• Kees Cook's avatar
    fork: Provide usercopy whitelisting for task_struct · 5905429a
    Kees Cook authored
    While the blocked and saved_sigmask fields of task_struct are copied to
    userspace (via sigmask_to_save() and setup_rt_frame()), it is always
    copied with a static length (i.e. sizeof(sigset_t)).
    
    The only portion of task_struct that is potentially dynamically sized and
    may be copied to userspace is in the architecture-specific thread_struct
    at the end of task_struct.
    
    cache object allocation:
        kernel/fork.c:
            alloc_task_struct_node(...):
                return kmem_cache_alloc_node(task_struct_cachep, ...);
    
            dup_task_struct(...):
                ...
                tsk = alloc_task_struct_node(node);
    
            copy_process(...):
                ...
                dup_task_struct(...)
    
            _do_fork(...):
                ...
                copy_process(...)
    
    example usage trace:
    
        arch/x86/kernel/fpu/signal.c:
            __fpu__restore_sig(...):
                ...
                struct task_struct *tsk = current;
                struct fpu *fpu = &tsk->thread.fpu;
                ...
                __copy_from_user(&fpu->state.xsave, ..., state_size);
    
            fpu__restore_sig(...):
                ...
                return __fpu__restore_sig(...);
    
        arch/x86/kernel/signal.c:
            restore_sigcontext(...):
                ...
                fpu__restore_sig(...)
    
    This introduces arch_thread_struct_whitelist() to let an architecture
    declare specifically where the whitelist should be within thread_struct.
    If undefined, the entire thread_struct field is left whitelisted.
    
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Nicholas Piggin <npiggin@gmail.com>
    Cc: Laura Abbott <labbott@redhat.com>
    Cc: "Mickaël Salaün" <mic@digikod.net>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Andy Lutomirski <luto@kernel.org>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Acked-by: default avatarRik van Riel <riel@redhat.com>
    5905429a
Kconfig 29.9 KB