[{"id":1772926,"web_url":"http://patchwork.ozlabs.org/comment/1772926/","msgid":"","list_archive_url":null,"date":"2017-09-21T15:23:45","subject":"Re: [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region\n\tboundaries","submitter":{"id":2224,"url":"http://patchwork.ozlabs.org/api/people/2224/","name":"Christoph Lameter (Ampere)","email":"cl@linux.com"},"content":"On Wed, 20 Sep 2017, Kees Cook wrote:\n\n> diff --git a/mm/slab.c b/mm/slab.c\n> index 87b6e5e0cdaf..df268999cf02 100644\n> --- a/mm/slab.c\n> +++ b/mm/slab.c\n> @@ -4408,7 +4408,9 @@ module_init(slab_proc_init);\n>\n> #ifdef CONFIG_HARDENED_USERCOPY\n> /*\n> - * Rejects objects that are incorrectly sized.\n> + * Rejects incorrectly sized objects and objects that are to be copied\n> + * to/from userspace but do not fall entirely within the containing slab\n> + * cache's usercopy region.\n> *\n> * Returns NULL if check passes, otherwise const char * to name of cache\n> * to indicate an error.\n> @@ -4428,11 +4430,15 @@ const char *__check_heap_object(const void *ptr, unsigned long n,\n> \t/* Find offset within object. */\n> \toffset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);\n>\n> -\t/* Allow address range falling entirely within object size. */\n> -\tif (offset <= cachep->object_size && n <= cachep->object_size - offset)\n> -\t\treturn NULL;\n> +\t/* Make sure object falls entirely within cache's usercopy region. */\n> +\tif (offset < cachep->useroffset)\n> +\t\treturn cachep->name;\n> +\tif (offset - cachep->useroffset > cachep->usersize)\n> +\t\treturn cachep->name;\n> +\tif (n > cachep->useroffset - offset + cachep->usersize)\n> +\t\treturn cachep->name;\n>\n> -\treturn cachep->name;\n> +\treturn NULL;\n> }\n> #endif /* CONFIG_HARDENED_USERCOPY */\n\nLooks like this is almost the same for all allocators. Can we put this\ninto mm/slab_common.c?","headers":{"Return-Path":"","X-Original-To":"patchwork-incoming@ozlabs.org","Delivered-To":"patchwork-incoming@ozlabs.org","Authentication-Results":"ozlabs.org;\n\tspf=none (mailfrom) smtp.mailfrom=vger.kernel.org\n\t(client-ip=209.132.180.67; helo=vger.kernel.org;\n\tenvelope-from=netdev-owner@vger.kernel.org;\n\treceiver=)","Received":["from vger.kernel.org (vger.kernel.org [209.132.180.67])\n\tby ozlabs.org (Postfix) with ESMTP id 3xygVr73tBz9t4B\n\tfor ;\n\tFri, 22 Sep 2017 01:28:36 +1000 (AEST)","(majordomo@vger.kernel.org) by vger.kernel.org via listexpand\n\tid S1751781AbdIUP2f (ORCPT );\n\tThu, 21 Sep 2017 11:28:35 -0400","from resqmta-po-07v.sys.comcast.net ([96.114.154.166]:52520 \"EHLO\n\tresqmta-po-07v.sys.comcast.net\" rhost-flags-OK-OK-OK-OK)\n\tby vger.kernel.org with ESMTP id S1751675AbdIUP2d (ORCPT\n\t); Thu, 21 Sep 2017 11:28:33 -0400","from resomta-po-17v.sys.comcast.net ([96.114.154.241])\n\tby resqmta-po-07v.sys.comcast.net with ESMTP\n\tid v3K2dwYe88xG4v3KOd1WTD; Thu, 21 Sep 2017 15:23:48 +0000","from gentwo.org ([98.222.162.64])\n\tby resomta-po-17v.sys.comcast.net with SMTP\n\tid v3KLdtB7yH69qv3KMdEb2s; Thu, 21 Sep 2017 15:23:48 +0000","by gentwo.org (Postfix, from userid 1001)\n\tid BEC7211627C8; Thu, 21 Sep 2017 10:23:45 -0500 (CDT)","from localhost (localhost [127.0.0.1])\n\tby gentwo.org (Postfix) with ESMTP id BB70F11602E4;\n\tThu, 21 Sep 2017 10:23:45 -0500 (CDT)"],"X-Greylist":"delayed 434 seconds by postgrey-1.27 at vger.kernel.org;\n\tThu, 21 Sep 2017 11:28:33 EDT","Date":"Thu, 21 Sep 2017 10:23:45 -0500 (CDT)","From":"Christopher Lameter ","X-X-Sender":"cl@nuc-kabylake","To":"Kees Cook ","cc":"linux-kernel@vger.kernel.org, David Windsor ,\n\tPekka Enberg , David Rientjes ,\n\tJoonsoo Kim ,\n\tAndrew Morton ,\n\tLaura Abbott , Ingo Molnar ,\n\tMark Rutland , linux-mm@kvack.org,\n\tlinux-xfs@vger.kernel.org, linux-fsdevel@vger.kernel.org,\n\tnetdev@vger.kernel.org, kernel-hardening@lists.openwall.com","Subject":"Re: [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region\n\tboundaries","In-Reply-To":"<1505940337-79069-3-git-send-email-keescook@chromium.org>","Message-ID":"","References":"<1505940337-79069-1-git-send-email-keescook@chromium.org>\n\t<1505940337-79069-3-git-send-email-keescook@chromium.org>","User-Agent":"Alpine 2.20 (DEB 67 2015-01-07)","MIME-Version":"1.0","Content-Type":"text/plain; charset=US-ASCII","X-CMAE-Envelope":"MS4wfFn7AqO6rWFW6ppxsCVMoLxVfkDALygboEJgOJpCzPopLlB+ixGyoo9yTAbC6sMC6npdq40qXy0lXXeqHnsCmOAUnaHEJ0+8uxq40Esjyxs3EdKxtBgW\n\t328YlSD+agDN2i2a/p19lAFf4jy83glxWdU/0cN0L6ZiFHnEF3NOFT1+OM75XJ4vAwHYvqXUGAYLC3r/ilAzDEdjrUNVL7uLs67ff8X9PyIgg5TCnPdEZuNv\n\tpLrfyeJsxbVW3XXnB2wL4/FJqAnfDG8Br/eSW79pH1g2qpkSEegfu4HKnccryIJe3JWJS6g9tAOenjtPeiX1jkyH6LrZoIcirGDeX3eAYjYnOjxROGSSuPGq\n\tb+8Hclcjy0O1Fiuu+6XCkhIkJio5j8C9uSEloIjD+sBOMjwK1lKGcGShTnGJ8DxaYM+WWk97/Gk2dKJe3phL75pwGeMvkJrCSCI5mncIJUOK8MOAUr/cuK7e\n\tuopi9dTLhaaGdRP90aqiz4fr5933iJ0wxqEUG9MiUwPZMAGPgEaaniNb7/HTre1nMBL12CMQsLPOzDBpsH5kIv/gJGh+BaYlSNVPhOV0ArCpYAuKudG08c1H\n\ti9N3iI6p1Zb/kigeSaZbaatSTxPVVT4GVleIlxAPBTVkRmvljI/jHsh+ydjS0w66Ywo=","Sender":"netdev-owner@vger.kernel.org","Precedence":"bulk","List-ID":"","X-Mailing-List":"netdev@vger.kernel.org"}}]