• David Windsor's avatar
    caif: Define usercopy region in caif proto slab cache · 93070d33
    David Windsor authored
    The CAIF channel connection request parameters need to be copied to/from
    userspace. In support of usercopy hardening, this patch defines a region
    in the struct proto slab cache in which userspace copy operations are
    allowed.
    
    example usage trace:
    
        net/caif/caif_socket.c:
            setsockopt(...):
                ...
                copy_from_user(&cf_sk->conn_req.param.data, ..., ol)
    
    This region is known as the slab cache's usercopy region. Slab caches
    can now check that each dynamically sized copy operation involving
    cache-managed memory falls entirely within the slab's usercopy region.
    
    This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY
    whitelisting code in the last public patch of grsecurity/PaX based on my
    understanding of the code. Changes or omissions from the original code are
    mine and don't reflect the original grsecurity/PaX code.
    Signed-off-by: default avatarDavid Windsor <dave@nullcore.net>
    [kees: split from network patch, provide usage trace]
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: netdev@vger.kernel.org
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    93070d33
caif_socket.c 26.5 KB