Commit 80a77045 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'usercopy-v4.8-rc6-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull more hardened usercopyfixes from Kees Cook:

 - force check_object_size() to be inline too

 - move page-spanning check behind a CONFIG since it's triggering false
   positives

[ Changed the page-spanning config option to depend on EXPERT in the
  merge.  That way it still gets build testing, and you can enable it if
  you want to, but is never enabled for "normal" configurations ]

* tag 'usercopy-v4.8-rc6-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  usercopy: remove page-spanning test for now
  usercopy: force check_object_size() inline
parents ab29b33a 8e1f74ea

include/linux/thread_info.h

+2 −2
Original line number Original line Diff line number Diff line
@@ -118,7 +118,7 @@ static inline int arch_within_stack_frames(const void * const stack, 
extern void __check_object_size(const void *ptr, unsigned long n,

extern void __check_object_size(const void *ptr, unsigned long n,

					bool to_user);

					bool to_user);





static inline void check_object_size(const void *ptr, unsigned long n,

static __always_inline void check_object_size(const void *ptr, unsigned long n,

					      bool to_user)

					      bool to_user)

{

{

	if (!__builtin_constant_p(n))

	if (!__builtin_constant_p(n))

mm/usercopy.c

+35 −26
Original line number Original line Diff line number Diff line
@@ -134,30 +134,15 @@ static inline const char *check_bogus_address(const void *ptr, unsigned long n) 
	return NULL;

	return NULL;

}

}





static inline const char *check_heap_object(const void *ptr, unsigned long n,

/* Checks for allocs that are marked in some way as spanning multiple pages. */

					    bool to_user)

static inline const char *check_page_span(const void *ptr, unsigned long n,

					  struct page *page, bool to_user)

{

{

	struct page *page, *endpage;

#ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN

	const void *end = ptr + n - 1;

	const void *end = ptr + n - 1;

	struct page *endpage;

	bool is_reserved, is_cma;

	bool is_reserved, is_cma;





	/*

	 * Some architectures (arm64) return true for virt_addr_valid() on

	 * vmalloced addresses. Work around this by checking for vmalloc

	 * first.

	 */

	if (is_vmalloc_addr(ptr))

		return NULL;



	if (!virt_addr_valid(ptr))

		return NULL;



	page = virt_to_head_page(ptr);



	/* Check slab allocator for flags and size. */

	if (PageSlab(page))

		return __check_heap_object(ptr, n, page);



	/*

	/*

	 * Sometimes the kernel data regions are not marked Reserved (see

	 * Sometimes the kernel data regions are not marked Reserved (see

	 * check below). And sometimes [_sdata,_edata) does not cover

	 * check below). And sometimes [_sdata,_edata) does not cover
@@ -186,7 +171,7 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n, 
		   ((unsigned long)end & (unsigned long)PAGE_MASK)))

		   ((unsigned long)end & (unsigned long)PAGE_MASK)))

		return NULL;

		return NULL;





	/* Allow if start and end are inside the same compound page. */

	/* Allow if fully inside the same compound (__GFP_COMP) page. */

	endpage = virt_to_head_page(end);

	endpage = virt_to_head_page(end);

	if (likely(endpage == page))

	if (likely(endpage == page))

		return NULL;

		return NULL;
@@ -199,20 +184,44 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n, 
	is_reserved = PageReserved(page);

	is_reserved = PageReserved(page);

	is_cma = is_migrate_cma_page(page);

	is_cma = is_migrate_cma_page(page);

	if (!is_reserved && !is_cma)

	if (!is_reserved && !is_cma)

		goto reject;

		return "<spans multiple pages>";





	for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) {

	for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) {

		page = virt_to_head_page(ptr);

		page = virt_to_head_page(ptr);

		if (is_reserved && !PageReserved(page))

		if (is_reserved && !PageReserved(page))

			goto reject;

			return "<spans Reserved and non-Reserved pages>";

		if (is_cma && !is_migrate_cma_page(page))

		if (is_cma && !is_migrate_cma_page(page))

			goto reject;

			return "<spans CMA and non-CMA pages>";

	}

	}

#endif





	return NULL;

	return NULL;

}





reject:

static inline const char *check_heap_object(const void *ptr, unsigned long n,

	return "<spans multiple pages>";

					    bool to_user)

{

	struct page *page;



	/*

	 * Some architectures (arm64) return true for virt_addr_valid() on

	 * vmalloced addresses. Work around this by checking for vmalloc

	 * first.

	 */

	if (is_vmalloc_addr(ptr))

		return NULL;



	if (!virt_addr_valid(ptr))

		return NULL;



	page = virt_to_head_page(ptr);



	/* Check slab allocator for flags and size. */

	if (PageSlab(page))

		return __check_heap_object(ptr, n, page);



	/* Verify object does not incorrectly span multiple pages. */

	return check_page_span(ptr, n, page, to_user);

}

}





/*

/*

security/Kconfig

+11 −0
Original line number Original line Diff line number Diff line
@@ -147,6 +147,17 @@ config HARDENED_USERCOPY 
	  or are part of the kernel text. This kills entire classes

	  or are part of the kernel text. This kills entire classes

	  of heap overflow exploits and similar kernel memory exposures.

	  of heap overflow exploits and similar kernel memory exposures.





config HARDENED_USERCOPY_PAGESPAN

	bool "Refuse to copy allocations that span multiple pages"

	depends on HARDENED_USERCOPY

	depends on EXPERT

	help

	  When a multi-page allocation is done without __GFP_COMP,

	  hardened usercopy will reject attempts to copy it. There are,

	  however, several cases of this in the kernel that have not all

	  been removed. This config is intended to be used only while

	  trying to find such users.



source security/selinux/Kconfig

source security/selinux/Kconfig

source security/smack/Kconfig

source security/smack/Kconfig

source security/tomoyo/Kconfig

source security/tomoyo/Kconfig

CRA Git | Maintained and supported by SUSTech CRA and CCSE