Re: [PATCH v2 02/11] mm: Hardened usercopy
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
- To: Kees Cook <keescook@xxxxxxxxxxxx>
- Subject: Re: [PATCH v2 02/11] mm: Hardened usercopy
- From: Balbir Singh <bsingharora@xxxxxxxxx>
- Date: Fri, 15 Jul 2016 22:55:19 +1000
- Cc: Balbir Singh <bsingharora@xxxxxxxxx>, Rik van Riel <riel@xxxxxxxxxx>, LKML <linux-kernel@xxxxxxxxxxxxxxx>, Casey Schaufler <casey@xxxxxxxxxxxxxxxx>, PaX Team <pageexec@xxxxxxxxxxx>, Brad Spengler <spender@xxxxxxxxxxxxxx>, Russell King <linux@xxxxxxxxxxxxxxx>, Catalin Marinas <catalin.marinas@xxxxxxx>, Will Deacon <will.deacon@xxxxxxx>, Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx>, Benjamin Herrenschmidt <benh@xxxxxxxxxxxxxxxxxxx>, Michael Ellerman <mpe@xxxxxxxxxxxxxx>, Tony Luck <tony.luck@xxxxxxxxx>, Fenghua Yu <fenghua.yu@xxxxxxxxx>, "David S. Miller" <davem@xxxxxxxxxxxxx>, "x86@xxxxxxxxxx" <x86@xxxxxxxxxx>, Christoph Lameter <cl@xxxxxxxxx>, Pekka Enberg <penberg@xxxxxxxxxx>, David Rientjes <rientjes@xxxxxxxxxx>, Joonsoo Kim <iamjoonsoo.kim@xxxxxxx>, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>, Andy Lutomirski <luto@xxxxxxxxxx>, Borislav Petkov <bp@xxxxxxx>, Mathias Krause <minipli@xxxxxxxxxxxxxx>, Jan Kara <jack@xxxxxxx>, Vitaly Wool <vitalywool@xxxxxxxxx>, Andrea Arcangeli <aarcange@xxxxxxxxxx>, Dmitry Vyukov <dvyukov@xxxxxxxxxx>, Laura Abbott <labbott@xxxxxxxxxxxxxxxxx>, "linux-arm-kernel@xxxxxxxxxxxxxxxxxxx" <linux-arm-kernel@xxxxxxxxxxxxxxxxxxx>, linux-ia64@xxxxxxxxxxxxxxx, "linuxppc-dev@xxxxxxxxxxxxxxxx" <linuxppc-dev@xxxxxxxxxxxxxxxx>, sparclinux <sparclinux@xxxxxxxxxxxxxxx>, linux-arch <linux-arch@xxxxxxxxxxxxxxx>, Linux-MM <linux-mm@xxxxxxxxx>, "kernel-hardening@xxxxxxxxxxxxxxxxxx" <kernel-hardening@xxxxxxxxxxxxxxxxxx>
- In-reply-to: <CAGXu5jLuQPdBH4a0BF9AgH7qQubfoz+fFW2sTi2rRxsU8u_8QQ@mail.gmail.com>
- List-id: <linux-ia64.vger.kernel.org>
- References: <1468446964-22213-1-git-send-email-keescook@chromium.org> <1468446964-22213-3-git-send-email-keescook@chromium.org> <20160714232019.GA28254@350D> <1468544658.30053.26.camel@redhat.com> <20160715014151.GA13944@balbir.ozlabs.ibm.com> <CAGXu5jJy4O4tV2sB=MSkYh2DEfxUYkH4Q3ghmrHEGc6s-k285A@mail.gmail.com> <CAGXu5jLuQPdBH4a0BF9AgH7qQubfoz+fFW2sTi2rRxsU8u_8QQ@mail.gmail.com>
- Reply-to: bsingharora@xxxxxxxxx
- User-agent: Mutt/1.5.24 (2015-08-30)
On Thu, Jul 14, 2016 at 09:53:31PM -0700, Kees Cook wrote:
> On Thu, Jul 14, 2016 at 9:05 PM, Kees Cook <keescook@xxxxxxxxxxxx> wrote:
> > On Thu, Jul 14, 2016 at 6:41 PM, Balbir Singh <bsingharora@xxxxxxxxx> wrote:
> >> On Thu, Jul 14, 2016 at 09:04:18PM -0400, Rik van Riel wrote:
> >>> On Fri, 2016-07-15 at 09:20 +1000, Balbir Singh wrote:
> >>>
> >>> > > ==
> >>> > > + ((unsigned long)end & (unsigned
> >>> > > long)PAGE_MASK)))
> >>> > > + return NULL;
> >>> > > +
> >>> > > + /* Allow if start and end are inside the same compound
> >>> > > page. */
> >>> > > + endpage = virt_to_head_page(end);
> >>> > > + if (likely(endpage == page))
> >>> > > + return NULL;
> >>> > > +
> >>> > > + /* Allow special areas, device memory, and sometimes
> >>> > > kernel data. */
> >>> > > + if (PageReserved(page) && PageReserved(endpage))
> >>> > > + return NULL;
> >>> >
> >>> > If we came here, it's likely that endpage > page, do we need to check
> >>> > that only the first and last pages are reserved? What about the ones
> >>> > in
> >>> > the middle?
> >>>
> >>> I think this will be so rare, we can get away with just
> >>> checking the beginning and the end.
> >>>
> >>
> >> But do we want to leave a hole where an aware user space
> >> can try a longer copy_* to avoid this check? If it is unlikely
> >> should we just bite the bullet and do the check for the entire
> >> range?
> >
> > I'd be okay with expanding the test -- it should be an extremely rare
> > situation already since the common Reserved areas (kernel data) will
> > have already been explicitly tested.
> >
> > What's the best way to do "next page"? Should it just be:
> >
> > for ( ; page <= endpage ; ptr += PAGE_SIZE, page = virt_to_head_page(ptr) ) {
> > if (!PageReserved(page))
> > return "<spans multiple pages>";
> > }
> >
> > return NULL;
> >
> > ?
>
> Er, I was testing the wrong thing. How about:
>
> /*
> * Reject if range is not Reserved (i.e. special or device memory),
> * since then the object spans several independently allocated pages.
> */
> for (; ptr <= end ; ptr += PAGE_SIZE, page = virt_to_head_page(ptr)) {
> if (!PageReserved(page))
> return "<spans multiple pages>";
> }
>
> return NULL;
That looks reasonable to me
Balbir
--
To unsubscribe from this list: send the line "unsubscribe linux-ia64" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
[Index of Archives]
[Linux Kernel]
[Sparc Linux]
[DCCP]
[Linux ARM]
[Yosemite News]
[Linux SCSI]
[Linux x86_64]
[Linux for Ham Radio]