From patchwork Mon Aug 28 21:34:57 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9926285 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 33B8060375 for ; Mon, 28 Aug 2017 21:38:59 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2875B287D5 for ; Mon, 28 Aug 2017 21:38:59 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1D502287DA; Mon, 28 Aug 2017 21:38:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, URIBL_BLACK autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 2B38A287DB for ; Mon, 28 Aug 2017 21:38:56 +0000 (UTC) Received: (qmail 13655 invoked by uid 550); 28 Aug 2017 21:35:51 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 12240 invoked from network); 28 Aug 2017 21:35:38 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=07z/bMspDGbkfMsuM4SNhF15x91QFTgIISxBb+ce3tk=; b=hBzckmhnYJ0uXd42bbk1zFf//BqVBu8bC/h9uJw04AIyMJcmXdzGHxHtK3KPA73RGa DTONvuEltkYShOFwX2lSs3PXrE3WKvKowp13TWgC2baPk5xgWZawmaRwNaPPY584NYGd +Yr97zQu9EOf2LaHHVfLAbNm0ZESc8u32SGnU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=07z/bMspDGbkfMsuM4SNhF15x91QFTgIISxBb+ce3tk=; b=THjmBqjASm2UQ+9Gy/z5OpTXi/FeXZbAUJdjLZRhPevfD74uoq25m9ZBmqZYGxHXyZ 0anOHWn3ppWEiSPDCSv+MCT+ZTfwHeNEr7Fg71+Vvn3DLzKsyVvSJhCHP60VmL83MBab ffOLXsCUc+CiCypZF9I7y3OFzsDLS9ebCywF9qGE7IOhS9/n9IVz0TX4pyBXtOq22e5C 6OxVsFTIVSGA7JVuh/w7Xvr3mRFEuZDUwtSQdktSfMnKqzjJKLT8s+hV/DZKmSJ3EhqD lQcMiDZOSQPfpfZ4KG8xPLMVK+GkDo14zfK3zn6k8JA0sgv5eO9OTDONiYAzbmwp2n3I F/Bg== X-Gm-Message-State: AHYfb5hB/0xbLxx/V3/5ObCL2huwUnHzohbsFUBEKWAfAGOziKwe2lLa VdWfi7KrDuvLrUpN X-Received: by 10.98.63.68 with SMTP id m65mr1812074pfa.257.1503956127026; Mon, 28 Aug 2017 14:35:27 -0700 (PDT) From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Kees Cook , David Windsor , Steve French , linux-cifs@vger.kernel.org, samba-technical@lists.samba.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com Date: Mon, 28 Aug 2017 14:34:57 -0700 Message-Id: <1503956111-36652-17-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1503956111-36652-1-git-send-email-keescook@chromium.org> References: <1503956111-36652-1-git-send-email-keescook@chromium.org> Subject: [kernel-hardening] [PATCH v2 16/30] cifs: Define usercopy region in cifs_request slab cache X-Virus-Scanned: ClamAV using ClamSMTP From: David Windsor CIFS request buffers, stored in the cifs_request slab cache, need to be copied to/from userspace. cache object allocation: fs/cifs/cifsfs.c: cifs_init_request_bufs(): ... cifs_req_poolp = mempool_create_slab_pool(cifs_min_rcv, cifs_req_cachep); fs/cifs/misc.c: cifs_buf_get(): ... ret_buf = mempool_alloc(cifs_req_poolp, GFP_NOFS); ... return ret_buf; In support of usercopy hardening, this patch defines a region in the cifs_request slab cache in which userspace copy operations are allowed. This region is known as the slab cache's usercopy region. Slab caches can now check that each copy operation involving cache-managed memory falls entirely within the slab's usercopy region. This patch is verbatim from Brad Spengler/PaX Team's PAX_USERCOPY whitelisting code in the last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original code are mine and don't reflect the original grsecurity/PaX code. Signed-off-by: David Windsor [kees: adjust commit log, provide usage trace] Cc: Steve French Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Kees Cook --- fs/cifs/cifsfs.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index 180b3356ff86..09dfdf76c738 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -1229,9 +1229,11 @@ cifs_init_request_bufs(void) cifs_dbg(VFS, "CIFSMaxBufSize %d 0x%x\n", CIFSMaxBufSize, CIFSMaxBufSize); */ - cifs_req_cachep = kmem_cache_create("cifs_request", + cifs_req_cachep = kmem_cache_create_usercopy("cifs_request", CIFSMaxBufSize + max_hdr_size, 0, - SLAB_HWCACHE_ALIGN, NULL); + SLAB_HWCACHE_ALIGN, 0, + CIFSMaxBufSize + max_hdr_size, + NULL); if (cifs_req_cachep == NULL) return -ENOMEM; @@ -1257,9 +1259,9 @@ cifs_init_request_bufs(void) more SMBs to use small buffer alloc and is still much more efficient to alloc 1 per page off the slab compared to 17K (5page) alloc of large cifs buffers even when page debugging is on */ - cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq", + cifs_sm_req_cachep = kmem_cache_create_usercopy("cifs_small_rq", MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN, - NULL); + 0, MAX_CIFS_SMALL_BUFFER_SIZE, NULL); if (cifs_sm_req_cachep == NULL) { mempool_destroy(cifs_req_poolp); kmem_cache_destroy(cifs_req_cachep);