From patchwork Tue Jan 9 20:55:37 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 10153347 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 80A13602CA for ; Tue, 9 Jan 2018 20:59:58 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 76011204C4 for ; Tue, 9 Jan 2018 20:59:58 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 684DA24B5B; Tue, 9 Jan 2018 20:59:58 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, RCVD_IN_DNSWL_HI, URIBL_BLACK autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E212B204C4 for ; Tue, 9 Jan 2018 20:59:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932110AbeAIU6i (ORCPT ); Tue, 9 Jan 2018 15:58:38 -0500 Received: from mail-pg0-f67.google.com ([74.125.83.67]:37761 "EHLO mail-pg0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1759847AbeAIU5V (ORCPT ); Tue, 9 Jan 2018 15:57:21 -0500 Received: by mail-pg0-f67.google.com with SMTP id z17so2879804pgc.4 for ; Tue, 09 Jan 2018 12:57:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=dHVNXQ6l5G+RsHH0Msr3+DNZZebZt6wJXxrtvxpaUjs=; b=jW/un8Lj3PoEX09F9QHuZ+tJCeIXKdO0OGBW4AcKmH+pSDI32x7bkmff0W+3JwQBPk YNgpCi2oST7lKCXS9Pe9w5iin9fkdNysM0xOCBQS7ynTsFbOl6K3c6J3p1vEKm/LSV+A JIBrhcycEzPL4OjX8zFdqC+v7/XN76LeOaQro= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=dHVNXQ6l5G+RsHH0Msr3+DNZZebZt6wJXxrtvxpaUjs=; b=DCFG+ggiWfsbUdTiD12FSvaWz4pPAwZtCpbAruSI9rOneozILEWevmoljdsnA1bPCa GXVZkWMZqQzN6ylM7GFjIa957sONHwEot6hgnGiOrzytKcs9gpTTS75/h+/WDtBybAKr vtMRKWIbmejbxlp3Q+X2S7fdlUTw7LV9/tZ621w1SwjLzdh41fcXwfVa9RmyajdCB9YJ vyGhMA5BkoIWj547rgO2frBbbnsKXti0aOYLqqOKTwDWb7mUogHXuOxQvM+LIkgJ2yZw cuA8yVZtv2hmRYHYU8AWWwK2UVboRP/uIO10mx2h+YNEqi8Rp7xyvKzv6WBuvoYeY/dc 1/Yg== X-Gm-Message-State: AKGB3mKVqJmlMWBfi9zvsofDcE8h19XB6D9y7OT/acPJpQ5v7kWimrwg UfZw78MZTyNl3yfp7X1y3zhjkg== X-Google-Smtp-Source: ACJfBovoZ7cjHkemojOFWfheI0kzFZvRfiJOJmuPjYyXA6q0VIAUOlOhhCWwelKnfMOCFlu5iDq3Mw== X-Received: by 10.101.73.204 with SMTP id t12mr13373540pgs.48.1515531440561; Tue, 09 Jan 2018 12:57:20 -0800 (PST) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id s5sm26133249pgp.91.2018.01.09.12.56.50 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 09 Jan 2018 12:57:18 -0800 (PST) From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Kees Cook , David Windsor , Alexander Viro , linux-fsdevel@vger.kernel.org, Linus Torvalds , Andrew Morton , Andy Lutomirski , Christoph Hellwig , Christoph Lameter , "David S. Miller" , Laura Abbott , Mark Rutland , "Martin K. Petersen" , Paolo Bonzini , Christian Borntraeger , Christoffer Dall , Dave Kleikamp , Jan Kara , Luis de Bethencourt , Marc Zyngier , Rik van Riel , Matthew Garrett , linux-arch@vger.kernel.org, netdev@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com Subject: [PATCH 08/36] vfs: Define usercopy region in names_cache slab caches Date: Tue, 9 Jan 2018 12:55:37 -0800 Message-Id: <1515531365-37423-9-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1515531365-37423-1-git-send-email-keescook@chromium.org> References: <1515531365-37423-1-git-send-email-keescook@chromium.org> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: David Windsor VFS pathnames are stored in the names_cache slab cache, either inline or across an entire allocation entry (when approaching PATH_MAX). These are copied to/from userspace, so they must be entirely whitelisted. cache object allocation: include/linux/fs.h: #define __getname() kmem_cache_alloc(names_cachep, GFP_KERNEL) example usage trace: strncpy_from_user+0x4d/0x170 getname_flags+0x6f/0x1f0 user_path_at_empty+0x23/0x40 do_mount+0x69/0xda0 SyS_mount+0x83/0xd0 fs/namei.c: getname_flags(...): ... result = __getname(); ... kname = (char *)result->iname; result->name = kname; len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX); ... if (unlikely(len == EMBEDDED_NAME_MAX)) { const size_t size = offsetof(struct filename, iname[1]); kname = (char *)result; result = kzalloc(size, GFP_KERNEL); ... result->name = kname; len = strncpy_from_user(kname, filename, PATH_MAX); In support of usercopy hardening, this patch defines the entire cache object in the names_cache slab cache as whitelisted, since it may entirely hold name strings to be copied to/from userspace. This patch is verbatim from Brad Spengler/PaX Team's PAX_USERCOPY whitelisting code in the last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original code are mine and don't reflect the original grsecurity/PaX code. Signed-off-by: David Windsor [kees: adjust commit log, add usage trace] Cc: Alexander Viro Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Kees Cook --- fs/dcache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/dcache.c b/fs/dcache.c index 92ad7a2168e1..9d7ee2de682c 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -3640,8 +3640,8 @@ void __init vfs_caches_init_early(void) void __init vfs_caches_init(void) { - names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0, - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL); + names_cachep = kmem_cache_create_usercopy("names_cache", PATH_MAX, 0, + SLAB_HWCACHE_ALIGN|SLAB_PANIC, 0, PATH_MAX, NULL); dcache_init(); inode_init();