From patchwork Wed Sep 20 20:45:11 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9962423 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 0C05F60208 for ; Wed, 20 Sep 2017 20:47:37 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A1D5627F89 for ; Wed, 20 Sep 2017 20:47:35 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 969FF28595; Wed, 20 Sep 2017 20:47:35 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.4 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED, T_DKIM_INVALID, URIBL_BLACK autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 9EA8727F89 for ; Wed, 20 Sep 2017 20:47:34 +0000 (UTC) Received: (qmail 3523 invoked by uid 550); 20 Sep 2017 20:46:18 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 3355 invoked from network); 20 Sep 2017 20:46:14 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=guDJ44pN3QXUcnxkBLtl1izw4RCuvLosziifFWcgdJs=; b=k+Ud0bIcmj7XSK1c7y4e5sMMybz040WNe+O3rVUIqScybyNFKRxGa7rM60ygqMe1L5 XP6cG37uSw0I9Y2G2RUzge+zZFMLQjI7nPhh6izuj63ilpVit8lM+Q3nPeASKmXAWSHM fhjN80+WeB9pFwYtn4tvQ9gqRRS7lKGP7NyPc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=guDJ44pN3QXUcnxkBLtl1izw4RCuvLosziifFWcgdJs=; b=Q30CbrPA7L4j6FIXR7TMGhJMuOxadCmca2kTyLWnn1/H2vOvQ3+rzcvP61rRwc07vn vvoJAM/fRMxIOCqbPfYoJR3KQzuzhhw9areh1yPqW7Vco+msYbhUBvhoW8acLHJ0CI0k POGhQ8wHE0yR4TtvihMNtykb6Mz+4/Gd9JnR8VDj7s1t5sm/hZLWtzRWxCOkoy59RB7T 4aRBLHh3jlDY/lSaGHZwvVX+XLHm0193Tgb8nm9ETNyT2zufRwkcvgVr2VZM85FR0Zid pOaRqaefnaFb+jvBl3cjDtvSJZ8fWan1UgWRXrBx1GhY3xk/Q+rjvrUxhnSr5r6FmvPM q7JA== X-Gm-Message-State: AHPjjUjAnifH3SarK9gxPeWBfICXQ3evZuChvuNGix/UPvkysCwwYfG1 CZD9InksyaHhAKPy1/CR6kBfXg== X-Google-Smtp-Source: AOwi7QB6/Ywb5q65pasgaUtLau2haawVsjOevWTyJJz/pUOpOYLbcWbqN4hnOiyxU3+UB5zRH8P6VA== X-Received: by 10.159.194.137 with SMTP id y9mr3307706pln.77.1505940362933; Wed, 20 Sep 2017 13:46:02 -0700 (PDT) From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Kees Cook , David Windsor , Alexander Viro , linux-fsdevel@vger.kernel.org, netdev@vger.kernel.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com Date: Wed, 20 Sep 2017 13:45:11 -0700 Message-Id: <1505940337-79069-6-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1505940337-79069-1-git-send-email-keescook@chromium.org> References: <1505940337-79069-1-git-send-email-keescook@chromium.org> Subject: [kernel-hardening] [PATCH v3 05/31] vfs: Define usercopy region in names_cache slab caches X-Virus-Scanned: ClamAV using ClamSMTP From: David Windsor VFS pathnames are stored in the names_cache slab cache, either inline or across an entire allocation entry (when approaching PATH_MAX). These are copied to/from userspace, so they must be entirely whitelisted. cache object allocation: include/linux/fs.h: #define __getname() kmem_cache_alloc(names_cachep, GFP_KERNEL) example usage trace: strncpy_from_user+0x4d/0x170 getname_flags+0x6f/0x1f0 user_path_at_empty+0x23/0x40 do_mount+0x69/0xda0 SyS_mount+0x83/0xd0 fs/namei.c: getname_flags(...): ... result = __getname(); ... kname = (char *)result->iname; result->name = kname; len = strncpy_from_user(kname, filename, EMBEDDED_NAME_MAX); ... if (unlikely(len == EMBEDDED_NAME_MAX)) { const size_t size = offsetof(struct filename, iname[1]); kname = (char *)result; result = kzalloc(size, GFP_KERNEL); ... result->name = kname; len = strncpy_from_user(kname, filename, PATH_MAX); In support of usercopy hardening, this patch defines the entire cache object in the names_cache slab cache as whitelisted, since it may entirely hold name strings to be copied to/from userspace. This patch is verbatim from Brad Spengler/PaX Team's PAX_USERCOPY whitelisting code in the last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original code are mine and don't reflect the original grsecurity/PaX code. Signed-off-by: David Windsor [kees: adjust commit log, add usage trace] Cc: Alexander Viro Cc: linux-fsdevel@vger.kernel.org Signed-off-by: Kees Cook --- fs/dcache.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/dcache.c b/fs/dcache.c index 5f5e7c1fcf4b..34ef9a9169be 100644 --- a/fs/dcache.c +++ b/fs/dcache.c @@ -3642,8 +3642,8 @@ void __init vfs_caches_init_early(void) void __init vfs_caches_init(void) { - names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0, - SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL); + names_cachep = kmem_cache_create_usercopy("names_cache", PATH_MAX, 0, + SLAB_HWCACHE_ALIGN|SLAB_PANIC, 0, PATH_MAX, NULL); dcache_init(); inode_init();