From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: ACJfBovF5UJfBzdjwomvn2BMpGEt7HXdQ0I5w09cih12l0frmNy02UsV9RSPd9vSINXfc6WEpdeu ARC-Seal: i=1; a=rsa-sha256; t=1516311130; cv=none; d=google.com; s=arc-20160816; b=DGMOX6WFcQW4bfh+bo40kvZsU8cxbVjJHvXuTMQpVhvQqEaGAp5/Vi+eEhZX8qYT/4 mM/FCMX2uHmlVWXyjrJdLDNeUOE74z2Eg609mqtJSmbqsEdhsS1BpocuDVNk0n+3TLRP dPMw3tz+uRuyM8OxtfKzb5o3arHTDn7xXUOBNo4feD1mtI1Lr72ycR5uH3AqJ5i0zKYz 4cyUDWkBSApDrFI3RMT4ANOc9C+u9Yg7uMxTeQkimxBuQBH++FPKa2UAiP2zxIAXe4gA omFmmjVYYGCn2c3Bjij0iWjEKMlUcZYwRhaouyOLp2bohGAN/YslUM9VvTQvrwnwlIxR Jwcw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=subject:content-transfer-encoding:content-language:in-reply-to :mime-version:user-agent:date:message-id:from:references:cc:to :delivered-to:list-id:list-subscribe:list-unsubscribe:list-help :list-post:precedence:mailing-list:arc-authentication-results; bh=cZNJbnwbMuccfaYbdS/hpz9GNHk4HA0dDycOINHXl7s=; b=TrOwIK5t+IB1UxnyVg9DUJunyYoGH9zuweFJc+Q7pP5YBayqL3tEKQIn5jr3E4JCfI GAKj0JYJsz0h5yEa0sGnp7s7E97+AFw5bvA1K1MXnrQBUJH1VKNoPQoLvXWaFGqTTkA6 5eVW2iyByNy7/zTFh8SuubFvQAqhMJuMAytTYbfPubjZ7YbPF5W3d7dX49K/JfnGDtIk RrkMXoQ5j8/ILgF/dlQRn6O0Rl9N1bSoyOo1B9Ka7d7CaAIRSzUU/WBeuJSKpup8xIVP YJFsmZnLsXoFpCZ2x49heKcjNL8J5bzfBtyEzr+00ElIL8mFSnPB+9kL/2WOBlOB6d2d qinQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of kernel-hardening-return-11333-gregkh=linuxfoundation.org@lists.openwall.com designates 195.42.179.200 as permitted sender) smtp.mailfrom=kernel-hardening-return-11333-gregkh=linuxfoundation.org@lists.openwall.com; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Authentication-Results: mx.google.com; spf=pass (google.com: domain of kernel-hardening-return-11333-gregkh=linuxfoundation.org@lists.openwall.com designates 195.42.179.200 as permitted sender) smtp.mailfrom=kernel-hardening-return-11333-gregkh=linuxfoundation.org@lists.openwall.com; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=redhat.com Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm List-Post: List-Help: List-Unsubscribe: List-Subscribe: To: Kees Cook , linux-kernel@vger.kernel.org Cc: David Windsor , Vlad Yasevich , Neil Horman , "David S. Miller" , linux-sctp@vger.kernel.org, netdev@vger.kernel.org, Linus Torvalds , Alexander Viro , Andrew Morton , Andy Lutomirski , Christoph Hellwig , Christoph Lameter , Mark Rutland , "Martin K. Petersen" , Paolo Bonzini , Christian Borntraeger , Christoffer Dall , Dave Kleikamp , Jan Kara , Luis de Bethencourt , Marc Zyngier , Rik van Riel , Matthew Garrett , linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com References: <1515636190-24061-1-git-send-email-keescook@chromium.org> <1515636190-24061-28-git-send-email-keescook@chromium.org> From: Laura Abbott Message-ID: <19a7add8-adaf-4ad4-6ae3-4a62967656b9@redhat.com> Date: Thu, 18 Jan 2018 13:31:42 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.2 MIME-Version: 1.0 In-Reply-To: <1515636190-24061-28-git-send-email-keescook@chromium.org> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Subject: [kernel-hardening] Re: [PATCH 27/38] sctp: Copy struct sctp_sock.autoclose to userspace using put_user() X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1589260380960273252?= X-GMAIL-MSGID: =?utf-8?q?1589967459247636536?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On 01/10/2018 06:02 PM, Kees Cook wrote: > From: David Windsor > > The autoclose field can be copied with put_user(), so there is no need to > use copy_to_user(). In both cases, hardened usercopy is being bypassed > since the size is constant, and not open to runtime manipulation. > > This patch is verbatim from Brad Spengler/PaX Team's PAX_USERCOPY > whitelisting code in the last public patch of grsecurity/PaX based on my > understanding of the code. Changes or omissions from the original code are > mine and don't reflect the original grsecurity/PaX code. > Just tried a quick rebase and it looks like this conflicts with c76f97c99ae6 ("sctp: make use of pre-calculated len") I don't think we can use put_user if we're copying via the full len? Thanks, Laura > Signed-off-by: David Windsor > [kees: adjust commit log] > Cc: Vlad Yasevich > Cc: Neil Horman > Cc: "David S. Miller" > Cc: linux-sctp@vger.kernel.org > Cc: netdev@vger.kernel.org > Signed-off-by: Kees Cook > --- > net/sctp/socket.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/sctp/socket.c b/net/sctp/socket.c > index efbc8f52c531..15491491ec88 100644 > --- a/net/sctp/socket.c > +++ b/net/sctp/socket.c > @@ -5011,7 +5011,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv > len = sizeof(int); > if (put_user(len, optlen)) > return -EFAULT; > - if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int))) > + if (put_user(sctp_sk(sk)->autoclose, (int __user *)optval)) > return -EFAULT; > return 0; > } >