From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750891AbdE1Rfi (ORCPT ); Sun, 28 May 2017 13:35:38 -0400 Received: from mail-it0-f51.google.com ([209.85.214.51]:32769 "EHLO mail-it0-f51.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750797AbdE1Rfg (ORCPT ); Sun, 28 May 2017 13:35:36 -0400 MIME-Version: 1.0 In-Reply-To: <20170528081541.GE22193@infradead.org> References: <1495829844-69341-1-git-send-email-keescook@chromium.org> <1495829844-69341-9-git-send-email-keescook@chromium.org> <20170528081541.GE22193@infradead.org> From: Kees Cook Date: Sun, 28 May 2017 10:35:34 -0700 X-Google-Sender-Auth: omlfDrzUSwaz61iHWxpFMiZA9VQ Message-ID: Subject: Re: [PATCH v2 08/20] randstruct: Whitelist NIU struct page overloading To: Christoph Hellwig , linux-mm@vger.kernel.org, Network Development Cc: "kernel-hardening@lists.openwall.com" , "David S . Miller" , Laura Abbott , "x86@kernel.org" , LKML Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by mail.home.local id v4SHZh41032559 On Sun, May 28, 2017 at 1:15 AM, Christoph Hellwig wrote: > On Fri, May 26, 2017 at 01:17:12PM -0700, Kees Cook wrote: >> The NIU ethernet driver intentionally stores a page struct pointer on >> top of the "mapping" field. Whitelist this case: >> >> drivers/net/ethernet/sun/niu.c: In function ‘niu_rx_pkt_ignore’: >> drivers/net/ethernet/sun/niu.c:3402:10: note: found mismatched ssa struct pointer types: ‘struct page’ and ‘struct address_space’ >> >> *link = (struct page *) page->mapping; >> ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> >> Cc: David S. Miller >> Signed-off-by: Kees Cook > > The driver really needs to stop doing this anyway. It would be good > to send this out to linux-mm and netdev to come up with a better scheme. Added to To. :) I couldn't understand why it was doing what it was doing, hence the whitelist entry. -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: Re: [PATCH v2 08/20] randstruct: Whitelist NIU struct page overloading Date: Sun, 28 May 2017 10:35:34 -0700 Message-ID: References: <1495829844-69341-1-git-send-email-keescook@chromium.org> <1495829844-69341-9-git-send-email-keescook@chromium.org> <20170528081541.GE22193@infradead.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Cc: "kernel-hardening@lists.openwall.com" , "David S . Miller" , Laura Abbott , "x86@kernel.org" , LKML To: Christoph Hellwig , linux-mm@vger.kernel.org, Network Development Return-path: List-Post: List-Help: List-Unsubscribe: List-Subscribe: Sender: keescook@google.com In-Reply-To: <20170528081541.GE22193@infradead.org> List-Id: netdev.vger.kernel.org On Sun, May 28, 2017 at 1:15 AM, Christoph Hellwig wrot= e: > On Fri, May 26, 2017 at 01:17:12PM -0700, Kees Cook wrote: >> The NIU ethernet driver intentionally stores a page struct pointer on >> top of the "mapping" field. Whitelist this case: >> >> drivers/net/ethernet/sun/niu.c: In function =E2=80=98niu_rx_pkt_ignore= =E2=80=99: >> drivers/net/ethernet/sun/niu.c:3402:10: note: found mismatched ssa struc= t pointer types: =E2=80=98struct page=E2=80=99 and =E2=80=98struct address_= space=E2=80=99 >> >> *link =3D (struct page *) page->mapping; >> ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> >> Cc: David S. Miller >> Signed-off-by: Kees Cook > > The driver really needs to stop doing this anyway. It would be good > to send this out to linux-mm and netdev to come up with a better scheme. Added to To. :) I couldn't understand why it was doing what it was doing, hence the whitelist entry. -Kees --=20 Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: <20170528081541.GE22193@infradead.org> References: <1495829844-69341-1-git-send-email-keescook@chromium.org> <1495829844-69341-9-git-send-email-keescook@chromium.org> <20170528081541.GE22193@infradead.org> From: Kees Cook Date: Sun, 28 May 2017 10:35:34 -0700 Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Subject: [kernel-hardening] Re: [PATCH v2 08/20] randstruct: Whitelist NIU struct page overloading To: Christoph Hellwig , linux-mm@vger.kernel.org, Network Development Cc: "kernel-hardening@lists.openwall.com" , "David S . Miller" , Laura Abbott , "x86@kernel.org" , LKML List-ID: On Sun, May 28, 2017 at 1:15 AM, Christoph Hellwig wrot= e: > On Fri, May 26, 2017 at 01:17:12PM -0700, Kees Cook wrote: >> The NIU ethernet driver intentionally stores a page struct pointer on >> top of the "mapping" field. Whitelist this case: >> >> drivers/net/ethernet/sun/niu.c: In function =E2=80=98niu_rx_pkt_ignore= =E2=80=99: >> drivers/net/ethernet/sun/niu.c:3402:10: note: found mismatched ssa struc= t pointer types: =E2=80=98struct page=E2=80=99 and =E2=80=98struct address_= space=E2=80=99 >> >> *link =3D (struct page *) page->mapping; >> ~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ >> >> Cc: David S. Miller >> Signed-off-by: Kees Cook > > The driver really needs to stop doing this anyway. It would be good > to send this out to linux-mm and netdev to come up with a better scheme. Added to To. :) I couldn't understand why it was doing what it was doing, hence the whitelist entry. -Kees --=20 Kees Cook Pixel Security