From: Christopher Lameter <cl@linux.com>
To: Kees Cook <keescook@chromium.org>
Cc: linux-kernel@vger.kernel.org, David Windsor <dave@nullcore.net>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Andrew Morton <akpm@linux-foundation.org>,
Laura Abbott <labbott@redhat.com>, Ingo Molnar <mingo@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
linux-mm@kvack.org, linux-xfs@vger.kernel.org,
linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org,
kernel-hardening@lists.openwall.com
Subject: Re: [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region boundaries
Date: Thu, 21 Sep 2017 10:23:45 -0500 (CDT) [thread overview]
Message-ID: <alpine.DEB.2.20.1709211022550.14427@nuc-kabylake> (raw)
In-Reply-To: <1505940337-79069-3-git-send-email-keescook@chromium.org>
On Wed, 20 Sep 2017, Kees Cook wrote:
> diff --git a/mm/slab.c b/mm/slab.c
> index 87b6e5e0cdaf..df268999cf02 100644
> --- a/mm/slab.c
> +++ b/mm/slab.c
> @@ -4408,7 +4408,9 @@ module_init(slab_proc_init);
>
> #ifdef CONFIG_HARDENED_USERCOPY
> /*
> - * Rejects objects that are incorrectly sized.
> + * Rejects incorrectly sized objects and objects that are to be copied
> + * to/from userspace but do not fall entirely within the containing slab
> + * cache's usercopy region.
> *
> * Returns NULL if check passes, otherwise const char * to name of cache
> * to indicate an error.
> @@ -4428,11 +4430,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
> /* Find offset within object. */
> offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
>
> - /* Allow address range falling entirely within object size. */
> - if (offset <= cachep->object_size && n <= cachep->object_size - offset)
> - return NULL;
> + /* Make sure object falls entirely within cache's usercopy region. */
> + if (offset < cachep->useroffset)
> + return cachep->name;
> + if (offset - cachep->useroffset > cachep->usersize)
> + return cachep->name;
> + if (n > cachep->useroffset - offset + cachep->usersize)
> + return cachep->name;
>
> - return cachep->name;
> + return NULL;
> }
> #endif /* CONFIG_HARDENED_USERCOPY */
Looks like this is almost the same for all allocators. Can we put this
into mm/slab_common.c?
WARNING: multiple messages have this Message-ID (diff)
From: Christopher Lameter <cl@linux.com>
To: Kees Cook <keescook@chromium.org>
Cc: linux-kernel@vger.kernel.org, David Windsor <dave@nullcore.net>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Andrew Morton <akpm@linux-foundation.org>,
Laura Abbott <labbott@redhat.com>, Ingo Molnar <mingo@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
linux-mm@kvack.org, linux-xfs@vger.kernel.org,
linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org,
kernel-hardening@lists.openwall.com
Subject: [kernel-hardening] Re: [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region boundaries
Date: Thu, 21 Sep 2017 10:23:45 -0500 (CDT) [thread overview]
Message-ID: <alpine.DEB.2.20.1709211022550.14427@nuc-kabylake> (raw)
In-Reply-To: <1505940337-79069-3-git-send-email-keescook@chromium.org>
On Wed, 20 Sep 2017, Kees Cook wrote:
> diff --git a/mm/slab.c b/mm/slab.c
> index 87b6e5e0cdaf..df268999cf02 100644
> --- a/mm/slab.c
> +++ b/mm/slab.c
> @@ -4408,7 +4408,9 @@ module_init(slab_proc_init);
>
> #ifdef CONFIG_HARDENED_USERCOPY
> /*
> - * Rejects objects that are incorrectly sized.
> + * Rejects incorrectly sized objects and objects that are to be copied
> + * to/from userspace but do not fall entirely within the containing slab
> + * cache's usercopy region.
> *
> * Returns NULL if check passes, otherwise const char * to name of cache
> * to indicate an error.
> @@ -4428,11 +4430,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
> /* Find offset within object. */
> offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
>
> - /* Allow address range falling entirely within object size. */
> - if (offset <= cachep->object_size && n <= cachep->object_size - offset)
> - return NULL;
> + /* Make sure object falls entirely within cache's usercopy region. */
> + if (offset < cachep->useroffset)
> + return cachep->name;
> + if (offset - cachep->useroffset > cachep->usersize)
> + return cachep->name;
> + if (n > cachep->useroffset - offset + cachep->usersize)
> + return cachep->name;
>
> - return cachep->name;
> + return NULL;
> }
> #endif /* CONFIG_HARDENED_USERCOPY */
Looks like this is almost the same for all allocators. Can we put this
into mm/slab_common.c?
next prev parent reply other threads:[~2017-09-21 15:23 UTC|newest]
Thread overview: 133+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-20 20:45 [PATCH v3 00/31] Hardened usercopy whitelisting Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 01/31] usercopy: Prepare for " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-21 15:21 ` Christopher Lameter
2017-09-21 15:21 ` [kernel-hardening] " Christopher Lameter
2017-09-20 20:45 ` [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region boundaries Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-21 15:23 ` Christopher Lameter [this message]
2017-09-21 15:23 ` [kernel-hardening] " Christopher Lameter
2017-09-20 20:45 ` [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-21 15:27 ` Christopher Lameter
2017-09-21 15:27 ` [kernel-hardening] " Christopher Lameter
2017-09-21 15:40 ` Kees Cook
2017-09-21 15:40 ` Kees Cook
2017-09-21 15:40 ` Kees Cook
2017-09-21 16:04 ` Christopher Lameter
2017-09-21 16:04 ` Christopher Lameter
2017-09-21 18:26 ` Kees Cook
2017-09-21 18:26 ` Kees Cook
2017-09-21 18:26 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 04/31] dcache: Define usercopy region in dentry_cache slab cache Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 05/31] vfs: Define usercopy region in names_cache slab caches Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 06/31] vfs: Copy struct mount.mnt_id to userspace using put_user() Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 07/31] ext4: Define usercopy region in ext4_inode_cache slab cache Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 08/31] ext2: Define usercopy region in ext2_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 09/31] jfs: Define usercopy region in jfs_ip " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-22 2:54 ` Dave Kleikamp
2017-09-22 2:54 ` [kernel-hardening] " Dave Kleikamp
2017-09-22 2:54 ` Dave Kleikamp
2017-09-20 20:45 ` [PATCH v3 10/31] befs: Define usercopy region in befs_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-21 9:34 ` Luis de Bethencourt
2017-09-21 9:34 ` [kernel-hardening] " Luis de Bethencourt
2017-09-21 9:34 ` Luis de Bethencourt
2017-09-20 20:45 ` [PATCH v3 11/31] exofs: Define usercopy region in exofs_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 12/31] orangefs: Define usercopy region in orangefs_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 13/31] ufs: Define usercopy region in ufs_inode_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 14/31] vxfs: Define usercopy region in vxfs_inode " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:56 ` Christoph Hellwig
2017-09-20 20:56 ` [kernel-hardening] " Christoph Hellwig
2017-09-20 20:56 ` Christoph Hellwig
2017-09-20 21:21 ` Kees Cook
2017-09-20 21:21 ` [kernel-hardening] " Kees Cook
2017-09-20 21:21 ` Kees Cook
2017-09-20 23:22 ` Christoph Hellwig
2017-09-20 23:22 ` [kernel-hardening] " Christoph Hellwig
2017-09-20 23:22 ` Christoph Hellwig
2017-09-20 23:22 ` Christoph Hellwig
2017-09-20 20:45 ` [PATCH v3 15/31] xfs: Define usercopy region in xfs_inode " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
[not found] ` <1505940337-79069-1-git-send-email-keescook-F7+t8E8rja9g9hUCZPvPmw@public.gmane.org>
2017-09-20 20:45 ` [PATCH v3 16/31] cifs: Define usercopy region in cifs_request " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 17/31] scsi: Define usercopy region in scsi_sense_cache " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 18/31] net: Define usercopy region in struct proto " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 19/31] ip: Define usercopy region in IP " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 20/31] caif: Define usercopy region in caif " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 21/31] sctp: Define usercopy region in SCTP " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 22/31] sctp: Copy struct sctp_sock.autoclose to userspace using put_user() Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 23/31] net: Restrict unwhitelisted proto caches to size 0 Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 24/31] fork: Define usercopy region in mm_struct slab caches Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 25/31] fork: Define usercopy region in thread_stack " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 26/31] fork: Provide usercopy whitelisting for task_struct Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 27/31] x86: Implement thread_struct whitelist for hardened usercopy Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 28/31] arm64: " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 29/31] arm: " Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 30/31] usercopy: Restrict non-usercopy caches to size 0 Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
2017-09-20 20:45 ` [PATCH v3 31/31] lkdtm: Update usercopy tests for whitelisting Kees Cook
2017-09-20 20:45 ` [kernel-hardening] " Kees Cook
2017-09-20 20:45 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=alpine.DEB.2.20.1709211022550.14427@nuc-kabylake \
--to=cl@linux.com \
--cc=akpm@linux-foundation.org \
--cc=dave@nullcore.net \
--cc=iamjoonsoo.kim@lge.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=labbott@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux-xfs@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mingo@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.