From patchwork Wed Sep 20 20:45:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 816496 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=linux-ext4-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b="fGxlDpm3"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3xyBjg4Ryhz9s83 for ; Thu, 21 Sep 2017 06:51:19 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751629AbdITUvC (ORCPT ); Wed, 20 Sep 2017 16:51:02 -0400 Received: from mail-pf0-f179.google.com ([209.85.192.179]:51929 "EHLO mail-pf0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751840AbdITUqE (ORCPT ); Wed, 20 Sep 2017 16:46:04 -0400 Received: by mail-pf0-f179.google.com with SMTP id b70so2105574pfl.8 for ; Wed, 20 Sep 2017 13:46:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=KHkA7gLl/RRGwjgOyKwgdPKfIPgF/zMmJeyAmhW6qOw=; b=fGxlDpm3vc2fA/Jp5Y2utCd8pLahnUqHH5urnUO7T33XIdpYnf5EunhApaWtZvFXBZ PP+lhfzIhN9MC0fnMUrQ9qt/JSve+OY+MsYnT/FJhB5yMZzXWXge3oL7ZWAxcNwbq2qu 3SKnK0rXsWfG0Ow1+CiA5mroMmV9Rrhn3IR/Q= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=KHkA7gLl/RRGwjgOyKwgdPKfIPgF/zMmJeyAmhW6qOw=; b=U7mdo5kzG1R3ZuTszwpdhihPpSsUaPw4xcXtE5OrVeDLdWoaCHU0s+T7ZkWy5eEUKI 8g5CnoK8khlXOZrlioFXFFLKm4I18spx4Vvi2+yMJV3HRhg3AVFPLOykfTNUgyR3yW1C YBSJ2uYQveQnOIalnK5rtW980qQPpcpKuwIGmKHKVN3+zRO1fO6VGAc92megdt9e7BlZ ciB55w1e7jygLxuRAGGzYr3+qDyiU00eGvsBrdfEzts+419YgWdijC8l28rMCZ54R9pI A1XP8xChdXtjD+GLjKrbBMDYGC4tNRJoBej9leBMayn9F2YUmJiSZT/ryylweSRAgSjV QXyA== X-Gm-Message-State: AHPjjUigzLHkOszv+BjpJ+jevUpbi04+2AGUrzIaLOSOgR/hpCutMf9f kmhTlNECxndHXu8nSsIcqlOTMw== X-Google-Smtp-Source: AOwi7QBE2T8Sem0JxX+dZ9g2uiwe37WR/RLJbYDb7rpoqIGffREbz1I7t/Lcwl6Yfi31ksHmVR+rSg== X-Received: by 10.98.211.200 with SMTP id z69mr3328748pfk.112.1505940364314; Wed, 20 Sep 2017 13:46:04 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id x13sm9309894pgt.16.2017.09.20.13.45.57 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 20 Sep 2017 13:46:00 -0700 (PDT) From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Kees Cook , David Windsor , "Theodore Ts'o" , Andreas Dilger , linux-ext4@vger.kernel.org, linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com Subject: [PATCH v3 07/31] ext4: Define usercopy region in ext4_inode_cache slab cache Date: Wed, 20 Sep 2017 13:45:13 -0700 Message-Id: <1505940337-79069-8-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1505940337-79069-1-git-send-email-keescook@chromium.org> References: <1505940337-79069-1-git-send-email-keescook@chromium.org> Sender: linux-ext4-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-ext4@vger.kernel.org From: David Windsor The ext4 symlink pathnames, stored in struct ext4_inode_info.i_data and therefore contained in the ext4_inode_cache slab cache, need to be copied to/from userspace. cache object allocation: fs/ext4/super.c: ext4_alloc_inode(...): struct ext4_inode_info *ei; ... ei = kmem_cache_alloc(ext4_inode_cachep, GFP_NOFS); ... return &ei->vfs_inode; include/trace/events/ext4.h: #define EXT4_I(inode) \ (container_of(inode, struct ext4_inode_info, vfs_inode)) fs/ext4/namei.c: ext4_symlink(...): ... inode->i_link = (char *)&EXT4_I(inode)->i_data; example usage trace: readlink_copy+0x43/0x70 vfs_readlink+0x62/0x110 SyS_readlinkat+0x100/0x130 fs/namei.c: readlink_copy(..., link): ... copy_to_user(..., link, len) (inlined into vfs_readlink) generic_readlink(dentry, ...): struct inode *inode = d_inode(dentry); const char *link = inode->i_link; ... readlink_copy(..., link); In support of usercopy hardening, this patch defines a region in the ext4_inode_cache slab cache in which userspace copy operations are allowed. This region is known as the slab cache's usercopy region. Slab caches can now check that each copy operation involving cache-managed memory falls entirely within the slab's usercopy region. This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY whitelisting code in the last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original code are mine and don't reflect the original grsecurity/PaX code. Signed-off-by: David Windsor [kees: adjust commit log, provide usage trace] Cc: "Theodore Ts'o" Cc: Andreas Dilger Cc: linux-ext4@vger.kernel.org Signed-off-by: Kees Cook --- fs/ext4/super.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/fs/ext4/super.c b/fs/ext4/super.c index b104096fce9e..b5d393321b7b 100644 --- a/fs/ext4/super.c +++ b/fs/ext4/super.c @@ -1036,11 +1036,13 @@ static void init_once(void *foo) static int __init init_inodecache(void) { - ext4_inode_cachep = kmem_cache_create("ext4_inode_cache", - sizeof(struct ext4_inode_info), - 0, (SLAB_RECLAIM_ACCOUNT| - SLAB_MEM_SPREAD|SLAB_ACCOUNT), - init_once); + ext4_inode_cachep = kmem_cache_create_usercopy("ext4_inode_cache", + sizeof(struct ext4_inode_info), 0, + (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD| + SLAB_ACCOUNT), + offsetof(struct ext4_inode_info, i_data), + sizeof_field(struct ext4_inode_info, i_data), + init_once); if (ext4_inode_cachep == NULL) return -ENOMEM; return 0;