Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1438777

Re: [PATCH 1/9] mm: Hardened usercopy

Show all headers | View raw

On Thu, Jul 7, 2016 at 12:35 PM, Rik van Riel <riel@redhat.com> wrote:
> On Wed, 2016-07-06 at 15:25 -0700, Kees Cook wrote:
>>
>> +     /* Allow kernel rodata region (if not marked as Reserved).
>> */
>> +     if (ptr >= (const void *)__start_rodata &&
>> +         end <= (const void *)__end_rodata)
>> +             return NULL;
>>
> One comment here.
>
> __check_object_size gets "to_user" as an argument.
>
> It may make sense to pass that to check_heap_object, and
> only allow copy_to_user from rodata, never copy_from_user,
> since that section should be read only.

Well, that's two votes for this extra check, but I'm still not sure
since it may already be allowed by the Reserved check, but I can
reorder things to _reject_ on rodata writes before the Reserved check,
etc.

I'll see what could work here...

-Kees

>
>> +void __check_object_size(const void *ptr, unsigned long n, bool
>> to_user)
>> +{
>>
>
> --
>
> All Rights Reversed.



-- 
Kees Cook
Chrome OS & Brillo Security

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 0/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 00:30 +0200
  [PATCH 6/9] powerpc/uaccess: Enable hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 00:30 +0200
  [PATCH 1/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 00:30 +0200
    Re: [PATCH 1/9] mm: Hardened usercopy Baruch Siach <baruch@tkos.co.il> - 2016-07-07 07:40 +0200
      Re: [PATCH 1/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 19:30 +0200
        Re: [PATCH 1/9] mm: Hardened usercopy Baruch Siach <baruch@tkos.co.il> - 2016-07-07 20:50 +0200
    Re: [PATCH 1/9] mm: Hardened usercopy Thomas Gleixner <tglx@linutronix.de> - 2016-07-07 09:50 +0200
      Re: [PATCH 1/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 19:40 +0200
        Re: [PATCH 1/9] mm: Hardened usercopy Thomas Gleixner <tglx@linutronix.de> - 2016-07-07 21:40 +0200
    Re: [PATCH 1/9] mm: Hardened usercopy Arnd Bergmann <arnd@arndb.de> - 2016-07-07 10:10 +0200
      Re: [PATCH 1/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 19:40 +0200
        Re: [PATCH 1/9] mm: Hardened usercopy Arnd Bergmann <arnd@arndb.de> - 2016-07-08 11:30 +0200
    Re: [PATCH 1/9] mm: Hardened usercopy Rik van Riel <riel@redhat.com> - 2016-07-07 18:30 +0200
    Re: [PATCH 1/9] mm: Hardened usercopy Rik van Riel <riel@redhat.com> - 2016-07-07 18:40 +0200
      Re: [PATCH 1/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 19:50 +0200
  [PATCH 2/9] x86/uaccess: Enable hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 00:30 +0200
  [PATCH 7/9] sparc/uaccess: Enable hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 00:30 +0200
  Re: [PATCH 0/9] mm: Hardened usercopy Christian Borntraeger <borntraeger@de.ibm.com> - 2016-07-07 09:40 +0200
    Re: [PATCH 0/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-07 19:30 +0200
  Re: [PATCH 0/9] mm: Hardened usercopy Ingo Molnar <mingo@kernel.org> - 2016-07-08 10:50 +0200
    Re: [PATCH 0/9] mm: Hardened usercopy Linus Torvalds <torvalds@linux-foundation.org> - 2016-07-08 18:20 +0200
      Re: [PATCH 0/9] mm: Hardened usercopy Ingo Molnar <mingo@kernel.org> - 2016-07-08 20:30 +0200
  Re: [PATCH 0/9] mm: Hardened usercopy Rik van Riel <riel@redhat.com> - 2016-07-09 04:50 +0200
    Re: [PATCH 0/9] mm: Hardened usercopy Ingo Molnar <mingo@kernel.org> - 2016-07-09 10:00 +0200
  Re: [PATCH 0/9] mm: Hardened usercopy Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-07-09 10:30 +0200
    Re: [PATCH 0/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-09 19:10 +0200
  Re: [PATCH 0/9] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-09 19:10 +0200
  Re: [PATCH 0/9] mm: Hardened usercopy Andy Lutomirski <luto@amacapital.net> - 2016-07-09 23:30 +0200
    Re: [PATCH 0/9] mm: Hardened usercopy "PaX Team" <pageexec@freemail.hu> - 2016-07-10 01:20 +0200

csiph-web