From patchwork Wed Jul 6 22:25:27 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 645628 Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3rlFw51Xh7z9spN for ; Thu, 7 Jul 2016 08:36:05 +1000 (AEST) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b=iZSxDY5c; dkim-atps=neutral Received: from ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 3rlFw506J5zDr8B for ; Thu, 7 Jul 2016 08:36:05 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b=iZSxDY5c; dkim-atps=neutral X-Original-To: linuxppc-dev@lists.ozlabs.org Delivered-To: linuxppc-dev@lists.ozlabs.org Received: from mail-pf0-x236.google.com (mail-pf0-x236.google.com [IPv6:2607:f8b0:400e:c00::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3rlFhC5bK0zDr3n for ; Thu, 7 Jul 2016 08:25:47 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b=iZSxDY5c; dkim-atps=neutral Received: by mail-pf0-x236.google.com with SMTP id h14so132289pfe.1 for ; Wed, 06 Jul 2016 15:25:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=2QxqiVZOBFkV4vIvpe3kiUFybcER7ygIQn97/7/1pRE=; b=iZSxDY5cWl/0JQ94cnH/5OLwWruFNvssBrlR1881LFAx0cmXmhRdj8OosqWHvNV458 ITpbzAbBQEJjqhXQvQc1ctPbnU7CzCe9UjOredvdyrXjlFfvqfiNH6/SCpzrGqq+POeg vmb1PCOWQ9oPXeGgcaJ8RO+cEaXnhbYlLSlMk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=2QxqiVZOBFkV4vIvpe3kiUFybcER7ygIQn97/7/1pRE=; b=LjuzL+m4fc9ddimHHchyxn6IkroNgcRhiXrsLcETHxMAbh/hV+6VvIINWEtzdMUGLB Gj1TXmvunrejdkEz+VPfVfZXfhBuf3ub/urX6xgYJVS1wEiJUeUVKrnT+45Q2BHfNeBC CE0vx6KzONP2blIOH9bkVokpizA55c6GC0gVwsOagP8W5wGZ/0fgubjqp3Z8hsi8BCap KFFRMTFWamiAMUJ5qtDwUPmWf2+sMYNbDtjH7HnCqO1f+DbFTPP57UxD4bRw49hek89t zaRaH/MGvMPF7Eyox3OQMKBJKKuHWnTxXYZZsuQYqHE1xcDX1dQePnI33ZHrSqAMiD7A A4Dg== X-Gm-Message-State: ALyK8tKIj2GTKxe1rFScfJJpDlHGDansdMRM7yvg1Deau83Em9dEfxl4PMODjGYDJdYl50BJ X-Received: by 10.98.36.130 with SMTP id k2mr46086368pfk.118.1467843945569; Wed, 06 Jul 2016 15:25:45 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id w27sm6458148pfa.54.2016.07.06.15.25.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 06 Jul 2016 15:25:45 -0700 (PDT) From: Kees Cook To: linux-kernel@vger.kernel.org Subject: [PATCH 8/9] mm: SLAB hardened usercopy support Date: Wed, 6 Jul 2016 15:25:27 -0700 Message-Id: <1467843928-29351-9-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1467843928-29351-1-git-send-email-keescook@chromium.org> References: <1467843928-29351-1-git-send-email-keescook@chromium.org> X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.22 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Jan Kara , kernel-hardening@lists.openwall.com, Catalin Marinas , Will Deacon , linux-mm@kvack.org, sparclinux@vger.kernel.org, linux-ia64@vger.kernel.org, Christoph Lameter , Andrea Arcangeli , linux-arch@vger.kernel.org, x86@kernel.org, Russell King , linux-arm-kernel@lists.infradead.org, PaX Team , Borislav Petkov , Mathias Krause , Fenghua Yu , Rik van Riel , Kees Cook , David Rientjes , Tony Luck , Andy Lutomirski , Joonsoo Kim , Dmitry Vyukov , Laura Abbott , Brad Spengler , Ard Biesheuvel , Pekka Enberg , Casey Schaufler , Andrew Morton , linuxppc-dev@lists.ozlabs.org, "David S. Miller" MIME-Version: 1.0 Errors-To: linuxppc-dev-bounces+patchwork-incoming=ozlabs.org@lists.ozlabs.org Sender: "Linuxppc-dev" Under CONFIG_HARDENED_USERCOPY, this adds object size checking to the SLAB allocator to catch any copies that may span objects. Based on code from PaX and grsecurity. Signed-off-by: Kees Cook --- init/Kconfig | 1 + mm/slab.c | 30 ++++++++++++++++++++++++++++++ 2 files changed, 31 insertions(+) diff --git a/init/Kconfig b/init/Kconfig index f755a602d4a1..798c2020ee7c 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1757,6 +1757,7 @@ choice config SLAB bool "SLAB" + select HAVE_HARDENED_USERCOPY_ALLOCATOR help The regular slab allocator that is established and known to work well in all environments. It organizes cache hot objects in diff --git a/mm/slab.c b/mm/slab.c index cc8bbc1e6bc9..5e2d5f349aca 100644 --- a/mm/slab.c +++ b/mm/slab.c @@ -4477,6 +4477,36 @@ static int __init slab_proc_init(void) module_init(slab_proc_init); #endif +#ifdef CONFIG_HARDENED_USERCOPY +/* + * Rejects objects that are incorrectly sized. + * + * Returns NULL if check passes, otherwise const char * to name of cache + * to indicate an error. + */ +const char *__check_heap_object(const void *ptr, unsigned long n, + struct page *page) +{ + struct kmem_cache *cachep; + unsigned int objnr; + unsigned long offset; + + /* Find and validate object. */ + cachep = page->slab_cache; + objnr = obj_to_index(cachep, page, (void *)ptr); + BUG_ON(objnr >= cachep->num); + + /* Find offset within object. */ + offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep); + + /* Allow address range falling entirely within object size. */ + if (offset <= cachep->object_size && n <= cachep->object_size - offset) + return NULL; + + return cachep->name; +} +#endif /* CONFIG_HARDENED_USERCOPY */ + /** * ksize - get the actual amount of memory allocated for a given object * @objp: Pointer to the object