From patchwork Mon Aug 28 21:34:57 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9926261 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3229760375 for ; Mon, 28 Aug 2017 21:37:56 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 216BE287E9 for ; Mon, 28 Aug 2017 21:37:56 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 16070287E0; Mon, 28 Aug 2017 21:37:56 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID,URIBL_BLACK autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B7BA7287DE for ; Mon, 28 Aug 2017 21:37:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751821AbdH1Vgv (ORCPT ); Mon, 28 Aug 2017 17:36:51 -0400 Received: from mail-pg0-f42.google.com ([74.125.83.42]:33936 "EHLO mail-pg0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751516AbdH1Vf1 (ORCPT ); Mon, 28 Aug 2017 17:35:27 -0400 Received: by mail-pg0-f42.google.com with SMTP id y15so5011816pgc.1 for ; Mon, 28 Aug 2017 14:35:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=07z/bMspDGbkfMsuM4SNhF15x91QFTgIISxBb+ce3tk=; b=hBzckmhnYJ0uXd42bbk1zFf//BqVBu8bC/h9uJw04AIyMJcmXdzGHxHtK3KPA73RGa DTONvuEltkYShOFwX2lSs3PXrE3WKvKowp13TWgC2baPk5xgWZawmaRwNaPPY584NYGd +Yr97zQu9EOf2LaHHVfLAbNm0ZESc8u32SGnU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=07z/bMspDGbkfMsuM4SNhF15x91QFTgIISxBb+ce3tk=; b=O9pQ/GaawfN/sGNsKfpBrpebhwk5qd20+Zup69BVVK2pu7LQHEVJc9p2vn6zLwshLo R9OV0dlM7AYcqBf14AVM7Kia02vNYtJ5JzvghZOKDzluc4Mxq3vBTcOiNBZ36kFReium w64bA5s+5CF3WJhaCUns+EBLESVzBFWgF9HGX5enjLn+OjUttFEcuuTr3zW1rU4ULssW L6N0DbLy4eQDy/JRpO6y8khzVuzh9tJ6hG82KTFj16pgyjM5n5ES+n0pxPT9ZobGxv+u i+gqPj2Qio78axmb73wCGDnDao7N/y6tgqxeEwZ/+AVLB/taZgvisUw04sD4a5leXf7u f/XA== X-Gm-Message-State: AHYfb5j7cBX6/KsDOJ9NVQeFcOLpX3iK+wnkLmKHqtI8dK2Ds53GS2gG jVfYsQ3tXC6nXmM/ X-Received: by 10.98.63.68 with SMTP id m65mr1812074pfa.257.1503956127026; Mon, 28 Aug 2017 14:35:27 -0700 (PDT) Received: from www.outflux.net (173-164-112-133-Oregon.hfc.comcastbusiness.net. [173.164.112.133]) by smtp.gmail.com with ESMTPSA id o64sm2399254pfk.84.2017.08.28.14.35.21 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 28 Aug 2017 14:35:25 -0700 (PDT) From: Kees Cook To: linux-kernel@vger.kernel.org Cc: Kees Cook , David Windsor , Steve French , linux-cifs@vger.kernel.org, samba-technical@lists.samba.org, linux-mm@kvack.org, kernel-hardening@lists.openwall.com Subject: [PATCH v2 16/30] cifs: Define usercopy region in cifs_request slab cache Date: Mon, 28 Aug 2017 14:34:57 -0700 Message-Id: <1503956111-36652-17-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1503956111-36652-1-git-send-email-keescook@chromium.org> References: <1503956111-36652-1-git-send-email-keescook@chromium.org> Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: David Windsor CIFS request buffers, stored in the cifs_request slab cache, need to be copied to/from userspace. cache object allocation: fs/cifs/cifsfs.c: cifs_init_request_bufs(): ... cifs_req_poolp = mempool_create_slab_pool(cifs_min_rcv, cifs_req_cachep); fs/cifs/misc.c: cifs_buf_get(): ... ret_buf = mempool_alloc(cifs_req_poolp, GFP_NOFS); ... return ret_buf; In support of usercopy hardening, this patch defines a region in the cifs_request slab cache in which userspace copy operations are allowed. This region is known as the slab cache's usercopy region. Slab caches can now check that each copy operation involving cache-managed memory falls entirely within the slab's usercopy region. This patch is verbatim from Brad Spengler/PaX Team's PAX_USERCOPY whitelisting code in the last public patch of grsecurity/PaX based on my understanding of the code. Changes or omissions from the original code are mine and don't reflect the original grsecurity/PaX code. Signed-off-by: David Windsor [kees: adjust commit log, provide usage trace] Cc: Steve French Cc: linux-cifs@vger.kernel.org Cc: samba-technical@lists.samba.org Signed-off-by: Kees Cook --- fs/cifs/cifsfs.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index 180b3356ff86..09dfdf76c738 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -1229,9 +1229,11 @@ cifs_init_request_bufs(void) cifs_dbg(VFS, "CIFSMaxBufSize %d 0x%x\n", CIFSMaxBufSize, CIFSMaxBufSize); */ - cifs_req_cachep = kmem_cache_create("cifs_request", + cifs_req_cachep = kmem_cache_create_usercopy("cifs_request", CIFSMaxBufSize + max_hdr_size, 0, - SLAB_HWCACHE_ALIGN, NULL); + SLAB_HWCACHE_ALIGN, 0, + CIFSMaxBufSize + max_hdr_size, + NULL); if (cifs_req_cachep == NULL) return -ENOMEM; @@ -1257,9 +1259,9 @@ cifs_init_request_bufs(void) more SMBs to use small buffer alloc and is still much more efficient to alloc 1 per page off the slab compared to 17K (5page) alloc of large cifs buffers even when page debugging is on */ - cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq", + cifs_sm_req_cachep = kmem_cache_create_usercopy("cifs_small_rq", MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN, - NULL); + 0, MAX_CIFS_SMALL_BUFFER_SIZE, NULL); if (cifs_sm_req_cachep == NULL) { mempool_destroy(cifs_req_poolp); kmem_cache_destroy(cifs_req_cachep);