From patchwork Mon Jun 19 23:36:24 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9798051 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7989160381 for ; Mon, 19 Jun 2017 23:38:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 76C5326C9B for ; Mon, 19 Jun 2017 23:38:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6B97927DCD; Mon, 19 Jun 2017 23:38:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, URIBL_BLACK autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id F210327861 for ; Mon, 19 Jun 2017 23:38:39 +0000 (UTC) Received: (qmail 14252 invoked by uid 550); 19 Jun 2017 23:37:22 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 11647 invoked from network); 19 Jun 2017 23:37:03 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=6WY3CwjBuPkTXdsYb30A/BiN7+2T/gFRNvJ33DdmHgo=; b=CRAwfEk2TDof+OTbYqsos2PiUjiJ6azlyLwKwq/qIfiXUwckX4lkt7EdGe/gGNykZL WWbqPwlKKZjJnRDUTsvvzVRo86Z1/LHn8rNLUtt1tYwVOp8YUtW6dPCa02/PAQSEOOa5 g3GYoVK9jZZkKkUCQc+6izBQ+n6cSH6FpK5Bk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=6WY3CwjBuPkTXdsYb30A/BiN7+2T/gFRNvJ33DdmHgo=; b=aPQ5nCqSKOW/5cwvHWK8AuU+SHD5FM/e/u4LI+1g4m6HUbjhzhOVaYmB4vKkUFIjtS F/7umYIZhds/MW1N9hsVx5WiQAhqqxGoqBRqBNdaZOrg5OkZhjwtoF15WrdlITyEQQMa fakQn5G+U5RPaF6hCCPxEl9ZIP+nRT+dnKVvRCrGw8BpmV5++h2X2t61ewALP+9qw1Ih regy6a5VACQOD1jHLTvwiX7vlfosB1dX3jKfz5kqn+dpt3EL1rwUAM28++i2cIAaG2Jm dni9h5R1YynW04DWmZkJl65ajzTwtQfHxEb/gO6fNub5Ks7XLdBVtkVRRRoT9b/PUSmM dXPQ== X-Gm-Message-State: AKS2vOwYAKfflbgzkU5mSwpLDERrs8lpDSBiTlgY4wY8tZNv/mi3oXPx E9DNrWXfpy/OhsZY X-Received: by 10.98.2.151 with SMTP id 145mr27327528pfc.52.1497915411376; Mon, 19 Jun 2017 16:36:51 -0700 (PDT) From: Kees Cook To: kernel-hardening@lists.openwall.com Cc: Kees Cook , David Windsor , linux-mm@kvack.org, linux-kernel@vger.kernel.org Date: Mon, 19 Jun 2017 16:36:24 -0700 Message-Id: <1497915397-93805-11-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1497915397-93805-1-git-send-email-keescook@chromium.org> References: <1497915397-93805-1-git-send-email-keescook@chromium.org> Subject: [kernel-hardening] [PATCH 10/23] vxfs: define usercopy region in vxfs_inode slab cache X-Virus-Scanned: ClamAV using ClamSMTP From: David Windsor The vxfs symlink pathnames, stored in struct vxfs_inode_info.vii_immed.vi_immed and therefore contained in the vxfs_inode slab cache, need to be copied to/from userspace. In support of usercopy hardening, this patch defines a region in the vxfs_inode slab cache in which userspace copy operations are allowed. This region is known as the slab cache's usercopy region. Slab caches can now check that each copy operation involving cache-managed memory falls entirely within the slab's usercopy region. This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY whitelisting code in the last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original code are mine and don't reflect the original grsecurity/PaX code. Signed-off-by: David Windsor [kees: adjust commit log] Signed-off-by: Kees Cook --- fs/freevxfs/vxfs_super.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/fs/freevxfs/vxfs_super.c b/fs/freevxfs/vxfs_super.c index 455ce5b77e9b..c143e18d5a65 100644 --- a/fs/freevxfs/vxfs_super.c +++ b/fs/freevxfs/vxfs_super.c @@ -332,9 +332,13 @@ vxfs_init(void) { int rv; - vxfs_inode_cachep = kmem_cache_create("vxfs_inode", + vxfs_inode_cachep = kmem_cache_create_usercopy("vxfs_inode", sizeof(struct vxfs_inode_info), 0, - SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD, NULL); + SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD, + offsetof(struct vxfs_inode_info, vii_immed.vi_immed), + sizeof_field(struct vxfs_inode_info, + vii_immed.vi_immed), + NULL); if (!vxfs_inode_cachep) return -ENOMEM; rv = register_filesystem(&vxfs_fs_type);