linux.git/mm/usercopy.c, branch v5.19

usercopy: Make usercopy resilient against ridiculously large copies

2022-06-13T16:54:52+00:00

If 'n' is so large that it's negative, we might wrap around and mistakenly
think that the copy is OK when it's not.  Such a copy would probably
crash, but just doing the arithmetic in a more simple way lets us detect
and refuse this case.

Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-4-willy@infradead.org

usercopy: Cast pointer to an integer once

2022-06-13T16:54:52+00:00

Get rid of a lot of annoying casts by setting 'addr' once at the top
of the function.

Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-3-willy@infradead.org

usercopy: Handle vm_map_ram() areas

2022-06-13T16:54:52+00:00

vmalloc does not allocate a vm_struct for vm_map_ram() areas.  That causes
us to deny usercopies from those areas.  This affects XFS which uses
vm_map_ram() for its directories.

Fix this by calling find_vmap_area() instead of find_vm_area().

Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-2-willy@infradead.org

mm: usercopy: move the virt_addr_valid() below the is_vmalloc_addr()

2022-05-16T23:02:21+00:00

The is_kmap_addr() and the is_vmalloc_addr() in the check_heap_object()
will not work, because the virt_addr_valid() will exclude the kmap and
vmalloc regions. So let's move the virt_addr_valid() below
the is_vmalloc_addr().

Signed-off-by: Yuanzheng Song 
Fixes: 4e140f59d285 ("mm/usercopy: Check kmap addresses properly")
Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
Cc: Matthew Wilcox (Oracle) 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220505071037.4121100-1-songyuanzheng@huawei.com

usercopy: Remove HARDENED_USERCOPY_PAGESPAN

2022-04-13T19:15:52+00:00

There isn't enough information to make this a useful check any more;
the useful parts of it were moved in earlier patches, so remove this
set of checks now.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Reviewed-by: David Hildenbrand 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-5-willy@infradead.org

mm/usercopy: Detect large folio overruns

2022-04-13T19:15:51+00:00

Move the compound page overrun detection out of
CONFIG_HARDENED_USERCOPY_PAGESPAN and convert it to use folios so it's
enabled for more people.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Reviewed-by: David Hildenbrand 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-4-willy@infradead.org

mm/usercopy: Detect vmalloc overruns

2022-04-13T19:15:51+00:00

If you have a vmalloc() allocation, or an address from calling vmap(),
you cannot overrun the vm_area which describes it, regardless of the
size of the underlying allocation.  This probably doesn't do much for
security because vmalloc comes with guard pages these days, but it
prevents usercopy aborts when copying to a vmap() of smaller pages.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-3-willy@infradead.org

mm/usercopy: Check kmap addresses properly

2022-04-13T19:15:50+00:00

If you are copying to an address in the kmap region, you may not copy
across a page boundary, no matter what the size of the underlying
allocation.  You can't kmap() a slab page because slab pages always
come from low memory.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-2-willy@infradead.org

Merge branch 'akpm' (patches from Andrew)

2022-03-22T23:11:53+00:00

Merge updates from Andrew Morton:

 - A few misc subsystems: kthread, scripts, ntfs, ocfs2, block, and vfs

 - Most the MM patches which precede the patches in Willy's tree: kasan,
   pagecache, gup, swap, shmem, memcg, selftests, pagemap, mremap,
   sparsemem, vmalloc, pagealloc, memory-failure, mlock, hugetlb,
   userfaultfd, vmscan, compaction, mempolicy, oom-kill, migration, thp,
   cma, autonuma, psi, ksm, page-poison, madvise, memory-hotplug, rmap,
   zswap, uaccess, ioremap, highmem, cleanups, kfence, hmm, and damon.

* emailed patches from Andrew Morton : (227 commits)
  mm/damon/sysfs: remove repeat container_of() in damon_sysfs_kdamond_release()
  Docs/ABI/testing: add DAMON sysfs interface ABI document
  Docs/admin-guide/mm/damon/usage: document DAMON sysfs interface
  selftests/damon: add a test for DAMON sysfs interface
  mm/damon/sysfs: support DAMOS stats
  mm/damon/sysfs: support DAMOS watermarks
  mm/damon/sysfs: support schemes prioritization
  mm/damon/sysfs: support DAMOS quotas
  mm/damon/sysfs: support DAMON-based Operation Schemes
  mm/damon/sysfs: support the physical address space monitoring
  mm/damon/sysfs: link DAMON for virtual address spaces monitoring
  mm/damon: implement a minimal stub for sysfs-based DAMON interface
  mm/damon/core: add number of each enum type values
  mm/damon/core: allow non-exclusive DAMON start/stop
  Docs/damon: update outdated term 'regions update interval'
  Docs/vm/damon/design: update DAMON-Idle Page Tracking interference handling
  Docs/vm/damon: call low level monitoring primitives the operations
  mm/damon: remove unnecessary CONFIG_DAMON option
  mm/damon/paddr,vaddr: remove damon_{p,v}a_{target_valid,set_operations}()
  mm/damon/dbgfs-test: fix is_target_id() change
  ...

mm/usercopy: return 1 from hardened_usercopy __setup() handler

2022-03-22T22:57:11+00:00

__setup() handlers should return 1 if the command line option is handled
and 0 if not (or maybe never return 0; it just pollutes init's
environment).  This prevents:

  Unknown kernel command line parameters \
  "BOOT_IMAGE=/boot/bzImage-517rc5 hardened_usercopy=off", will be \
  passed to user space.

  Run /sbin/init as init process
   with arguments:
     /sbin/init
   with environment:
     HOME=/
     TERM=linux
     BOOT_IMAGE=/boot/bzImage-517rc5
     hardened_usercopy=off
or
     hardened_usercopy=on
but when "hardened_usercopy=foo" is used, there is no Unknown kernel
command line parameter.

Return 1 to indicate that the boot option has been handled.
Print a warning if strtobool() returns an error on the option string,
but do not mark this as in unknown command line option and do not cause
init's environment to be polluted with this string.

Link: https://lkml.kernel.org/r/20220222034249.14795-1-rdunlap@infradead.org
Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru
Fixes: b5cb15d9372ab ("usercopy: Allow boot cmdline disabling of hardening")
Signed-off-by: Randy Dunlap 
Reported-by: Igor Zhbanov 
Acked-by: Chris von Recklinghausen 
Cc: Kees Cook 
Signed-off-by: Andrew Morton 
Signed-off-by: Linus Torvalds