Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1722013

[PATCH v2 27/30] x86: Implement thread_struct whitelist for hardened usercopy

From Kees Cook <keescook@chromium.org>
Newsgroups linux.kernel
Subject [PATCH v2 27/30] x86: Implement thread_struct whitelist for hardened usercopy
Date 2017-08-29 00:00 +0200
Message-ID <ujAeB-2oT-5@gated-at.bofh.it> (permalink)
References <ujzVf-2ie-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw


This whitelists the FPU register state portion of the thread_struct for
copying to userspace, instead of the default entire struct.

Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: x86@kernel.org
Cc: Borislav Petkov <bp@suse.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Mathias Krause <minipli@googlemail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
---
 arch/x86/Kconfig                 | 1 +
 arch/x86/include/asm/processor.h | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 781521b7cf9e..a8793721483c 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -113,6 +113,7 @@ config X86
 	select HAVE_ARCH_MMAP_RND_COMPAT_BITS	if MMU && COMPAT
 	select HAVE_ARCH_COMPAT_MMAP_BASES	if MMU && COMPAT
 	select HAVE_ARCH_SECCOMP_FILTER
+	select HAVE_ARCH_THREAD_STRUCT_WHITELIST
 	select HAVE_ARCH_TRACEHOOK
 	select HAVE_ARCH_TRANSPARENT_HUGEPAGE
 	select HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD if X86_64
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 028245e1c42b..dc52ba90f090 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -481,6 +481,14 @@ struct thread_struct {
 	 */
 };
 
+/* Whitelist the FPU state from the task_struct for hardened usercopy. */
+static inline void arch_thread_struct_whitelist(unsigned long *offset,
+						unsigned long *size)
+{
+	*offset = offsetof(struct thread_struct, fpu.state);
+	*size = fpu_kernel_xstate_size;
+}
+
 /*
  * Thread-synchronous status.
  *
-- 
2.7.4

Back to linux.kernel | Previous | NextPrevious in thread | Next in thread | Find similar | Unroll thread


Thread

[PATCH v2 00/30] Hardened usercopy whitelisting Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 07/30] ext4: Define usercopy region in ext4_inode_cache slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 09/30] jfs: Define usercopy region in jfs_ip slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 06/30] vfs: Copy struct mount.mnt_id to userspace using put_user() Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 05/30] vfs: Define usercopy region in names_cache slab caches Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 08/30] ext2: Define usercopy region in ext2_inode_cache slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
    Re: [PATCH v2 08/30] ext2: Define usercopy region in  ext2_inode_cache slab cache Jan Kara <jack@suse.cz> - 2017-08-30 13:30 +0200
  [PATCH v2 13/30] ufs: Define usercopy region in ufs_inode_cache slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 16/30] cifs: Define usercopy region in cifs_request slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 02/30] usercopy: Enforce slab cache usercopy region boundaries Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 20/30] caif: Define usercopy region in caif proto slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 01/30] usercopy: Prepare for usercopy whitelisting Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 11/30] exofs: Define usercopy region in exofs_inode_cache slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 04/30] dcache: Define usercopy region in dentry_cache slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
  [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
    Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab cache Kees Cook <keescook@chromium.org> - 2017-08-29 00:00 +0200
      Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache "Darrick J. Wong" <darrick.wong@oracle.com> - 2017-08-29 06:50 +0200
        Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab cache Kees Cook <keescook@chromium.org> - 2017-08-29 20:50 +0200
          Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache "Darrick J. Wong" <darrick.wong@oracle.com> - 2017-08-29 21:10 +0200
          Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache Dave Chinner <david@fromorbit.com> - 2017-08-30 00:20 +0200
            Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab cache Kees Cook <keescook@chromium.org> - 2017-08-30 00:30 +0200
    Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache "Darrick J. Wong" <darrick.wong@oracle.com> - 2017-08-29 00:00 +0200
    Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache Christoph Hellwig <hch@infradead.org> - 2017-08-29 10:20 +0200
      Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache Dave Chinner <david@fromorbit.com> - 2017-08-29 14:40 +0200
        Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache Christoph Hellwig <hch@infradead.org> - 2017-08-29 14:50 +0200
          Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache Dave Chinner <david@fromorbit.com> - 2017-08-30 00:00 +0200
            Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache Christoph Hellwig <hch@infradead.org> - 2017-08-30 09:20 +0200
              Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache Dave Chinner <david@fromorbit.com> - 2017-08-30 10:10 +0200
                Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab  cache Christoph Hellwig <hch@infradead.org> - 2017-08-30 10:40 +0200
      Re: [PATCH v2 15/30] xfs: Define usercopy region in xfs_inode slab cache Kees Cook <keescook@chromium.org> - 2017-08-29 21:00 +0200
  [PATCH v2 10/30] befs: Define usercopy region in befs_inode_cache slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:40 +0200
    Re: [PATCH v2 10/30] befs: Define usercopy region in befs_inode_cache  slab cache Luis de Bethencourt <luisbg@kernel.org> - 2017-08-29 12:20 +0200
      Re: [PATCH v2 10/30] befs: Define usercopy region in befs_inode_cache  slab cache Kees Cook <keescook@chromium.org> - 2017-08-29 17:40 +0200
        Re: [PATCH v2 10/30] befs: Define usercopy region in befs_inode_cache  slab cache Luis de Bethencourt <luisbg@kernel.org> - 2017-08-29 19:20 +0200
  [PATCH v2 25/30] fork: Define usercopy region in thread_stack slab caches Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
    Re: [kernel-hardening] [PATCH v2 25/30] fork: Define usercopy  region in thread_stack slab caches Rik van Riel <riel@redhat.com> - 2017-08-30 21:00 +0200
  [PATCH v2 21/30] sctp: Define usercopy region in SCTP proto slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
  [PATCH v2 19/30] ip: Define usercopy region in IP proto slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
  [PATCH v2 22/30] sctp: Copy struct sctp_sock.autoclose to userspace using put_user() Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
  [PATCH v2 29/30] arm: Implement thread_struct whitelist for hardened usercopy Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
  [PATCH v2 30/30] usercopy: Restrict non-usercopy caches to size 0 Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
  [PATCH v2 14/30] vxfs: Define usercopy region in vxfs_inode slab cache Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
  [PATCH v2 24/30] fork: Define usercopy region in mm_struct slab caches Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
    Re: [kernel-hardening] [PATCH v2 24/30] fork: Define usercopy  region in mm_struct slab caches Rik van Riel <riel@redhat.com> - 2017-08-30 21:30 +0200
  [PATCH v2 23/30] net: Restrict unwhitelisted proto caches to size 0 Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
  [PATCH v2 26/30] fork: Provide usercopy whitelisting for task_struct Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
    Re: [kernel-hardening] [PATCH v2 26/30] fork: Provide usercopy  whitelisting for task_struct Rik van Riel <riel@redhat.com> - 2017-08-30 21:00 +0200
  [PATCH v2 28/30] arm64: Implement thread_struct whitelist for hardened usercopy Kees Cook <keescook@chromium.org> - 2017-08-28 23:50 +0200
  [PATCH v2 27/30] x86: Implement thread_struct whitelist for hardened usercopy Kees Cook <keescook@chromium.org> - 2017-08-29 00:00 +0200
    Re: [kernel-hardening] [PATCH v2 27/30] x86: Implement  thread_struct whitelist for hardened usercopy Rik van Riel <riel@redhat.com> - 2017-08-30 21:00 +0200
  [PATCH v2 18/30] net: Define usercopy region in struct proto slab cache Kees Cook <keescook@chromium.org> - 2017-08-29 00:00 +0200

csiph-web