Linus Torvalds 617aebe6a9 Currently, hardened usercopy performs dynamic bounds checking on slab ... cache objects. This is good, but still leaves a lot of kernel memory available to be copied to/from userspace in the face of bugs. To further restrict what memory is available for copying, this creates a way to whitelist specific areas of a given slab cache object for copying to/from userspace, allowing much finer granularity of access control. Slab caches that are never exposed to userspace can declare no whitelist for their objects, thereby keeping them unavailable to userspace via dynamic copy operations. (Note, an implicit form of whitelisting is the use of constant sizes in usercopy operations and get_user()/put_user(); these bypass all hardened usercopy checks since these sizes cannot change at runtime.) This new check is WARN-by-default, so any mistakes can be found over the next several releases without breaking anyone's system. The series has roughly the following sections: - remove %p and improve reporting with offset - prepare infrastructure and whitelist kmalloc - update VFS subsystem with whitelists - update SCSI subsystem with whitelists - update network subsystem with whitelists - update process memory with whitelists - update per-architecture thread_struct with whitelists - update KVM with whitelists and fix ioctl bug - mark all other allocations as not whitelisted - update lkdtm for more sensible test overage -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Kees Cook <kees@outflux.net> iQIcBAABCgAGBQJabvleAAoJEIly9N/cbcAmO1kQAJnjVPutnLSbnUteZxtsv7W4 43Cggvokfxr6l08Yh3hUowNxZVKjhF9uwMVgRRg9Nl5WdYCN+vCQbHz+ZdzGJXKq cGqdKWgexMKX+aBdNDrK7BphUeD46sH7JWR+a/lDV/BgPxBCm9i5ZZCgXbPP89AZ NpLBji7gz49wMsnm/x135xtNlZ3dG0oKETzi7MiR+NtKtUGvoIszSKy5JdPZ4m8q 9fnXmHqmwM6uQFuzDJPt1o+D1fusTuYnjI7EgyrJRRhQ+BB3qEFZApXnKNDRS9Dm uB7jtcwefJCjlZVCf2+PWTOEifH2WFZXLPFlC8f44jK6iRW2Nc+wVRisJ3vSNBG1 gaRUe/FSge68eyfQj5OFiwM/2099MNkKdZ0fSOjEBeubQpiFChjgWgcOXa5Bhlrr C4CIhFV2qg/tOuHDAF+Q5S96oZkaTy5qcEEwhBSW15ySDUaRWFSrtboNt6ZVOhug d8JJvDCQWoNu1IQozcbv6xW/Rk7miy8c0INZ4q33YUvIZpH862+vgDWfTJ73Zy9H jR/8eG6t3kFHKS1vWdKZzOX1bEcnd02CGElFnFYUEewKoV7ZeeLsYX7zodyUAKyi Yp5CImsDbWWTsptBg6h9nt2TseXTxYCt2bbmpJcqzsqSCUwOQNQ4/YpuzLeG0ihc JgOmUnQNJWCTwUUw5AS1 =tzmJ -----END PGP SIGNATURE----- Merge tag 'usercopy-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardened usercopy whitelisting from Kees Cook: "Currently, hardened usercopy performs dynamic bounds checking on slab cache objects. This is good, but still leaves a lot of kernel memory available to be copied to/from userspace in the face of bugs. To further restrict what memory is available for copying, this creates a way to whitelist specific areas of a given slab cache object for copying to/from userspace, allowing much finer granularity of access control. Slab caches that are never exposed to userspace can declare no whitelist for their objects, thereby keeping them unavailable to userspace via dynamic copy operations. (Note, an implicit form of whitelisting is the use of constant sizes in usercopy operations and get_user()/put_user(); these bypass all hardened usercopy checks since these sizes cannot change at runtime.) This new check is WARN-by-default, so any mistakes can be found over the next several releases without breaking anyone's system. The series has roughly the following sections: - remove %p and improve reporting with offset - prepare infrastructure and whitelist kmalloc - update VFS subsystem with whitelists - update SCSI subsystem with whitelists - update network subsystem with whitelists - update process memory with whitelists - update per-architecture thread_struct with whitelists - update KVM with whitelists and fix ioctl bug - mark all other allocations as not whitelisted - update lkdtm for more sensible test overage" * tag 'usercopy-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (38 commits) lkdtm: Update usercopy tests for whitelisting usercopy: Restrict non-usercopy caches to size 0 kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl kvm: whitelist struct kvm_vcpu_arch arm: Implement thread_struct whitelist for hardened usercopy arm64: Implement thread_struct whitelist for hardened usercopy x86: Implement thread_struct whitelist for hardened usercopy fork: Provide usercopy whitelisting for task_struct fork: Define usercopy region in thread_stack slab caches fork: Define usercopy region in mm_struct slab caches net: Restrict unwhitelisted proto caches to size 0 sctp: Copy struct sctp_sock.autoclose to userspace using put_user() sctp: Define usercopy region in SCTP proto slab cache caif: Define usercopy region in caif proto slab cache ip: Define usercopy region in IP proto slab cache net: Define usercopy region in struct proto slab cache scsi: Define usercopy region in scsi_sense_cache slab cache cifs: Define usercopy region in cifs_request slab cache vxfs: Define usercopy region in vxfs_inode slab cache ufs: Define usercopy region in ufs_inode_cache slab cache ...		2018-02-03 16:25:42 -08:00
..
alpha	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mattst88/alpha	2018-02-02 13:46:21 -08:00
arc	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
arm	Currently, hardened usercopy performs dynamic bounds checking on slab	2018-02-03 16:25:42 -08:00
arm64	Currently, hardened usercopy performs dynamic bounds checking on slab	2018-02-03 16:25:42 -08:00
blackfin	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
c6x	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
cris	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
frv	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
h8300	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
hexagon	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
ia64	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
m32r	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
m68k	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
metag	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
microblaze	Microblaze patches for 4.16-rc1	2018-02-02 09:48:36 -08:00
mips	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
mn10300	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
nios2	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
openrisc	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
parisc	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
powerpc	powerpc updates for 4.16	2018-02-02 10:01:04 -08:00
riscv	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
s390	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
score	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
sh	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
sparc	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
tile	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
um	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
unicore32	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
x86	Currently, hardened usercopy performs dynamic bounds checking on slab	2018-02-03 16:25:42 -08:00
xtensa	The core framework has a handful of patches this time around, mostly due	2018-02-01 16:56:07 -08:00
.gitignore
Kconfig	Currently, hardened usercopy performs dynamic bounds checking on slab	2018-02-03 16:25:42 -08:00