[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20161103042301.GA24968@remoulade>
Date: Thu, 3 Nov 2016 04:23:02 +0000
From: Mark Rutland <mark.rutland@....com>
To: Vaishali Thakkar <vaishali.thakkar@...cle.com>
Cc: Kees Cook <keescook@...omium.org>,
"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>,
Al Viro <viro@...iv.linux.org.uk>,
David Windsor <dwindsor@...il.com>
Subject: Re: [RFC PATCH] lib: Harden
csum_partial_copy_from_user
Hi Vaishali,
On Thu, Nov 03, 2016 at 07:44:35AM +0530, Vaishali Thakkar wrote:
> On Thursday 03 November 2016 03:29 AM, Kees Cook wrote:
> > On Wed, Nov 2, 2016 at 2:44 PM, Mark Rutland <mark.rutland@....com> wrote:
> >> I know that both arm64 and x86 have a check_object_size() call in their
> >> __copy_from_user() implementations.
> >> Is that missing on some architectures?
> >
> > Every architecture is _slightly_ different. Most put the check in
> > __copy_from_user() so it's correctly caught. (x86 puts them in both
> > since copy*() calls _copy*(), not __copy*() ... >_<)
>
> I think still there are some architectures which didn't put the check
> in __copy_from_user() [eg. tile].
I see. :(
Looking again, a grep shows many (even those with MMUs) don't do anything at
all in v4.9-rc2:
[mark@...oulade:~/src/linux]% for ARCH in arch/*; do
printf "%d %s\n" $(git grep check_object_size -- "${ARCH}" | wc -l) ${ARCH};
done | sort -n
0 arch/alpha
0 arch/arc
0 arch/avr32
0 arch/blackfin
0 arch/c6x
0 arch/cris
0 arch/frv
0 arch/h8300
0 arch/hexagon
0 arch/Kconfig
0 arch/m32r
0 arch/m68k
0 arch/metag
0 arch/microblaze
0 arch/mn10300
0 arch/nios2
0 arch/openrisc
0 arch/score
0 arch/sh
0 arch/tile
0 arch/um
0 arch/unicore32
0 arch/xtensa
2 arch/parisc
2 arch/s390
3 arch/arm
4 arch/arm64
4 arch/ia64
4 arch/powerpc
5 arch/sparc
6 arch/mips
6 arch/x86
> I was actually wondering if there are any cases where we need any
> architecture specific extra check(s)?
Generally, I'd expect that to be orthogonal to the hardened usercopy work, and
that check would still be present in the low-level architecture-specific code
even if we made the check_object_size() checks common.
Do you have an example of the kind of thing you're worried about?
Thanks,
Mark.
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
