From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935703AbcIGSyg (ORCPT ); Wed, 7 Sep 2016 14:54:36 -0400 Received: from ex13-edg-ou-002.vmware.com ([208.91.0.190]:18851 "EHLO EX13-EDG-OU-002.vmware.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753712AbcIGSyd (ORCPT ); Wed, 7 Sep 2016 14:54:33 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=syeh@vmware.com; Date: Wed, 7 Sep 2016 11:54:11 -0700 From: Sinclair Yeh To: Kees Cook CC: Thomas Hellstrom , Rik van Riel , Laura Abbott , VMware Graphics , Vinson Lee , Linus Torvalds , Vladimir Davydov , Johannes Weiner , "Andy Lutomirski" , Subject: Re: [PATCH v2] usercopy: remove page-spanning test for now Message-ID: <20160907185410.GA7170@promb-2n-dhcp38.eng.vmware.com> References: <20160907180845.GA31134@www.outflux.net> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: <20160907180845.GA31134@www.outflux.net> User-Agent: Mutt/1.6.1 (2016-04-27) X-Originating-IP: [208.91.1.34] X-ClientProxiedBy: BY1PR0201CA0040.namprd02.prod.outlook.com (10.160.191.178) To BN6PR05MB3235.namprd05.prod.outlook.com (10.172.147.9) X-MS-Office365-Filtering-Correlation-Id: 689e0fb9-84d1-4e89-398e-08d3d750625c X-Microsoft-Exchange-Diagnostics: 1;BN6PR05MB3235;2:wtyDyH8EprQlYS/aqvMj3nIG4ioaEo1ecikqPe6J939uB6YThePmxPZEjh8wOB2PLd8wNvGXZX+53plSjNueZcyTOmdOo9+ykyoNWnWuPH2TkCaF7c1P69m5fWbOwbbpDtFYfDwuwdUCeHW4vdRJhpNJrHLCOhwvGNoy1EFRQL0MDwkE+yMsQ0UaN5LYZApU;3:qM5qqlqnrBDnC8fUGt4UPX++/OwQGq0pQnD7nF7bdRwjmj/3fTqb+2zJ+7n4COScmndZ3av4LTYJZzuNH8SyOoLh5YqTsagD0NANwEIZztDf4IdvFYdVjw9J1IyGWOF4;25:ZWEenu/HSqn9HI/fIqbtSpQjGVTmqHSsr4PXX/9uD5vMcNF4Zu4m3a4mVNU19hEDCvd7QiCmsFHdcAqSHkfgkb63G014S9pLlcJC+8kc7ng9MXtiG4Kx/0tmNyW1EjS3MGqOciPeItH5Q8Bs8CQE7m3yI4r3U1Naz/QhuKG2EhS0GEEBfPkaSh3cGEBYz2CiS9oTRltT09eKrMK7RUdiUIvtTAXiEL93OWHXtv5bNuLPBZsW4CSIe+XSzKmKJX8daJe2lTjooNxh6p5OaHErzdcGGANUJ547j7r+w1vJxvl2xy1+IdYp1h5hqiibvhvUtKKIY5W/ewNpGtZTJvqZC1YT7GTrHEcej1XFTsaiFdXs0eo25HOBwEY5CtloNSrKJjolHEXTCclv7/Q/TBWvzQ==;31:DgzU27EGJ5oPhuJKAz7fYPFefJdSsZjDYQD7uon5AtbhieaFeAb4Ws7qOoh3jk9gFi+15AEitYg1lV4O32fLNA4TuBndzeVF8rqYjcgdEgWKTNy3zdeDt2f8O5pZRusOiTaQTISyRhjJ69do+X7uwWQ4yWfBfG0UEzvUa5lJpNBOkghlxCeti2sNX6MvbtroTeX34baSwMPa9Ec+6PiQkyTVsJzSnjRTxELn2bXS ViE= X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:BN6PR05MB3235; X-LD-Processed: b39138ca-3cee-4b4a-a4d6-cd83d9dd62f0,ExtAddr X-Microsoft-Exchange-Diagnostics: 1;BN6PR05MB3235;20:C0aqf5WDC3loANl0WOWwsiKRSQP2w41njUs2grf9/7FPs3yWF3yGICgbf7/r9yX6p69euJOfx2aSDQGdAK9Q4yuTjqsToo/7wa/8Dhc5vpYYQv/dztWPNFxPty0aZcWTpSJ7ZmyA9vCeAb1NAlUIhzKHk7nnaXKA0T6V25a8tMAyTbasgWJdKGp4ZERn6OwG8JLbczrPCgXEuoJMZaFdOVLJGjlYT0Sh9P/Bag37E0DrLQpvWvU2nY7F7FVWae3f1I84h/5A2Py+ZiNHpcvUJcuwAbrde0APPWKjkidP79FTW8qMrEusD4PY53V/z3+wYmNyqCYOsWDtRdfzyKoZ+RORpzXaNTd+xzc3qGD4+UZ/kRrRa1Z+9sQfAtQyf6hzT1fOtfN3vjS2z/ZQppqWepdzO0kZ3Zi5svnPReuVgJ3+B+MxDXiufznZoQFVDVkJatWBxxMIEkzl7uEk8mfTRN9jsOY+69bcYC0GGhc01DX80kSKH5znRFA3hXge7OYA X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:(61668805478150)(10436049006162)(192374486261705)(17755550239193); X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(6040176)(601004)(2401047)(8121501046)(5005006)(3002001)(10201501046);SRVR:BN6PR05MB3235;BCL:0;PCL:0;RULEID:;SRVR:BN6PR05MB3235; X-Microsoft-Exchange-Diagnostics: 1;BN6PR05MB3235;4:loSX9I8w3Io6G+9KH8h2Xy07W3iElcKC+0ALTy9yTD9fR+TXYed0UJsSU1FwcUNgXzET3TFjm7RbEMXD3nvYnNozg0RN3mCSd3Pok+zwfekHonpvBNqApyFrQSPkwMT/Y06k26aoDLspQGWgeFe59ehD0Qn2V9yzXufbzzPRE4eUuPXoQ9JH/A9FjB4K9nD+Ce6qRiflB9jn+ijjsH0HXTtWS9y5PoDjpmi34qjoRXut4x+55EKssOqQfp7gGd8sw4nS8n083UQjP4PQcMDQ8Lv/T/mFAaE8Vau3Kg/XvPay+nWuZj3R2GL53mGAsC7m8s0Fz2l02Hwyomf+UziqtYtf++4tFvnZsJKZ3+LYEe6G691oRonUBVIAsOmQRebEc+N2KGATF7clMCdA+/FFD/XbRpCi8QKmpK+Oe+SP8jCKlQWdTExBa+G/U+h2UeXhefcWjhLjYd5Y2bl+7JDRMpPkFQlYi0LPsmeVKxPD3JU/zN7RcaMwRurwfdE7Ovez9Og/s9MAIlpwjATQ4Ang4w== X-Forefront-PRVS: 0058ABBBC7 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(4630300001)(6009001)(7916002)(24454002)(189002)(199003)(3846002)(101416001)(586003)(5660300001)(77096005)(97756001)(15975445007)(66066001)(33656002)(47776003)(81156014)(19580405001)(6116002)(54356999)(50986999)(23726003)(8676002)(2950100001)(76176999)(92566002)(81166006)(19580395003)(83506001)(4001350100001)(68736007)(86362001)(42186005)(575784001)(2906002)(46406003)(105586002)(7846002)(7736002)(1076002)(189998001)(50466002)(110136002)(97736004)(4326007)(305945005)(106356001)(7099028)(18370500001);DIR:OUT;SFP:1101;SCL:1;SRVR:BN6PR05MB3235;H:promb-2n-dhcp38.eng.vmware.com;FPR:;SPF:None;PTR:InfoNoRecords;MX:1;A:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;BN6PR05MB3235;23:QEp375dSZukK+X9ZfW3twgnan7GR9K5cWPsz6gGNo?= =?us-ascii?Q?0LFKLa1ATt60+3tFcVKbOmMfA6s28ZOc9en6eS4yz/EGEW8/dLQaoXoCcGPz?= =?us-ascii?Q?m8ef+7tzeusR7U8r+Jak9fkRss3NB7IWeKKp3glH01Pfj7o30yIBDiOlJC3j?= =?us-ascii?Q?j9ncjUHH4K1dDGUxyKhW3zwBv9oG6RU/f369/0D6gLbwUK6kM+Fec7ZUX6Px?= =?us-ascii?Q?1DusQnNFQuanxoO3rcCtt62kqM0QvT4unlRgmHCKBNwwyb5HHV8qbHTZS7sx?= =?us-ascii?Q?75IVQWsGcYX93tim60fdsf9n9q3RLV1/CnonlpG6jEwFr8+x6yv+d6bS0VBb?= =?us-ascii?Q?SQ8nuH+7fTDMD6bHko3mDm5lao6bxwmcjHY9TloqZXgn1x6yC98GfHUkuF7N?= =?us-ascii?Q?ghGrjoocjBLlBffoCyPDSqXOtjWQa57drxqv0hUPbOoqMoAAKoAN2xmQeiK2?= =?us-ascii?Q?eBRKMyDH7Oq3OpL4LLtq+tHFtk/O8Vcj1WB4yZWKjsSZbOSVn+RfpTrjRYjj?= =?us-ascii?Q?DlZMM3Zpv5OzemgWJWCroXHOxC/rAVUVJOYvTGGvCOz1o0rRu+9ZDWD2tT5A?= =?us-ascii?Q?dWgYKu/kPVjXbXMPegMnEZt9BftrQGhjkA5Ho3DmPgsw8vsbrg9eoO3OZxR/?= =?us-ascii?Q?XzmICpZIoUYgUVULj+JRz4BRhljopV1iNz+PPI4Fly7qmIP9qN6m7mtoR5IW?= =?us-ascii?Q?bSAj0bFAgy255qKbOLVrng5NMN/mxDvalaPiOxpQA9D0jXParYQCw/jKlWdW?= =?us-ascii?Q?UojqbEDRZ0evYXU9dttEbpIvq0W5bk4VteWNzTmYvNJE30B4Eaj3xQ5eNhdK?= =?us-ascii?Q?J7cexqtMdm4vqt/lF0ITd1SNwK6d+qqGF7fqAjI4LACFkCWAwoNDZigrzMSk?= =?us-ascii?Q?bGibUZzohdsWhMZG0EkVZYkvdzsF9FtAfQJaY1WQXqPTYCcV3MjBpsbvygrj?= =?us-ascii?Q?nrg4PbG+55KHcZdokDHaMiYtL9hKlNV4zWooDl9bwnSHcu3/FnkuSWHlx3Ao?= =?us-ascii?Q?AjQs5bWrSXghMoNVUXt9mlD8RDTtOHuiPpuL+0cqfLrF+GLraU3MKn1QZVfF?= =?us-ascii?Q?b4Kynx4KCsKK5T6gSRpE01Ahbv3FD846oBvpns1N2mMAnThpVZcIjjDX9yG5?= =?us-ascii?Q?cjFBViHUnD0ly90DvuNRmNq4z/1iSNfFH+ihkGPEj91o6Q7Ck19+mkytv/IF?= =?us-ascii?Q?wEt/rS7WetEWc4XciX89x17094F/bnaiW8m?= X-Microsoft-Exchange-Diagnostics: 1;BN6PR05MB3235;6:dovxTzmDmrw8Aza7ocCWuPsnX+9QJfXqISay0sQ1A1Cb5WuQbwuwQQz8G6jw116bpUI+DpoMX/dZm/pOXCuEqi5Z3YTv83/gBJs5ZdnwaNC6mG4vkpCvnSWTeq8JIiJvD07Vc/aQuJe1ZhE7IypSIQ4J1d2Xaq9m72ZRigeihc8MJ73f/5+dxvcpmkowdMU1lo7AVAE3v1sH39I2xeyIxlIt0ZISsyLkLQz3UVAIlExst7G0G/szRiIupjHP/Ht2w/bByj/uAmsmSCFZz0dUh9iXl7kLmRhJiNAG93n7HAA=;5:uHcvPNvp1y7AMcoprfwP/acUAeNr+iavx3jPsCNW3lzIeruDb9VKT0NR6R4Ej1C/SzBNvq96PmbNJrNts6Nm/UGpZGJMKsZZ7CnxafLrw47vaRgNvDo7wyGJ2tDGsEqqHap//3Lx2IH6kKAU34PvdQ==;24:k/IwtBjSoepARfBSf43Jsq68/I5Ytbx0QlQdQMmbSjgi/FEGjTh6xqDaFvTAvTFWCTaDOt9PxExNpiAVU54nGbg3+01ZbMxGQBl/hSy1ihM=;7:hmhLQ2cprf34esNAic+4UAXutb6hf0e+oYMv907d33+vHSMnlhYe40xihpYdcVYuo6I1gGE9cVn6uojtkQmyQFG3molR+/ZUWIKpbRM3JJOjYDI67CwxVceaHtFY/Gj//mnjYhHE9Y4Izu+gKImx4lvv/H7UjsmGRjCn0LmFek01V5nwoQ/2Sb8enuWUGCbFvnQpk7LBhJ9mUcFVU8Ig2GcGx3Bu7CY1SR0r6BapdwkrbG0jgBJSrJEX/qoGFx/k SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;BN6PR05MB3235;20:la6IpRVgiWwVNvyxh/QH9Ay6ux1hSVLV6Bw0S7ky8NE+dreWZTJ4jNtJxjHFmORrj6NgvA5EmOOBqtT0A4sqj9FEAUsW5ZtBn/WCHnqiiap2Fl32dwFOJ/A50zenviPoN0yAvggZoMHkV1scQ4Ixg5QfewwyF624rcf54SB/Na4= X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2016 18:54:22.3827 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: BN6PR05MB3235 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Reviewed-by: Sinclair Yeh On Wed, Sep 07, 2016 at 11:08:45AM -0700, Kees Cook wrote: > A custom allocator without __GFP_COMP that copies to userspace has been > found in vmw_execbuf_process[1], so this disables the page-span checker > by placing it behind a CONFIG for future work where such things can be > tracked down later. > > [1] https://urldefense.proofpoint.com/v2/url?u=https-3A__bugzilla.redhat.com_show-5Fbug.cgi-3Fid-3D1373326&d=CwIBAg&c=Sqcl0Ez6M0X8aeM67LKIiDJAXVeAw-YihVMNtXt-uEs&r=w9Iu3o4zAy-3-s8MFvrNSQ&m=HmnBFNgZxprKMPy51P5NjJYN3A5FrdjyzaM817eexKU&s=Htqh5qkhK5mXIdzTCYiqCaZU1R98sOatRFgsoDbGOzw&e= > > Reported-by: Vinson Lee > Fixes: f5509cc18daa ("mm: Hardened usercopy") > Signed-off-by: Kees Cook > --- > v2: > - split logic into separate function entirely, torvalds > --- > mm/usercopy.c | 61 ++++++++++++++++++++++++++++++++------------------------ > security/Kconfig | 11 ++++++++++ > 2 files changed, 46 insertions(+), 26 deletions(-) > > diff --git a/mm/usercopy.c b/mm/usercopy.c > index a3cc3052f830..089328f2b920 100644 > --- a/mm/usercopy.c > +++ b/mm/usercopy.c > @@ -134,31 +134,16 @@ static inline const char *check_bogus_address(const void *ptr, unsigned long n) > return NULL; > } > > -static inline const char *check_heap_object(const void *ptr, unsigned long n, > - bool to_user) > +/* Checks for allocs that are marked in some way as spanning multiple pages. */ > +static inline const char *check_page_span(const void *ptr, unsigned long n, > + struct page *page, bool to_user) > { > - struct page *page, *endpage; > +#ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN > const void *end = ptr + n - 1; > + struct page *endpage; > bool is_reserved, is_cma; > > /* > - * Some architectures (arm64) return true for virt_addr_valid() on > - * vmalloced addresses. Work around this by checking for vmalloc > - * first. > - */ > - if (is_vmalloc_addr(ptr)) > - return NULL; > - > - if (!virt_addr_valid(ptr)) > - return NULL; > - > - page = virt_to_head_page(ptr); > - > - /* Check slab allocator for flags and size. */ > - if (PageSlab(page)) > - return __check_heap_object(ptr, n, page); > - > - /* > * Sometimes the kernel data regions are not marked Reserved (see > * check below). And sometimes [_sdata,_edata) does not cover > * rodata and/or bss, so check each range explicitly. > @@ -186,7 +171,7 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n, > ((unsigned long)end & (unsigned long)PAGE_MASK))) > return NULL; > > - /* Allow if start and end are inside the same compound page. */ > + /* Allow if fully inside the same compound (__GFP_COMP) page. */ > endpage = virt_to_head_page(end); > if (likely(endpage == page)) > return NULL; > @@ -199,20 +184,44 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n, > is_reserved = PageReserved(page); > is_cma = is_migrate_cma_page(page); > if (!is_reserved && !is_cma) > - goto reject; > + return ""; > > for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) { > page = virt_to_head_page(ptr); > if (is_reserved && !PageReserved(page)) > - goto reject; > + return ""; > if (is_cma && !is_migrate_cma_page(page)) > - goto reject; > + return ""; > } > +#endif > > return NULL; > +} > + > +static inline const char *check_heap_object(const void *ptr, unsigned long n, > + bool to_user) > +{ > + struct page *page; > + > + /* > + * Some architectures (arm64) return true for virt_addr_valid() on > + * vmalloced addresses. Work around this by checking for vmalloc > + * first. > + */ > + if (is_vmalloc_addr(ptr)) > + return NULL; > + > + if (!virt_addr_valid(ptr)) > + return NULL; > + > + page = virt_to_head_page(ptr); > + > + /* Check slab allocator for flags and size. */ > + if (PageSlab(page)) > + return __check_heap_object(ptr, n, page); > > -reject: > - return ""; > + /* Verify object does not incorrectly span multiple pages. */ > + return check_page_span(ptr, n, page, to_user); > } > > /* > diff --git a/security/Kconfig b/security/Kconfig > index da10d9b573a4..2dfc0ce4083e 100644 > --- a/security/Kconfig > +++ b/security/Kconfig > @@ -147,6 +147,17 @@ config HARDENED_USERCOPY > or are part of the kernel text. This kills entire classes > of heap overflow exploits and similar kernel memory exposures. > > +config HARDENED_USERCOPY_PAGESPAN > + bool "Refuse to copy allocations that span multiple pages" > + depends on HARDENED_USERCOPY > + depends on !COMPILE_TEST > + help > + When a multi-page allocation is done without __GFP_COMP, > + hardened usercopy will reject attempts to copy it. There are, > + however, several cases of this in the kernel that have not all > + been removed. This config is intended to be used only while > + trying to find such users. > + > source security/selinux/Kconfig > source security/smack/Kconfig > source security/tomoyo/Kconfig > -- > 2.7.4 > > > -- > Kees Cook > Nexus Security