Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1447136

RE: [PATCH v3 00/11] mm: Hardened usercopy

Show all headers | View raw

From: Kees Cook
> Sent: 15 July 2016 22:44
> This is a start of the mainline port of PAX_USERCOPY[1]. 
...
> - if address range is in the current process stack, it must be within the
>   current stack frame (if such checking is possible) or at least entirely
>   within the current process's stack.
...

That description doesn't seem quite right to me.
I presume the check is:
  Within the current process's stack and not crossing the ends of the
  current stack frame.

The 'current' stack frame is likely to be that of copy_to/from_user().
Even if you use the stack of the caller, any problematic buffers
are likely to have been passed in from a calling function.
So unless you are going to walk the stack (good luck on that)
I'm not sure checking the stack frames is worth it.

I'd also guess that a lot of copies are from the middle of structures
so cannot fail the tests you are adding.

	David

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH v3 00/11] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-15 23:50 +0200
  [PATCH v3 07/11] powerpc/uaccess: Enable hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-15 23:50 +0200
  [PATCH v3 06/11] ia64/uaccess: Enable hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-15 23:50 +0200
  Re: [PATCH v3 00/11] mm: Hardened usercopy Balbir Singh <bsingharora@gmail.com> - 2016-07-18 10:30 +0200
  RE: [PATCH v3 00/11] mm: Hardened usercopy David Laight <David.Laight@ACULAB.COM> - 2016-07-20 12:00 +0200
    Re: [PATCH v3 00/11] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-20 17:40 +0200
      RE: [PATCH v3 00/11] mm: Hardened usercopy David Laight <David.Laight@ACULAB.COM> - 2016-07-20 18:10 +0200
        Re: [PATCH v3 00/11] mm: Hardened usercopy Rik van Riel <riel@redhat.com> - 2016-07-20 18:30 +0200
        Re: [PATCH v3 00/11] mm: Hardened usercopy Kees Cook <keescook@chromium.org> - 2016-07-20 19:50 +0200

csiph-web