From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932086AbcGGRln (ORCPT ); Thu, 7 Jul 2016 13:41:43 -0400 Received: from mail-wm0-f44.google.com ([74.125.82.44]:37563 "EHLO mail-wm0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751980AbcGGRlc (ORCPT ); Thu, 7 Jul 2016 13:41:32 -0400 MIME-Version: 1.0 In-Reply-To: <1467909317.13253.17.camel@redhat.com> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> <1467909317.13253.17.camel@redhat.com> From: Kees Cook Date: Thu, 7 Jul 2016 13:41:30 -0400 X-Google-Sender-Auth: G7YvpZAttnI3E0LIbomo14nL3yM Message-ID: Subject: Re: [PATCH 1/9] mm: Hardened usercopy To: Rik van Riel Cc: LKML , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , Laura Abbott , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jul 7, 2016 at 12:35 PM, Rik van Riel wrote: > On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >> >> + /* Allow kernel rodata region (if not marked as Reserved). >> */ >> + if (ptr >= (const void *)__start_rodata && >> + end <= (const void *)__end_rodata) >> + return NULL; >> > One comment here. > > __check_object_size gets "to_user" as an argument. > > It may make sense to pass that to check_heap_object, and > only allow copy_to_user from rodata, never copy_from_user, > since that section should be read only. Well, that's two votes for this extra check, but I'm still not sure since it may already be allowed by the Reserved check, but I can reorder things to _reject_ on rodata writes before the Reserved check, etc. I'll see what could work here... -Kees > >> +void __check_object_size(const void *ptr, unsigned long n, bool >> to_user) >> +{ >> > > -- > > All Rights Reversed. -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: Re: [PATCH 1/9] mm: Hardened usercopy Date: Thu, 7 Jul 2016 13:41:30 -0400 Message-ID: References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> <1467909317.13253.17.camel@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: In-Reply-To: <1467909317.13253.17.camel@redhat.com> Sender: sparclinux-owner@vger.kernel.org To: Rik van Riel Cc: LKML , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Mathias Krause , Jan Kara , Vitaly Wool And List-Id: linux-arch.vger.kernel.org On Thu, Jul 7, 2016 at 12:35 PM, Rik van Riel wrote: > On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >> >> + /* Allow kernel rodata region (if not marked as Reserved). >> */ >> + if (ptr >= (const void *)__start_rodata && >> + end <= (const void *)__end_rodata) >> + return NULL; >> > One comment here. > > __check_object_size gets "to_user" as an argument. > > It may make sense to pass that to check_heap_object, and > only allow copy_to_user from rodata, never copy_from_user, > since that section should be read only. Well, that's two votes for this extra check, but I'm still not sure since it may already be allowed by the Reserved check, but I can reorder things to _reject_ on rodata writes before the Reserved check, etc. I'll see what could work here... -Kees > >> +void __check_object_size(const void *ptr, unsigned long n, bool >> to_user) >> +{ >> > > -- > > All Rights Reversed. -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f49.google.com ([74.125.82.49]:35028 "EHLO mail-wm0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752496AbcGGRlc (ORCPT ); Thu, 7 Jul 2016 13:41:32 -0400 Received: by mail-wm0-f49.google.com with SMTP id z126so157503585wme.0 for ; Thu, 07 Jul 2016 10:41:32 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <1467909317.13253.17.camel@redhat.com> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> <1467909317.13253.17.camel@redhat.com> From: Kees Cook Date: Thu, 7 Jul 2016 13:41:30 -0400 Message-ID: Subject: Re: [PATCH 1/9] mm: Hardened usercopy Content-Type: text/plain; charset=UTF-8 Sender: linux-arch-owner@vger.kernel.org List-ID: To: Rik van Riel Cc: LKML , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , Laura Abbott , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" Message-ID: <20160707174130.1mR2rLll7OMc5TyTMOS7FoVVNIWXDx0IpRMhK2Co53M@z> On Thu, Jul 7, 2016 at 12:35 PM, Rik van Riel wrote: > On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >> >> + /* Allow kernel rodata region (if not marked as Reserved). >> */ >> + if (ptr >= (const void *)__start_rodata && >> + end <= (const void *)__end_rodata) >> + return NULL; >> > One comment here. > > __check_object_size gets "to_user" as an argument. > > It may make sense to pass that to check_heap_object, and > only allow copy_to_user from rodata, never copy_from_user, > since that section should be read only. Well, that's two votes for this extra check, but I'm still not sure since it may already be allowed by the Reserved check, but I can reorder things to _reject_ on rodata writes before the Reserved check, etc. I'll see what could work here... -Kees > >> +void __check_object_size(const void *ptr, unsigned long n, bool >> to_user) >> +{ >> > > -- > > All Rights Reversed. -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Date: Thu, 07 Jul 2016 17:41:30 +0000 Subject: Re: [PATCH 1/9] mm: Hardened usercopy Message-Id: List-Id: References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> <1467909317.13253.17.camel@redhat.com> In-Reply-To: <1467909317.13253.17.camel@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Rik van Riel Cc: LKML , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , Laura Abbott , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" On Thu, Jul 7, 2016 at 12:35 PM, Rik van Riel wrote: > On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >> >> + /* Allow kernel rodata region (if not marked as Reserved). >> */ >> + if (ptr >= (const void *)__start_rodata && >> + end <= (const void *)__end_rodata) >> + return NULL; >> > One comment here. > > __check_object_size gets "to_user" as an argument. > > It may make sense to pass that to check_heap_object, and > only allow copy_to_user from rodata, never copy_from_user, > since that section should be read only. Well, that's two votes for this extra check, but I'm still not sure since it may already be allowed by the Reserved check, but I can reorder things to _reject_ on rodata writes before the Reserved check, etc. I'll see what could work here... -Kees > >> +void __check_object_size(const void *ptr, unsigned long n, bool >> to_user) >> +{ >> > > -- > > All Rights Reversed. -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-wm0-f69.google.com (mail-wm0-f69.google.com [74.125.82.69]) by kanga.kvack.org (Postfix) with ESMTP id 865D06B025E for ; Thu, 7 Jul 2016 13:41:32 -0400 (EDT) Received: by mail-wm0-f69.google.com with SMTP id n127so143264wme.1 for ; Thu, 07 Jul 2016 10:41:32 -0700 (PDT) Received: from mail-wm0-x22a.google.com (mail-wm0-x22a.google.com. [2a00:1450:400c:c09::22a]) by mx.google.com with ESMTPS id uw2si3946171wjb.55.2016.07.07.10.41.31 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 07 Jul 2016 10:41:31 -0700 (PDT) Received: by mail-wm0-x22a.google.com with SMTP id n127so25179987wme.1 for ; Thu, 07 Jul 2016 10:41:31 -0700 (PDT) MIME-Version: 1.0 In-Reply-To: <1467909317.13253.17.camel@redhat.com> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> <1467909317.13253.17.camel@redhat.com> From: Kees Cook Date: Thu, 7 Jul 2016 13:41:30 -0400 Message-ID: Subject: Re: [PATCH 1/9] mm: Hardened usercopy Content-Type: text/plain; charset=UTF-8 Sender: owner-linux-mm@kvack.org List-ID: To: Rik van Riel Cc: LKML , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , Laura Abbott , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" On Thu, Jul 7, 2016 at 12:35 PM, Rik van Riel wrote: > On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >> >> + /* Allow kernel rodata region (if not marked as Reserved). >> */ >> + if (ptr >= (const void *)__start_rodata && >> + end <= (const void *)__end_rodata) >> + return NULL; >> > One comment here. > > __check_object_size gets "to_user" as an argument. > > It may make sense to pass that to check_heap_object, and > only allow copy_to_user from rodata, never copy_from_user, > since that section should be read only. Well, that's two votes for this extra check, but I'm still not sure since it may already be allowed by the Reserved check, but I can reorder things to _reject_ on rodata writes before the Reserved check, etc. I'll see what could work here... -Kees > >> +void __check_object_size(const void *ptr, unsigned long n, bool >> to_user) >> +{ >> > > -- > > All Rights Reversed. -- Kees Cook Chrome OS & Brillo Security -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 From: keescook@chromium.org (Kees Cook) Date: Thu, 7 Jul 2016 13:41:30 -0400 Subject: [PATCH 1/9] mm: Hardened usercopy In-Reply-To: <1467909317.13253.17.camel@redhat.com> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> <1467909317.13253.17.camel@redhat.com> Message-ID: To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Thu, Jul 7, 2016 at 12:35 PM, Rik van Riel wrote: > On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >> >> + /* Allow kernel rodata region (if not marked as Reserved). >> */ >> + if (ptr >= (const void *)__start_rodata && >> + end <= (const void *)__end_rodata) >> + return NULL; >> > One comment here. > > __check_object_size gets "to_user" as an argument. > > It may make sense to pass that to check_heap_object, and > only allow copy_to_user from rodata, never copy_from_user, > since that section should be read only. Well, that's two votes for this extra check, but I'm still not sure since it may already be allowed by the Reserved check, but I can reorder things to _reject_ on rodata writes before the Reserved check, etc. I'll see what could work here... -Kees > >> +void __check_object_size(const void *ptr, unsigned long n, bool >> to_user) >> +{ >> > > -- > > All Rights Reversed. -- Kees Cook Chrome OS & Brillo Security From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: <1467909317.13253.17.camel@redhat.com> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org> <1467909317.13253.17.camel@redhat.com> From: Kees Cook Date: Thu, 7 Jul 2016 13:41:30 -0400 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [PATCH 1/9] mm: Hardened usercopy To: Rik van Riel Cc: LKML , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , Laura Abbott , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" List-ID: On Thu, Jul 7, 2016 at 12:35 PM, Rik van Riel wrote: > On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote: >> >> + /* Allow kernel rodata region (if not marked as Reserved). >> */ >> + if (ptr >= (const void *)__start_rodata && >> + end <= (const void *)__end_rodata) >> + return NULL; >> > One comment here. > > __check_object_size gets "to_user" as an argument. > > It may make sense to pass that to check_heap_object, and > only allow copy_to_user from rodata, never copy_from_user, > since that section should be read only. Well, that's two votes for this extra check, but I'm still not sure since it may already be allowed by the Reserved check, but I can reorder things to _reject_ on rodata writes before the Reserved check, etc. I'll see what could work here... -Kees > >> +void __check_object_size(const void *ptr, unsigned long n, bool >> to_user) >> +{ >> > > -- > > All Rights Reversed. -- Kees Cook Chrome OS & Brillo Security