lkml.org 
[lkml]   [2018]   [Jan]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 21/36] ip: Define usercopy region in IP proto slab cache
    Date
    From: David Windsor <dave@nullcore.net>

    The ICMP filters for IPv4 and IPv6 raw sockets need to be copied to/from
    userspace. In support of usercopy hardening, this patch defines a region
    in the struct proto slab cache in which userspace copy operations are
    allowed.

    example usage trace:

    net/ipv4/raw.c:
    raw_seticmpfilter(...):
    ...
    copy_from_user(&raw_sk(sk)->filter, ..., optlen)

    raw_geticmpfilter(...):
    ...
    copy_to_user(..., &raw_sk(sk)->filter, len)

    net/ipv6/raw.c:
    rawv6_seticmpfilter(...):
    ...
    copy_from_user(&raw6_sk(sk)->filter, ..., optlen)

    rawv6_geticmpfilter(...):
    ...
    copy_to_user(..., &raw6_sk(sk)->filter, len)

    This region is known as the slab cache's usercopy region. Slab caches
    can now check that each dynamically sized copy operation involving
    cache-managed memory falls entirely within the slab's usercopy region.

    This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY
    whitelisting code in the last public patch of grsecurity/PaX based on my
    understanding of the code. Changes or omissions from the original code are
    mine and don't reflect the original grsecurity/PaX code.

    Signed-off-by: David Windsor <dave@nullcore.net>
    [kees: split from network patch, provide usage trace]
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
    Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
    Cc: netdev@vger.kernel.org
    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    net/ipv4/raw.c | 2 ++
    net/ipv6/raw.c | 2 ++
    2 files changed, 4 insertions(+)

    diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
    index 33b70bfd1122..1b6fa4195ac9 100644
    --- a/net/ipv4/raw.c
    +++ b/net/ipv4/raw.c
    @@ -970,6 +970,8 @@ struct proto raw_prot = {
    .hash = raw_hash_sk,
    .unhash = raw_unhash_sk,
    .obj_size = sizeof(struct raw_sock),
    + .useroffset = offsetof(struct raw_sock, filter),
    + .usersize = sizeof_field(struct raw_sock, filter),
    .h.raw_hash = &raw_v4_hashinfo,
    #ifdef CONFIG_COMPAT
    .compat_setsockopt = compat_raw_setsockopt,
    diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
    index 761a473a07c5..08a85fabdfd1 100644
    --- a/net/ipv6/raw.c
    +++ b/net/ipv6/raw.c
    @@ -1272,6 +1272,8 @@ struct proto rawv6_prot = {
    .hash = raw_hash_sk,
    .unhash = raw_unhash_sk,
    .obj_size = sizeof(struct raw6_sock),
    + .useroffset = offsetof(struct raw6_sock, filter),
    + .usersize = sizeof_field(struct raw6_sock, filter),
    .h.raw_hash = &raw_v6_hashinfo,
    #ifdef CONFIG_COMPAT
    .compat_setsockopt = compat_rawv6_setsockopt,
    --
    2.7.4
    \
     
     \ /
      Last update: 2018-01-14 23:20    [W:9.650 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site