[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <063D6719AE5E284EB5DD2968C1650D6D5F502102@AcuExch.aculab.com>
Date: Mon, 25 Jul 2016 09:27:31 +0000
From: David Laight <David.Laight@...LAB.COM>
To: 'Josh Poimboeuf' <jpoimboe@...hat.com>, Kees Cook <keescook@...omium.org>
CC: Jan Kara <jack@...e.cz>, "kernel-hardening@...ts.openwall.com"
<kernel-hardening@...ts.openwall.com>, Will Deacon <will.deacon@....com>,
Linux-MM <linux-mm@...ck.org>, sparclinux <sparclinux@...r.kernel.org>,
"linux-ia64@...r.kernel.org" <linux-ia64@...r.kernel.org>, Christoph Lameter
<cl@...ux.com>, Andrea Arcangeli <aarcange@...hat.com>, linux-arch
<linux-arch@...r.kernel.org>, "x86@...nel.org" <x86@...nel.org>, Russell King
<linux@...linux.org.uk>, "linux-arm-kernel@...ts.infradead.org"
<linux-arm-kernel@...ts.infradead.org>, Catalin Marinas
<catalin.marinas@....com>, PaX Team <pageexec@...email.hu>, Borislav Petkov
<bp@...e.de>, Mathias Krause <minipli@...glemail.com>, Fenghua Yu
<fenghua.yu@...el.com>, Rik van Riel <riel@...hat.com>, David Rientjes
<rientjes@...gle.com>, Tony Luck <tony.luck@...el.com>, Andy Lutomirski
<luto@...nel.org>, Joonsoo Kim <iamjoonsoo.kim@....com>, Dmitry Vyukov
<dvyukov@...gle.com>, Laura Abbott <labbott@...oraproject.org>, Brad Spengler
<spender@...ecurity.net>, Ard Biesheuvel <ard.biesheuvel@...aro.org>, LKML
<linux-kernel@...r.kernel.org>, Pekka Enberg <penberg@...nel.org>, "Daniel
Micay" <danielmicay@...il.com>, Casey Schaufler <casey@...aufler-ca.com>,
Andrew Morton <akpm@...ux-foundation.org>, "linuxppc-dev@...ts.ozlabs.org"
<linuxppc-dev@...ts.ozlabs.org>, "David S. Miller" <davem@...emloft.net>
Subject: RE: [PATCH v3 02/11] mm: Hardened usercopy
From: Josh Poimboeuf
> Sent: 22 July 2016 18:46
..
> > >> +/*
> > >> + * Checks if a given pointer and length is contained by the current
> > >> + * stack frame (if possible).
> > >> + *
> > >> + * 0: not at all on the stack
> > >> + * 1: fully within a valid stack frame
> > >> + * 2: fully on the stack (when can't do frame-checking)
> > >> + * -1: error condition (invalid stack position or bad stack frame)
> > >> + */
> > >> +static noinline int check_stack_object(const void *obj, unsigned long len)
> > >> +{
> > >> + const void * const stack = task_stack_page(current);
> > >> + const void * const stackend = stack + THREAD_SIZE;
> > >
> > > That allows access to the entire stack, including the struct thread_info,
> > > is that what we want - it seems dangerous? Or did I miss a check
> > > somewhere else?
> >
> > That seems like a nice improvement to make, yeah.
> >
> > > We have end_of_stack() which computes the end of the stack taking
> > > thread_info into account (end being the opposite of your end above).
> >
> > Amusingly, the object_is_on_stack() check in sched.h doesn't take
> > thread_info into account either. :P Regardless, I think using
> > end_of_stack() may not be best. To tighten the check, I think we could
> > add this after checking that the object is on the stack:
> >
> > #ifdef CONFIG_STACK_GROWSUP
> > stackend -= sizeof(struct thread_info);
> > #else
> > stack += sizeof(struct thread_info);
> > #endif
> >
> > e.g. then if the pointer was in the thread_info, the second test would
> > fail, triggering the protection.
>
> FWIW, this won't work right on x86 after Andy's
> CONFIG_THREAD_INFO_IN_TASK patches get merged.
What ends up in the 'thread_info' area?
If it contains the fp save area then programs like gdb may end up requesting
copy_in/out directly from that area.
Interestingly the avx registers don't need saving on a normal system call
entry (they are all caller-saved) so the kernel stack can safely overwrite
that area.
Syscall entry probably ought to execute the 'zero all avx registers' instruction.
They do need saving on interrupt entry - but the stack used will be less.
David
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
