netdev - Re: [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region boundaries

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.20.1709211022550.14427@nuc-kabylake>
Date:   Thu, 21 Sep 2017 10:23:45 -0500 (CDT)
From:   Christopher Lameter <cl@...ux.com>
To:     Kees Cook <keescook@...omium.org>
cc:     linux-kernel@...r.kernel.org, David Windsor <dave@...lcore.net>,
        Pekka Enberg <penberg@...nel.org>,
        David Rientjes <rientjes@...gle.com>,
        Joonsoo Kim <iamjoonsoo.kim@....com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Laura Abbott <labbott@...hat.com>,
        Ingo Molnar <mingo@...nel.org>,
        Mark Rutland <mark.rutland@....com>, linux-mm@...ck.org,
        linux-xfs@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        netdev@...r.kernel.org, kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region
 boundaries

On Wed, 20 Sep 2017, Kees Cook wrote:

> diff --git a/mm/slab.c b/mm/slab.c
> index 87b6e5e0cdaf..df268999cf02 100644
> --- a/mm/slab.c
> +++ b/mm/slab.c
> @@ -4408,7 +4408,9 @@ module_init(slab_proc_init);
>
>  #ifdef CONFIG_HARDENED_USERCOPY
>  /*
> - * Rejects objects that are incorrectly sized.
> + * Rejects incorrectly sized objects and objects that are to be copied
> + * to/from userspace but do not fall entirely within the containing slab
> + * cache's usercopy region.
>   *
>   * Returns NULL if check passes, otherwise const char * to name of cache
>   * to indicate an error.
> @@ -4428,11 +4430,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
>  	/* Find offset within object. */
>  	offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
>
> -	/* Allow address range falling entirely within object size. */
> -	if (offset <= cachep->object_size && n <= cachep->object_size - offset)
> -		return NULL;
> +	/* Make sure object falls entirely within cache's usercopy region. */
> +	if (offset < cachep->useroffset)
> +		return cachep->name;
> +	if (offset - cachep->useroffset > cachep->usersize)
> +		return cachep->name;
> +	if (n > cachep->useroffset - offset + cachep->usersize)
> +		return cachep->name;
>
> -	return cachep->name;
> +	return NULL;
>  }
>  #endif /* CONFIG_HARDENED_USERCOPY */

Looks like this is almost the same for all allocators. Can we put this
into mm/slab_common.c?