Commit 80a77045 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'usercopy-v4.8-rc6-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull more hardened usercopyfixes from Kees Cook:

 - force check_object_size() to be inline too

 - move page-spanning check behind a CONFIG since it's triggering false
   positives

[ Changed the page-spanning config option to depend on EXPERT in the
  merge.  That way it still gets build testing, and you can enable it if
  you want to, but is never enabled for "normal" configurations ]

* tag 'usercopy-v4.8-rc6-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  usercopy: remove page-spanning test for now
  usercopy: force check_object_size() inline
parents ab29b33a 8e1f74ea
...@@ -118,8 +118,8 @@ static inline int arch_within_stack_frames(const void * const stack, ...@@ -118,8 +118,8 @@ static inline int arch_within_stack_frames(const void * const stack,
extern void __check_object_size(const void *ptr, unsigned long n, extern void __check_object_size(const void *ptr, unsigned long n,
bool to_user); bool to_user);
static inline void check_object_size(const void *ptr, unsigned long n, static __always_inline void check_object_size(const void *ptr, unsigned long n,
bool to_user) bool to_user)
{ {
if (!__builtin_constant_p(n)) if (!__builtin_constant_p(n))
__check_object_size(ptr, n, to_user); __check_object_size(ptr, n, to_user);
......
...@@ -134,30 +134,15 @@ static inline const char *check_bogus_address(const void *ptr, unsigned long n) ...@@ -134,30 +134,15 @@ static inline const char *check_bogus_address(const void *ptr, unsigned long n)
return NULL; return NULL;
} }
static inline const char *check_heap_object(const void *ptr, unsigned long n, /* Checks for allocs that are marked in some way as spanning multiple pages. */
bool to_user) static inline const char *check_page_span(const void *ptr, unsigned long n,
struct page *page, bool to_user)
{ {
struct page *page, *endpage; #ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN
const void *end = ptr + n - 1; const void *end = ptr + n - 1;
struct page *endpage;
bool is_reserved, is_cma; bool is_reserved, is_cma;
/*
* Some architectures (arm64) return true for virt_addr_valid() on
* vmalloced addresses. Work around this by checking for vmalloc
* first.
*/
if (is_vmalloc_addr(ptr))
return NULL;
if (!virt_addr_valid(ptr))
return NULL;
page = virt_to_head_page(ptr);
/* Check slab allocator for flags and size. */
if (PageSlab(page))
return __check_heap_object(ptr, n, page);
/* /*
* Sometimes the kernel data regions are not marked Reserved (see * Sometimes the kernel data regions are not marked Reserved (see
* check below). And sometimes [_sdata,_edata) does not cover * check below). And sometimes [_sdata,_edata) does not cover
...@@ -186,7 +171,7 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n, ...@@ -186,7 +171,7 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n,
((unsigned long)end & (unsigned long)PAGE_MASK))) ((unsigned long)end & (unsigned long)PAGE_MASK)))
return NULL; return NULL;
/* Allow if start and end are inside the same compound page. */ /* Allow if fully inside the same compound (__GFP_COMP) page. */
endpage = virt_to_head_page(end); endpage = virt_to_head_page(end);
if (likely(endpage == page)) if (likely(endpage == page))
return NULL; return NULL;
...@@ -199,20 +184,44 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n, ...@@ -199,20 +184,44 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n,
is_reserved = PageReserved(page); is_reserved = PageReserved(page);
is_cma = is_migrate_cma_page(page); is_cma = is_migrate_cma_page(page);
if (!is_reserved && !is_cma) if (!is_reserved && !is_cma)
goto reject; return "<spans multiple pages>";
for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) { for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) {
page = virt_to_head_page(ptr); page = virt_to_head_page(ptr);
if (is_reserved && !PageReserved(page)) if (is_reserved && !PageReserved(page))
goto reject; return "<spans Reserved and non-Reserved pages>";
if (is_cma && !is_migrate_cma_page(page)) if (is_cma && !is_migrate_cma_page(page))
goto reject; return "<spans CMA and non-CMA pages>";
} }
#endif
return NULL; return NULL;
}
static inline const char *check_heap_object(const void *ptr, unsigned long n,
bool to_user)
{
struct page *page;
/*
* Some architectures (arm64) return true for virt_addr_valid() on
* vmalloced addresses. Work around this by checking for vmalloc
* first.
*/
if (is_vmalloc_addr(ptr))
return NULL;
if (!virt_addr_valid(ptr))
return NULL;
page = virt_to_head_page(ptr);
/* Check slab allocator for flags and size. */
if (PageSlab(page))
return __check_heap_object(ptr, n, page);
reject: /* Verify object does not incorrectly span multiple pages. */
return "<spans multiple pages>"; return check_page_span(ptr, n, page, to_user);
} }
/* /*
......
...@@ -147,6 +147,17 @@ config HARDENED_USERCOPY ...@@ -147,6 +147,17 @@ config HARDENED_USERCOPY
or are part of the kernel text. This kills entire classes or are part of the kernel text. This kills entire classes
of heap overflow exploits and similar kernel memory exposures. of heap overflow exploits and similar kernel memory exposures.
config HARDENED_USERCOPY_PAGESPAN
bool "Refuse to copy allocations that span multiple pages"
depends on HARDENED_USERCOPY
depends on EXPERT
help
When a multi-page allocation is done without __GFP_COMP,
hardened usercopy will reject attempts to copy it. There are,
however, several cases of this in the kernel that have not all
been removed. This config is intended to be used only while
trying to find such users.
source security/selinux/Kconfig source security/selinux/Kconfig
source security/smack/Kconfig source security/smack/Kconfig
source security/tomoyo/Kconfig source security/tomoyo/Kconfig
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment