Re: [PATCH 1/9] mm: Hardened usercopy
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
- To: Kees Cook <keescook@xxxxxxxxxxxx>, linux-kernel@xxxxxxxxxxxxxxx
- Subject: Re: [PATCH 1/9] mm: Hardened usercopy
- From: Rik van Riel <riel@xxxxxxxxxx>
- Date: Thu, 07 Jul 2016 12:35:17 -0400
- Cc: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>, PaX Team <pageexec@xxxxxxxxxxx>, Brad Spengler <spender@xxxxxxxxxxxxxx>, Russell King <linux@xxxxxxxxxxxxxxx>, Catalin Marinas <catalin.marinas@xxxxxxx>, Will Deacon <will.deacon@xxxxxxx>, Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx>, Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx>, Michael Ellerman <mpe@xxxxxxxxxxxxxx>, Tony Luck <tony.luck@xxxxxxxxx>, Fenghua Yu <fenghua.yu@xxxxxxxxx>, "David S. Miller" <davem@xxxxxxxxxxxxx>, x86@xxxxxxxxxx, Christoph Lameter <cl@xxxxxxxxx>, Pekka Enberg <penberg@xxxxxxxxxx>, David Rientjes <rientjes@xxxxxxxxxx>, Joonsoo Kim <iamjoonsoo.kim@xxxxxxx>, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>, Andy Lutomirski <luto@xxxxxxxxxx>, Borislav Petkov <bp@xxxxxxx>, Mathias Krause <minipli@xxxxxxxxxxxxxx>, Jan Kara <jack@xxxxxxx>, Vitaly Wool <vitalywool@xxxxxxxxx>, Andrea Arcangeli <aarcange@xxxxxxxxxx>, Dmitry Vyukov <dvyukov@xxxxxxxxxx>, Laura Abbott <labbott@xxxxxxxxxxxxxxxxx>, linux-arm-kernel@xxxxxxxxxxxxxxxxxxx, linux-ia64@xxxxxxxxxxxxxxx, linuxppc-dev@xxxxxxxxxxxxxxxx, sparclinux@xxxxxxxxxxxxxxx, linux-arch@xxxxxxxxxxxxxxx, linux-mm@xxxxxxxxx, kernel-hardening@xxxxxxxxxxxxxxxxxx
- In-reply-to: <1467843928-29351-2-git-send-email-keescook@chromium.org>
- List-id: <linux-ia64.vger.kernel.org>
- References: <1467843928-29351-1-git-send-email-keescook@chromium.org> <1467843928-29351-2-git-send-email-keescook@chromium.org>
On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote:
>
> + /* Allow kernel rodata region (if not marked as Reserved).
> */
> + if (ptr >= (const void *)__start_rodata &&
> + end <= (const void *)__end_rodata)
> + return NULL;
>
One comment here.
__check_object_size gets "to_user" as an argument.
It may make sense to pass that to check_heap_object, and
only allow copy_to_user from rodata, never copy_from_user,
since that section should be read only.
> +void __check_object_size(const void *ptr, unsigned long n, bool
> to_user)
> +{
>
--
All Rights Reversed.
Attachment:
signature.asc
Description: This is a digitally signed message part
[Index of Archives]
[Linux Kernel]
[Sparc Linux]
[DCCP]
[Linux ARM]
[Yosemite News]
[Linux SCSI]
[Linux x86_64]
[Linux for Ham Radio]