• Kees Cook's avatar
    mm: Hardened usercopy · f5509cc1
    Kees Cook authored
    This is the start of porting PAX_USERCOPY into the mainline kernel. This
    is the first set of features, controlled by CONFIG_HARDENED_USERCOPY. The
    work is based on code by PaX Team and Brad Spengler, and an earlier port
    from Casey Schaufler. Additional non-slab page tests are from Rik van Riel.
    
    This patch contains the logic for validating several conditions when
    performing copy_to_user() and copy_from_user() on the kernel object
    being copied to/from:
    - address range doesn't wrap around
    - address range isn't NULL or zero-allocated (with a non-zero copy size)
    - if on the slab allocator:
      - object size must be less than or equal to copy size (when check is
        implemented in the allocator, which appear in subsequent patches)
    - otherwise, object must not span page allocations (excepting Reserved
      and CMA ranges)
    - if on the stack
      - object must not extend before/after the current process stack
      - object must be contained by a valid stack frame (when there is
        arch/build support for identifying stack frames)
    - object must not overlap with kernel text
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Tested-by: default avatarValdis Kletnieks <valdis.kletnieks@vt.edu>
    Tested-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    f5509cc1
Makefile 3.55 KB