stable kernels there might be some interesting cases, especially in the compat ioctl handlers. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Hellwig Subject: Re: [PATCH 03/24] net: add a new sockptr_t type Date: Mon, 20 Jul 2020 19:43:22 +0200 Message-ID: <20200720174322.GA21785@lst.de> References: <20200720124737.118617-1-hch@lst.de> <20200720124737.118617-4-hch@lst.de> <20200720163748.GA1292162@gmail.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20200720163748.GA1292162@gmail.com> Sender: linux-hams-owner@vger.kernel.org To: Eric Biggers Cc: Christoph Hellwig , "David S. Miller" , Jakub Kicinski , Alexei Starovoitov , Daniel Borkmann , Alexey Kuznetsov , Hideaki YOSHIFUJI , Eric Dumazet , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-sctp@vger.kernel.org, linux-hams@vger.kernel.org, linux-bluetooth@vger.kernel.org, bridge@lists.linux-foundation.org, linux-can@vger.kernel.org, dccp@vger.kernel.org, linux-decnet-user@lists.sourceforge.net, linux-wpan@vger.kernel.org, linux-s390@vger.kernel.org, mptcp@lists.01.org, lvs-devel@ List-Id: linux-can.vger.kernel.org On Mon, Jul 20, 2020 at 09:37:48AM -0700, Eric Biggers wrote: > How does this not introduce a massive security hole when > CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE? > > AFAICS, userspace can pass in a pointer >= TASK_SIZE, > and this code makes it be treated as a kernel pointer. Yeah, we'll need to validate that before initializing the pointer. But thinking this a little further: doesn't this mean any set_fs(KERNEL_DS) that has other user pointers than the one it is intended for has the same issue? Pretty much all of these are gone in mainline now, but in older stable kernels there might be some interesting cases, especially in the compat ioctl handlers. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Hellwig Date: Mon, 20 Jul 2020 17:43:22 +0000 Subject: Re: [PATCH 03/24] net: add a new sockptr_t type Message-Id: <20200720174322.GA21785@lst.de> List-Id: References: <20200720124737.118617-1-hch@lst.de> <20200720124737.118617-4-hch@lst.de> <20200720163748.GA1292162@gmail.com> In-Reply-To: <20200720163748.GA1292162@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Eric Biggers Cc: Christoph Hellwig , "David S. Miller" , Jakub Kicinski , Alexei Starovoitov , Daniel Borkmann , Alexey Kuznetsov , Hideaki YOSHIFUJI , Eric Dumazet , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-sctp@vger.kernel.org, linux-hams@vger.kernel.org, linux-bluetooth@vger.kernel.org, bridge@lists.linux-foundation.org, linux-can@vger.kernel.org, dccp@vger.kernel.org, linux-decnet-user@lists.sourceforge.net, linux-wpan@vger.kernel.org, linux-s390@vger.kernel.org, mptcp@lists.01.org, lvs-devel@vger.kernel.org, rds-devel@oss.oracle.com, linux-afs@lists.infradead.org, tipc-discussion@lists.sourceforge.net, linux-x25@vger.kernel.org On Mon, Jul 20, 2020 at 09:37:48AM -0700, Eric Biggers wrote: > How does this not introduce a massive security hole when > CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE? > > AFAICS, userspace can pass in a pointer >= TASK_SIZE, > and this code makes it be treated as a kernel pointer. Yeah, we'll need to validate that before initializing the pointer. But thinking this a little further: doesn't this mean any set_fs(KERNEL_DS) that has other user pointers than the one it is intended for has the same issue? Pretty much all of these are gone in mainline now, but in older stable kernels there might be some interesting cases, especially in the compat ioctl handlers. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Hellwig Date: Mon, 20 Jul 2020 17:43:22 +0000 Subject: Re: [PATCH 03/24] net: add a new sockptr_t type Message-Id: <20200720174322.GA21785@lst.de> List-Id: References: <20200720124737.118617-4-hch@lst.de> In-Reply-To: <20200720124737.118617-4-hch@lst.de> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: dccp@vger.kernel.org On Mon, Jul 20, 2020 at 09:37:48AM -0700, Eric Biggers wrote: > How does this not introduce a massive security hole when > CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE? > > AFAICS, userspace can pass in a pointer >= TASK_SIZE, > and this code makes it be treated as a kernel pointer. Yeah, we'll need to validate that before initializing the pointer. But thinking this a little further: doesn't this mean any set_fs(KERNEL_DS) that has other user pointers than the one it is intended for has the same issue? Pretty much all of these are gone in mainline now, but in older stable kernels there might be some interesting cases, especially in the compat ioctl handlers. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Hellwig Subject: Re: [PATCH 03/24] net: add a new sockptr_t type Date: Mon, 20 Jul 2020 19:43:22 +0200 Message-ID: <20200720174322.GA21785@lst.de> References: <20200720124737.118617-1-hch@lst.de> <20200720124737.118617-4-hch@lst.de> <20200720163748.GA1292162@gmail.com> Mime-Version: 1.0 Return-path: Content-Disposition: inline In-Reply-To: <20200720163748.GA1292162@gmail.com> Sender: linux-hams-owner@vger.kernel.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Eric Biggers Cc: Christoph Hellwig , "David S. Miller" , Jakub Kicinski , Alexei Starovoitov , Daniel Borkmann , Alexey Kuznetsov , Hideaki YOSHIFUJI , Eric Dumazet , linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org, netdev@vger.kernel.org, bpf@vger.kernel.org, netfilter-devel@vger.kernel.org, coreteam@netfilter.org, linux-sctp@vger.kernel.org, linux-hams@vger.kernel.org, linux-bluetooth@vger.kernel.org, bridge@lists.linux-foundation.org, linux-can@vger.kernel.org, dccp@vger.kernel.org, linux-decnet-user@lists.sourceforge.net, linux-wpan@vger.kernel.org, linux-s390@vger.kernel.org, mptcp@lists.01.org, On Mon, Jul 20, 2020 at 09:37:48AM -0700, Eric Biggers wrote: > How does this not introduce a massive security hole when > CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE? > > AFAICS, userspace can pass in a pointer >= TASK_SIZE, > and this code makes it be treated as a kernel pointer. Yeah, we'll need to validate that before initializing the pointer. But thinking this a little further: doesn't this mean any set_fs(KERNEL_DS) that has other user pointers than the one it is intended for has the same issue? Pretty much all of these are gone in mainline now, but in older stable kernels there might be some interesting cases, especially in the compat ioctl handlers. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Mon, 20 Jul 2020 19:43:22 +0200 From: Christoph Hellwig Message-ID: <20200720174322.GA21785@lst.de> References: <20200720124737.118617-1-hch@lst.de> <20200720124737.118617-4-hch@lst.de> <20200720163748.GA1292162@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200720163748.GA1292162@gmail.com> Subject: Re: [Bridge] [PATCH 03/24] net: add a new sockptr_t type List-Id: Linux Ethernet Bridging List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Biggers Cc: Alexei Starovoitov , linux-sctp@vger.kernel.org, Christoph Hellwig , linux-s390@vger.kernel.org, rds-devel@oss.oracle.com, Daniel Borkmann , dccp@vger.kernel.org, bridge@lists.linux-foundation.org, linux-afs@lists.infradead.org, lvs-devel@vger.kernel.org, coreteam@netfilter.org, mptcp@lists.01.org, Alexey Kuznetsov , linux-can@vger.kernel.org, Jakub Kicinski , linux-hams@vger.kernel.org, tipc-discussion@lists.sourceforge.net, linux-x25@vger.kernel.org, Eric Dumazet , Hideaki YOSHIFUJI , netdev@vger.kernel.org, linux-decnet-user@lists.sourceforge.net, linux-kernel@vger.kernel.org, linux-bluetooth@vger.kernel.org, netfilter-devel@vger.kernel.org, linux-crypto@vger.kernel.org, bpf@vger.kernel.org, linux-wpan@vger.kernel.org, "David S. Miller" On Mon, Jul 20, 2020 at 09:37:48AM -0700, Eric Biggers wrote: > How does this not introduce a massive security hole when > CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE? > > AFAICS, userspace can pass in a pointer >= TASK_SIZE, > and this code makes it be treated as a kernel pointer. Yeah, we'll need to validate that before initializing the pointer. But thinking this a little further: doesn't this mean any set_fs(KERNEL_DS) that has other user pointers than the one it is intended for has the same issue? Pretty much all of these are gone in mainline now, but in older stable kernels there might be some interesting cases, especially in the compat ioctl handlers.