RE: [PATCH v3 02/11] mm: Hardened usercopy
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
- To: "'Josh Poimboeuf'" <jpoimboe@xxxxxxxxxx>, Kees Cook <keescook@xxxxxxxxxxxx>
- Subject: RE: [PATCH v3 02/11] mm: Hardened usercopy
- From: David Laight <David.Laight@xxxxxxxxxx>
- Date: Mon, 25 Jul 2016 09:27:31 +0000
- Accept-language: en-GB, en-US
- Cc: Jan Kara <jack@xxxxxxx>, "kernel-hardening@xxxxxxxxxxxxxxxxxx" <kernel-hardening@xxxxxxxxxxxxxxxxxx>, Will Deacon <will.deacon@xxxxxxx>, Linux-MM <linux-mm@xxxxxxxxx>, sparclinux <sparclinux@xxxxxxxxxxxxxxx>, "linux-ia64@xxxxxxxxxxxxxxx" <linux-ia64@xxxxxxxxxxxxxxx>, Christoph Lameter <cl@xxxxxxxxx>, Andrea Arcangeli <aarcange@xxxxxxxxxx>, linux-arch <linux-arch@xxxxxxxxxxxxxxx>, "x86@xxxxxxxxxx" <x86@xxxxxxxxxx>, Russell King <linux@xxxxxxxxxxxxxxx>, "linux-arm-kernel@xxxxxxxxxxxxxxxxxxx" <linux-arm-kernel@xxxxxxxxxxxxxxxxxxx>, Catalin Marinas <catalin.marinas@xxxxxxx>, PaX Team <pageexec@xxxxxxxxxxx>, Borislav Petkov <bp@xxxxxxx>, Mathias Krause <minipli@xxxxxxxxxxxxxx>, Fenghua Yu <fenghua.yu@xxxxxxxxx>, Rik van Riel <riel@xxxxxxxxxx>, David Rientjes <rientjes@xxxxxxxxxx>, Tony Luck <tony.luck@xxxxxxxxx>, Andy Lutomirski <luto@xxxxxxxxxx>, Joonsoo Kim <iamjoonsoo.kim@xxxxxxx>, Dmitry Vyukov <dvyukov@xxxxxxxxxx>, Laura Abbott <labbott@xxxxxxxxxxxxxxxxx>, Brad Spengler <spender@xxxxxxxxxxxxxx>, Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx>, LKML <linux-kernel@xxxxxxxxxxxxxxx>, Pekka Enberg <penberg@xxxxxxxxxx>, "Daniel Micay" <danielmicay@xxxxxxxxx>, Casey Schaufler <casey@xxxxxxxxxxxxxxxx>, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>, "linuxppc-dev@xxxxxxxxxxxxxxxx" <linuxppc-dev@xxxxxxxxxxxxxxxx>, "David S. Miller" <davem@xxxxxxxxxxxxx>
- In-reply-to: <20160722174551.jddle6mf7zlq6xmb@treble>
- List-id: <linux-ia64.vger.kernel.org>
- References: <1468619065-3222-1-git-send-email-keescook@chromium.org> <1468619065-3222-3-git-send-email-keescook@chromium.org> <5790711f.2350420a.b4287.2cc0SMTPIN_ADDED_BROKEN@mx.google.com> <CAGXu5jLCu1Vv0uugKZrsjSEsoABgXJSOJ8GkKmrHbvj9jkC2YA@mail.gmail.com> <20160722174551.jddle6mf7zlq6xmb@treble>
- Thread-index: AQHR5EDYtHQgWS+wrkqwrJcPjHAXuaAo4vvw
- Thread-topic: [PATCH v3 02/11] mm: Hardened usercopy
From: Josh Poimboeuf
> Sent: 22 July 2016 18:46
..
> > >> +/*
> > >> + * Checks if a given pointer and length is contained by the current
> > >> + * stack frame (if possible).
> > >> + *
> > >> + * 0: not at all on the stack
> > >> + * 1: fully within a valid stack frame
> > >> + * 2: fully on the stack (when can't do frame-checking)
> > >> + * -1: error condition (invalid stack position or bad stack frame)
> > >> + */
> > >> +static noinline int check_stack_object(const void *obj, unsigned long len)
> > >> +{
> > >> + const void * const stack = task_stack_page(current);
> > >> + const void * const stackend = stack + THREAD_SIZE;
> > >
> > > That allows access to the entire stack, including the struct thread_info,
> > > is that what we want - it seems dangerous? Or did I miss a check
> > > somewhere else?
> >
> > That seems like a nice improvement to make, yeah.
> >
> > > We have end_of_stack() which computes the end of the stack taking
> > > thread_info into account (end being the opposite of your end above).
> >
> > Amusingly, the object_is_on_stack() check in sched.h doesn't take
> > thread_info into account either. :P Regardless, I think using
> > end_of_stack() may not be best. To tighten the check, I think we could
> > add this after checking that the object is on the stack:
> >
> > #ifdef CONFIG_STACK_GROWSUP
> > stackend -= sizeof(struct thread_info);
> > #else
> > stack += sizeof(struct thread_info);
> > #endif
> >
> > e.g. then if the pointer was in the thread_info, the second test would
> > fail, triggering the protection.
>
> FWIW, this won't work right on x86 after Andy's
> CONFIG_THREAD_INFO_IN_TASK patches get merged.
What ends up in the 'thread_info' area?
If it contains the fp save area then programs like gdb may end up requesting
copy_in/out directly from that area.
Interestingly the avx registers don't need saving on a normal system call
entry (they are all caller-saved) so the kernel stack can safely overwrite
that area.
Syscall entry probably ought to execute the 'zero all avx registers' instruction.
They do need saving on interrupt entry - but the stack used will be less.
David
��.n��������+%������w��{.n�����{��&�����ܨ}���Ơz�j:+v�����w����ޙ��&�)ߡ�a����z�ޗ���ݢj��w�f
[Index of Archives]
[Linux Kernel]
[Sparc Linux]
[DCCP]
[Linux ARM]
[Yosemite News]
[Linux SCSI]
[Linux x86_64]
[Linux for Ham Radio]