OSDN Git Service

caif: Define usercopy region in caif proto slab cache
authorDavid Windsor <dave@nullcore.net>
Thu, 24 Aug 2017 23:58:35 +0000 (16:58 -0700)
committerKees Cook <keescook@chromium.org>
Mon, 15 Jan 2018 20:08:00 +0000 (12:08 -0800)
commit93070d339d7bc6f6b07b64faf5134fd144e8ec48
treec70a1c368470efc884a8792e253695ead745a344
parent8c2bc895a9347846b33c47124a75db624aa83677
caif: Define usercopy region in caif proto slab cache

The CAIF channel connection request parameters need to be copied to/from
userspace. In support of usercopy hardening, this patch defines a region
in the struct proto slab cache in which userspace copy operations are
allowed.

example usage trace:

    net/caif/caif_socket.c:
        setsockopt(...):
            ...
            copy_from_user(&cf_sk->conn_req.param.data, ..., ol)

This region is known as the slab cache's usercopy region. Slab caches
can now check that each dynamically sized copy operation involving
cache-managed memory falls entirely within the slab's usercopy region.

This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY
whitelisting code in the last public patch of grsecurity/PaX based on my
understanding of the code. Changes or omissions from the original code are
mine and don't reflect the original grsecurity/PaX code.

Signed-off-by: David Windsor <dave@nullcore.net>
[kees: split from network patch, provide usage trace]
Cc: "David S. Miller" <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
net/caif/caif_socket.c