[05/36] usercopy: WARN() on slab cache usercopy region violations

Commit Message

Kees Cook Jan. 9, 2018, 8:55 p.m. UTC

From: David Windsor <[e-mail]>

This patch adds checking of usercopy cache whitelisting, and is modified
from Brad Spengler/PaX Team's PAX_USERCOPY whitelisting code in the
last public patch of grsecurity/PaX based on my understanding of the
code. Changes or omissions from the original code are mine and don't
reflect the original grsecurity/PaX code.

The SLAB and SLUB allocators are modified to WARN() on all copy operations
in which the kernel heap memory being modified falls outside of the cache's
defined usercopy region.

Signed-off-by: David Windsor <[e-mail]>
[kees: adjust commit log and comments, switch to WARN-by-default]
Cc: Christoph Lameter <[e-mail]>
Cc: Pekka Enberg <[e-mail]>
Cc: David Rientjes <[e-mail]>
Cc: Joonsoo Kim <[e-mail]>
Cc: Andrew Morton <[e-mail]>
Cc: Laura Abbott <[e-mail]>
Cc: Ingo Molnar <[e-mail]>
Cc: Mark Rutland <[e-mail]>
Cc: [e-mail]
Cc: [e-mail]
Signed-off-by: Kees Cook <[e-mail]>
---
 mm/slab.c     | 30 +++++++++++++++++++++++++-----
 mm/slub.c     | 34 +++++++++++++++++++++++++++-------
 mm/usercopy.c | 12 ++++++++++++
 3 files changed, 64 insertions(+), 12 deletions(-)

Comments

Christoph Lameter (Ampere) Jan. 10, 2018, 6:31 p.m. UTC | #1

On Tue, 9 Jan 2018, Kees Cook wrote:

> @@ -3823,11 +3825,9 @@ int __check_heap_object(const void *ptr, unsigned long n, struct page *page,

Could we do the check in mm_slab_common.c for all allocators and just have
a small function in each allocators that give you the metadata needed for
the object?

> + * carefully audit the whitelist range).
> + */
>  int report_usercopy(const char *name, const char *detail, bool to_user,
>  		    unsigned long offset, unsigned long len)
>  {

Should this not be added earlier?

Kees Cook Jan. 10, 2018, 8:14 p.m. UTC | #2

On Wed, Jan 10, 2018 at 10:31 AM, Christopher Lameter <[e-mail]> wrote:
> On Tue, 9 Jan 2018, Kees Cook wrote:
>
>> @@ -3823,11 +3825,9 @@ int __check_heap_object(const void *ptr, unsigned long n, struct page *page,
>
> Could we do the check in mm_slab_common.c for all allocators and just have
> a small function in each allocators that give you the metadata needed for
> the object?

That could be done, but there would still need to be some
implementation-specific checks in the per-implementation side (e.g.
red-zone, etc). I'll work up a patch and see if it's less ugly than
what I've currently got. :)

>> + * carefully audit the whitelist range).
>> + */
>>  int report_usercopy(const char *name, const char *detail, bool to_user,
>>                   unsigned long offset, unsigned long len)
>>  {
>
> Should this not be added earlier?

This seemed like the best place to add this since it's where the WARN
is being added, so it's a bit more help for anyone looking at the
code.

-Kees

Patch

diff --git a/mm/slab.c b/mm/slab.c
index f1ead7b7909d..d9939828f8e4 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4392,7 +4392,9 @@  module_init(slab_proc_init);
 
 #ifdef CONFIG_HARDENED_USERCOPY
 /*
- * Rejects objects that are incorrectly sized.
+ * Rejects incorrectly sized objects and objects that are to be copied
+ * to/from userspace but do not fall entirely within the containing slab
+ * cache's usercopy region.
  *
  * Returns NULL if check passes, otherwise const char * to name of cache
  * to indicate an error.
@@ -4412,11 +4414,29 @@  int __check_heap_object(const void *ptr, unsigned long n, struct page *page,
 	/* Find offset within object. */
 	offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
 
-	/* Allow address range falling entirely within object size. */
-	if (offset <= cachep->object_size && n <= cachep->object_size - offset)
-		return 0;
+	/* Make sure object falls entirely within cache's usercopy region. */
+	if (offset < cachep->useroffset ||
+	    offset - cachep->useroffset > cachep->usersize ||
+	    n > cachep->useroffset - offset + cachep->usersize) {
+		/*
+		 * If the copy is still within the allocated object, produce
+		 * a warning instead of rejecting the copy. This is intended
+		 * to be a temporary method to find any missing usercopy
+		 * whitelists.
+		 */
+		if (offset <= cachep->object_size &&
+		    n <= cachep->object_size - offset) {
+			WARN_ONCE(1, "unexpected usercopy %s with bad or missing whitelist with SLAB object '%s' (offset %lu, size %lu)",
+				  to_user ? "exposure" : "overwrite",
+				  cachep->name, offset, n);
+			return 0;
+		}
 
-	return report_usercopy("SLAB object", cachep->name, to_user, offset, n);
+		return report_usercopy("SLAB object", cachep->name, to_user,
+				       offset, n);
+	}
+
+	return 0;
 }
 #endif /* CONFIG_HARDENED_USERCOPY */
 
diff --git a/mm/slub.c b/mm/slub.c
index 8738a8d8bf8e..2aa4972a2058 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3813,7 +3813,9 @@  EXPORT_SYMBOL(__kmalloc_node);
 
 #ifdef CONFIG_HARDENED_USERCOPY
 /*
- * Rejects objects that are incorrectly sized.
+ * Rejects incorrectly sized objects and objects that are to be copied
+ * to/from userspace but do not fall entirely within the containing slab
+ * cache's usercopy region.
  *
  * Returns NULL if check passes, otherwise const char * to name of cache
  * to indicate an error.
@@ -3823,11 +3825,9 @@  int __check_heap_object(const void *ptr, unsigned long n, struct page *page,
 {
 	struct kmem_cache *s;
 	unsigned long offset;
-	size_t object_size;
 
 	/* Find object and usable object size. */
 	s = page->slab_cache;
-	object_size = slab_ksize(s);
 
 	/* Reject impossible pointers. */
 	if (ptr < page_address(page))
@@ -3845,11 +3845,31 @@  int __check_heap_object(const void *ptr, unsigned long n, struct page *page,
 		offset -= s->red_left_pad;
 	}
 
-	/* Allow address range falling entirely within object size. */
-	if (offset <= object_size && n <= object_size - offset)
-		return 0;
+	/* Make sure object falls entirely within cache's usercopy region. */
+	if (offset < s->useroffset ||
+	    offset - s->useroffset > s->usersize ||
+	    n > s->useroffset - offset + s->usersize) {
+		size_t object_size;
 
-	return report_usercopy("SLUB object", s->name, to_user, offset, n);
+		/*
+		 * If the copy is still within the allocated object, produce
+		 * a warning instead of rejecting the copy. This is intended
+		 * to be a temporary method to find any missing usercopy
+		 * whitelists.
+		 */
+		object_size = slab_ksize(s);
+		if ((offset <= object_size && n <= object_size - offset)) {
+			WARN_ONCE(1, "unexpected usercopy %s with bad or missing whitelist with SLUB object '%s' (offset %lu size %lu)",
+				  to_user ? "exposure" : "overwrite",
+				  s->name, offset, n);
+			return 0;
+		}
+
+		return report_usercopy("SLUB object", s->name, to_user,
+				       offset, n);
+	}
+
+	return 0;
 }
 #endif /* CONFIG_HARDENED_USERCOPY */
 
diff --git a/mm/usercopy.c b/mm/usercopy.c
index a8426a502136..4ed615d4efc8 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -58,6 +58,18 @@  static noinline int check_stack_object(const void *obj, unsigned long len)
 	return GOOD_STACK;
 }
 
+/*
+ * If this function is reached, then CONFIG_HARDENED_USERCOPY has found an
+ * unexpected state during a copy_from_user() or copy_to_user() call.
+ * There are several checks being performed on the buffer by the
+ * __check_object_size() function. Normal stack buffer usage should never
+ * trip the checks, and kernel text addressing will always trip the check.
+ * For cache objects, it is checking that only the whitelisted range of
+ * bytes for a given cache is being accessed (via the cache's usersize and
+ * useroffset fields). To adjust a cache whitelist, use the usercopy-aware
+ * kmem_cache_create_usercopy() function to create the cache (and
+ * carefully audit the whitelist range).
+ */
 int report_usercopy(const char *name, const char *detail, bool to_user,
 		    unsigned long offset, unsigned long len)
 {