Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1736129
| From | Kees Cook <keescook@chromium.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH v3 19/31] ip: Define usercopy region in IP proto slab cache |
| Date | 2017-09-20 23:00 +0200 |
| Message-ID | <urUga-855-41@gated-at.bofh.it> (permalink) |
| References | <urU6t-818-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: David Windsor <dave@nullcore.net>
The ICMP filters for IPv4 and IPv6 raw sockets need to be copied to/from
userspace. In support of usercopy hardening, this patch defines a region
in the struct proto slab cache in which userspace copy operations are
allowed.
example usage trace:
net/ipv4/raw.c:
raw_seticmpfilter(...):
...
copy_from_user(&raw_sk(sk)->filter, ..., optlen)
raw_geticmpfilter(...):
...
copy_to_user(..., &raw_sk(sk)->filter, len)
net/ipv6/raw.c:
rawv6_seticmpfilter(...):
...
copy_from_user(&raw6_sk(sk)->filter, ..., optlen)
rawv6_geticmpfilter(...):
...
copy_to_user(..., &raw6_sk(sk)->filter, len)
This region is known as the slab cache's usercopy region. Slab caches can
now check that each copy operation involving cache-managed memory falls
entirely within the slab's usercopy region.
This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY
whitelisting code in the last public patch of grsecurity/PaX based on my
understanding of the code. Changes or omissions from the original code are
mine and don't reflect the original grsecurity/PaX code.
Signed-off-by: David Windsor <dave@nullcore.net>
[kees: split from network patch, provide usage trace]
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
---
net/ipv4/raw.c | 2 ++
net/ipv6/raw.c | 2 ++
2 files changed, 4 insertions(+)
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 33b70bfd1122..1b6fa4195ac9 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -970,6 +970,8 @@ struct proto raw_prot = {
.hash = raw_hash_sk,
.unhash = raw_unhash_sk,
.obj_size = sizeof(struct raw_sock),
+ .useroffset = offsetof(struct raw_sock, filter),
+ .usersize = sizeof_field(struct raw_sock, filter),
.h.raw_hash = &raw_v4_hashinfo,
#ifdef CONFIG_COMPAT
.compat_setsockopt = compat_raw_setsockopt,
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e4462b0ff801..041d1cd5e774 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1268,6 +1268,8 @@ struct proto rawv6_prot = {
.hash = raw_hash_sk,
.unhash = raw_unhash_sk,
.obj_size = sizeof(struct raw6_sock),
+ .useroffset = offsetof(struct raw6_sock, filter),
+ .usersize = sizeof_field(struct raw6_sock, filter),
.h.raw_hash = &raw_v6_hashinfo,
#ifdef CONFIG_COMPAT
.compat_setsockopt = compat_rawv6_setsockopt,
--
2.7.4
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH v3 00/31] Hardened usercopy whitelisting Kees Cook <keescook@chromium.org> - 2017-09-20 22:50 +0200
[PATCH v3 26/31] fork: Provide usercopy whitelisting for task_struct Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 15/31] xfs: Define usercopy region in xfs_inode slab cache Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 07/31] ext4: Define usercopy region in ext4_inode_cache slab cache Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 29/31] arm: Implement thread_struct whitelist for hardened usercopy Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 25/31] fork: Define usercopy region in thread_stack slab caches Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 02/31] usercopy: Enforce slab cache usercopy region boundaries Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
Re: [PATCH v3 02/31] usercopy: Enforce slab cache usercopy region boundaries Christopher Lameter <cl@linux.com> - 2017-09-21 17:30 +0200
[PATCH v3 23/31] net: Restrict unwhitelisted proto caches to size 0 Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 17/31] scsi: Define usercopy region in scsi_sense_cache slab cache Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 19/31] ip: Define usercopy region in IP proto slab cache Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 28/31] arm64: Implement thread_struct whitelist for hardened usercopy Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 21/31] sctp: Define usercopy region in SCTP proto slab cache Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 31/31] lkdtm: Update usercopy tests for whitelisting Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 01/31] usercopy: Prepare for usercopy whitelisting Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
Re: [PATCH v3 01/31] usercopy: Prepare for usercopy whitelisting Christopher Lameter <cl@linux.com> - 2017-09-21 17:30 +0200
[PATCH v3 08/31] ext2: Define usercopy region in ext2_inode_cache slab cache Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 18/31] net: Define usercopy region in struct proto slab cache Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 24/31] fork: Define usercopy region in mm_struct slab caches Kees Cook <keescook@chromium.org> - 2017-09-20 23:00 +0200
[PATCH v3 04/31] dcache: Define usercopy region in dentry_cache slab cache Kees Cook <keescook@chromium.org> - 2017-09-20 23:10 +0200
[PATCH v3 27/31] x86: Implement thread_struct whitelist for hardened usercopy Kees Cook <keescook@chromium.org> - 2017-09-20 23:10 +0200
[PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches Kees Cook <keescook@chromium.org> - 2017-09-20 23:10 +0200
Re: [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches Christopher Lameter <cl@linux.com> - 2017-09-21 17:30 +0200
Re: [kernel-hardening] Re: [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches Kees Cook <keescook@chromium.org> - 2017-09-21 17:50 +0200
Re: [kernel-hardening] Re: [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches Christopher Lameter <cl@linux.com> - 2017-09-21 18:10 +0200
Re: [kernel-hardening] Re: [PATCH v3 03/31] usercopy: Mark kmalloc caches as usercopy caches Kees Cook <keescook@chromium.org> - 2017-09-21 20:30 +0200
csiph-web