Kees Cook f5509cc18d mm: Hardened usercopy ... This is the start of porting PAX_USERCOPY into the mainline kernel. This is the first set of features, controlled by CONFIG_HARDENED_USERCOPY. The work is based on code by PaX Team and Brad Spengler, and an earlier port from Casey Schaufler. Additional non-slab page tests are from Rik van Riel. This patch contains the logic for validating several conditions when performing copy_to_user() and copy_from_user() on the kernel object being copied to/from: - address range doesn't wrap around - address range isn't NULL or zero-allocated (with a non-zero copy size) - if on the slab allocator: - object size must be less than or equal to copy size (when check is implemented in the allocator, which appear in subsequent patches) - otherwise, object must not span page allocations (excepting Reserved and CMA ranges) - if on the stack - object must not extend before/after the current process stack - object must be contained by a valid stack frame (when there is arch/build support for identifying stack frames) - object must not overlap with kernel text Signed-off-by: Kees Cook <keescook@chromium.org> Tested-by: Valdis Kletnieks <valdis.kletnieks@vt.edu> Tested-by: Michael Ellerman <mpe@ellerman.id.au>		2016-07-26 14:41:47 -07:00
..
kasan	kasan/quarantine: fix bugs on qlist_move_cache()	2016-07-15 14:54:27 +09:00
backing-dev.c	mm: throttle on IO only when there are too many dirty and writeback pages	2016-05-20 17:58:30 -07:00
balloon_compaction.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2016-03-17 21:38:27 -07:00
bootmem.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
cleancache.c	cleancache: constify cleancache_ops structure	2016-01-27 09:09:57 -05:00
cma_debug.c
cma.c	mm/cma: silence warnings due to max() usage	2016-05-27 14:49:37 -07:00
cma.h
compaction.c	mm, compaction: prevent VM_BUG_ON when terminating freeing scanner	2016-07-15 14:54:27 +09:00
debug_page_ref.c	mm/page_ref: add tracepoint to track down page reference manipulation	2016-03-17 15:09:34 -07:00
debug.c	mm: introduce page reference manipulation functions	2016-03-17 15:09:34 -07:00
dmapool.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
early_ioremap.c
fadvise.c	mm/fadvise.c: do not discard partial pages with POSIX_FADV_DONTNEED	2016-06-09 14:23:11 -07:00
failslab.c	mm: fault-inject take over bootstrap kmem_cache check	2016-03-15 16:55:16 -07:00
filemap.c	Revert "mm: make faultaround produce old ptes"	2016-06-24 17:23:52 -07:00
frame_vector.c	mm/gup: Switch all callers of get_user_pages() to not pass tsk/mm	2016-02-16 10:11:12 +01:00
frontswap.c
gup.c	Merge branch 'mm-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-04-14 19:31:34 -07:00
highmem.c	mm/highmem: make nr_free_highpages() handles all highmem zones by itself	2016-05-19 19:12:14 -07:00
huge_memory.c	mm: thp: move pmd check inside ptl for freeze_page()	2016-07-15 14:54:27 +09:00
hugetlb_cgroup.c	mm, hugetlb_cgroup: round limit_in_bytes down to hugepage size	2016-05-20 17:58:30 -07:00
hugetlb.c	mm: thp: refix false positive BUG in page_move_anon_rmap()	2016-07-15 14:54:27 +09:00
hwpoison-inject.c
init-mm.c
internal.h	mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask	2016-06-24 17:23:52 -07:00
interval_tree.c
Kconfig	mm: disable DEFERRED_STRUCT_PAGE_INIT on !NO_BOOTMEM	2016-05-27 14:49:37 -07:00
Kconfig.debug	mm/page_ref: add tracepoint to track down page reference manipulation	2016-03-17 15:09:34 -07:00
kmemcheck.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
kmemleak-test.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
kmemleak.c	mm: prevent KASAN false positives in kmemleak	2016-06-24 17:23:52 -07:00
ksm.c	ksm: fix conflict between mmput and scan_get_next_rmap_item	2016-05-12 15:52:50 -07:00
list_lru.c	mm: memcontrol: move kmem accounting code to CONFIG_MEMCG	2016-01-20 17:09:18 -08:00
maccess.c	x86: remove more uaccess_32.h complexity	2016-05-22 17:21:27 -07:00
madvise.c	mm: make mmap_sem for write waits killable for mm syscalls	2016-05-23 17:04:14 -07:00
Makefile	mm: Hardened usercopy	2016-07-26 14:41:47 -07:00
memblock.c	mm/memblock.c: remove unnecessary always-true comparison	2016-05-20 17:58:30 -07:00
memcontrol.c	mm: memcontrol: fix cgroup creation failure after many small jobs	2016-07-23 10:25:54 +09:00
memory_hotplug.c	mm: fix section mismatch warning	2016-05-27 15:23:32 -07:00
memory-failure.c	mm/memory-failure.c: replace "MCE" with "Memory failure"	2016-05-20 17:58:30 -07:00
memory.c	mm: thp: refix false positive BUG in page_move_anon_rmap()	2016-07-15 14:54:27 +09:00
mempolicy.c	mm, page_alloc: avoid looking up the first zone in a zonelist twice	2016-05-19 19:12:14 -07:00
mempool.c	mm: mempool: kasan: don't poot mempool objects in quarantine	2016-06-24 17:23:52 -07:00
memtest.c
migrate.c	mm: Export migrate_page_move_mapping and migrate_page_copy	2016-06-23 00:29:45 +02:00
mincore.c	mm, fs: remove remaining PAGE_CACHE_* and page_cache_{get,release} usage	2016-04-04 10:41:08 -07:00
mlock.c	mm: make mmap_sem for write waits killable for mm syscalls	2016-05-23 17:04:14 -07:00
mm_init.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
mmap.c	mm: remove more IS_ERR_VALUE abuses	2016-05-27 15:57:31 -07:00
mmu_context.c	mm/mmu_context, sched/core: Fix mmu_context.h assumption	2016-04-28 11:44:19 +02:00
mmu_notifier.c	fix Christoph's email addresses	2016-03-17 15:09:34 -07:00
mmzone.c	mm, page_alloc: inline the fast path of the zonelist iterator	2016-05-19 19:12:14 -07:00
mprotect.c	mm: make mmap_sem for write waits killable for mm syscalls	2016-05-23 17:04:14 -07:00
mremap.c	mm: make mmap_sem for write waits killable for mm syscalls	2016-05-23 17:04:14 -07:00
msync.c
nobootmem.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
nommu.c	mm: remove more IS_ERR_VALUE abuses	2016-05-27 15:57:31 -07:00
oom_kill.c	oom_reaper: avoid pointless atomic_inc_not_zero usage.	2016-06-24 17:23:52 -07:00
page_alloc.c	mm, meminit: ensure node is online before checking whether pages are uninitialised	2016-07-15 14:54:27 +09:00
page_counter.c
page_ext.c	mm: use early_pfn_to_nid in page_ext_init	2016-05-27 14:49:37 -07:00
page_idle.c	mm: add page_check_address_transhuge() helper	2016-01-15 17:56:32 -08:00
page_io.c	Merge branch 'work.preadv2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2016-05-17 15:05:23 -07:00
page_isolation.c	mm/memory_hotplug: add comment to some functions related to memory hotplug	2016-05-19 19:12:14 -07:00
page_owner.c	mm/page_owner: avoid null pointer dereference	2016-06-24 17:23:52 -07:00
page_poison.c	mm: check the return value of lookup_page_ext for all call sites	2016-06-03 15:06:22 -07:00
page-writeback.c	writeback: use higher precision calculation in domain_dirty_limits()	2016-05-30 08:54:40 -06:00
pagewalk.c	thp: rename split_huge_page_pmd() to split_huge_pmd()	2016-01-15 17:56:32 -08:00
percpu-km.c	mm: percpu: use pr_fmt to prefix output	2016-03-17 15:09:34 -07:00
percpu-vm.c
percpu.c	percpu: fix synchronization between synchronous map extension and chunk destruction	2016-05-25 11:48:25 -04:00
pgtable-generic.c	mm/thp/migration: switch from flush_tlb_range to flush_pmd_tlb_range	2016-03-17 15:09:34 -07:00
process_vm_access.c	mm/gup: Introduce get_user_pages_remote()	2016-02-16 10:04:09 +01:00
quicklist.c	fix Christoph's email addresses	2016-03-17 15:09:34 -07:00
readahead.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
rmap.c	mm: thp: refix false positive BUG in page_move_anon_rmap()	2016-07-15 14:54:27 +09:00
shmem.c	tmpfs: fix regression hang in fallocate undo	2016-07-10 20:08:44 -07:00
slab_common.c	mm: memcontrol: fix cgroup creation failure after many small jobs	2016-07-23 10:25:54 +09:00
slab.c	mm, kasan: don't call kasan_krealloc() from ksize().	2016-05-20 17:58:30 -07:00
slab.h	mm: kasan: initial memory quarantine implementation	2016-05-20 17:58:30 -07:00
slob.c	mm: slab: free kmem_cache_node after destroy sysfs file	2016-02-18 16:23:24 -08:00
slub.c	mm, kasan: don't call kasan_krealloc() from ksize().	2016-05-20 17:58:30 -07:00
sparse-vmemmap.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
sparse.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
swap_cgroup.c	mm: convert printk(KERN_<LEVEL> to pr_<level>	2016-03-17 15:09:34 -07:00
swap_state.c	mm: thp: broken page count after commit aa88b68c3b	2016-06-09 14:23:11 -07:00
swap.c	mm/swap.c: flush lru pvecs on compound page arrival	2016-06-24 17:23:52 -07:00
swapfile.c	mm: thp: calculate the mapcount correctly for THP pages during WP faults	2016-05-12 15:52:50 -07:00
truncate.c	dax: New fault locking	2016-05-19 15:20:54 -06:00
usercopy.c	mm: Hardened usercopy	2016-07-26 14:41:47 -07:00
userfaultfd.c	mm, fs: get rid of PAGE_CACHE_* and page_cache_{get,release} macros	2016-04-04 10:41:08 -07:00
util.c	mm: make vm_mmap killable	2016-05-23 17:04:14 -07:00
vmacache.c
vmalloc.c	mm: fix overflow in vm_map_ram()	2016-06-03 15:06:22 -07:00
vmpressure.c	mm/vmpressure.c: fix subtree pressure detection	2016-02-03 08:28:43 -08:00
vmscan.c	mm, oom: rework oom detection	2016-05-20 17:58:30 -07:00
vmstat.c	mm: check the return value of lookup_page_ext for all call sites	2016-06-03 15:06:22 -07:00
workingset.c	mm: workingset: printk missing log level, use pr_info()	2016-07-15 14:54:27 +09:00
z3fold.c	mm/z3fold.c: avoid modifying HEADLESS page and minor cleanup	2016-06-03 16:02:55 -07:00
zbud.c	mm/zbud.c: use list_last_entry() instead of list_tail_entry()	2016-01-15 11:40:52 -08:00
zpool.c	mm: zsmalloc: constify struct zs_pool name	2015-11-06 17:50:42 -08:00
zsmalloc.c	update "mm/zsmalloc: don't fail if can't create debugfs info"	2016-05-26 15:35:44 -07:00
zswap.c	mm/zswap: use workqueue to destroy pool	2016-05-20 17:58:30 -07:00