617aebe6a9
cache objects. This is good, but still leaves a lot of kernel memory available to be copied to/from userspace in the face of bugs. To further restrict what memory is available for copying, this creates a way to whitelist specific areas of a given slab cache object for copying to/from userspace, allowing much finer granularity of access control. Slab caches that are never exposed to userspace can declare no whitelist for their objects, thereby keeping them unavailable to userspace via dynamic copy operations. (Note, an implicit form of whitelisting is the use of constant sizes in usercopy operations and get_user()/put_user(); these bypass all hardened usercopy checks since these sizes cannot change at runtime.) This new check is WARN-by-default, so any mistakes can be found over the next several releases without breaking anyone's system. The series has roughly the following sections: - remove %p and improve reporting with offset - prepare infrastructure and whitelist kmalloc - update VFS subsystem with whitelists - update SCSI subsystem with whitelists - update network subsystem with whitelists - update process memory with whitelists - update per-architecture thread_struct with whitelists - update KVM with whitelists and fix ioctl bug - mark all other allocations as not whitelisted - update lkdtm for more sensible test overage -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 Comment: Kees Cook <kees@outflux.net> iQIcBAABCgAGBQJabvleAAoJEIly9N/cbcAmO1kQAJnjVPutnLSbnUteZxtsv7W4 43Cggvokfxr6l08Yh3hUowNxZVKjhF9uwMVgRRg9Nl5WdYCN+vCQbHz+ZdzGJXKq cGqdKWgexMKX+aBdNDrK7BphUeD46sH7JWR+a/lDV/BgPxBCm9i5ZZCgXbPP89AZ NpLBji7gz49wMsnm/x135xtNlZ3dG0oKETzi7MiR+NtKtUGvoIszSKy5JdPZ4m8q 9fnXmHqmwM6uQFuzDJPt1o+D1fusTuYnjI7EgyrJRRhQ+BB3qEFZApXnKNDRS9Dm uB7jtcwefJCjlZVCf2+PWTOEifH2WFZXLPFlC8f44jK6iRW2Nc+wVRisJ3vSNBG1 gaRUe/FSge68eyfQj5OFiwM/2099MNkKdZ0fSOjEBeubQpiFChjgWgcOXa5Bhlrr C4CIhFV2qg/tOuHDAF+Q5S96oZkaTy5qcEEwhBSW15ySDUaRWFSrtboNt6ZVOhug d8JJvDCQWoNu1IQozcbv6xW/Rk7miy8c0INZ4q33YUvIZpH862+vgDWfTJ73Zy9H jR/8eG6t3kFHKS1vWdKZzOX1bEcnd02CGElFnFYUEewKoV7ZeeLsYX7zodyUAKyi Yp5CImsDbWWTsptBg6h9nt2TseXTxYCt2bbmpJcqzsqSCUwOQNQ4/YpuzLeG0ihc JgOmUnQNJWCTwUUw5AS1 =tzmJ -----END PGP SIGNATURE----- Merge tag 'usercopy-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardened usercopy whitelisting from Kees Cook: "Currently, hardened usercopy performs dynamic bounds checking on slab cache objects. This is good, but still leaves a lot of kernel memory available to be copied to/from userspace in the face of bugs. To further restrict what memory is available for copying, this creates a way to whitelist specific areas of a given slab cache object for copying to/from userspace, allowing much finer granularity of access control. Slab caches that are never exposed to userspace can declare no whitelist for their objects, thereby keeping them unavailable to userspace via dynamic copy operations. (Note, an implicit form of whitelisting is the use of constant sizes in usercopy operations and get_user()/put_user(); these bypass all hardened usercopy checks since these sizes cannot change at runtime.) This new check is WARN-by-default, so any mistakes can be found over the next several releases without breaking anyone's system. The series has roughly the following sections: - remove %p and improve reporting with offset - prepare infrastructure and whitelist kmalloc - update VFS subsystem with whitelists - update SCSI subsystem with whitelists - update network subsystem with whitelists - update process memory with whitelists - update per-architecture thread_struct with whitelists - update KVM with whitelists and fix ioctl bug - mark all other allocations as not whitelisted - update lkdtm for more sensible test overage" * tag 'usercopy-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (38 commits) lkdtm: Update usercopy tests for whitelisting usercopy: Restrict non-usercopy caches to size 0 kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl kvm: whitelist struct kvm_vcpu_arch arm: Implement thread_struct whitelist for hardened usercopy arm64: Implement thread_struct whitelist for hardened usercopy x86: Implement thread_struct whitelist for hardened usercopy fork: Provide usercopy whitelisting for task_struct fork: Define usercopy region in thread_stack slab caches fork: Define usercopy region in mm_struct slab caches net: Restrict unwhitelisted proto caches to size 0 sctp: Copy struct sctp_sock.autoclose to userspace using put_user() sctp: Define usercopy region in SCTP proto slab cache caif: Define usercopy region in caif proto slab cache ip: Define usercopy region in IP proto slab cache net: Define usercopy region in struct proto slab cache scsi: Define usercopy region in scsi_sense_cache slab cache cifs: Define usercopy region in cifs_request slab cache vxfs: Define usercopy region in vxfs_inode slab cache ufs: Define usercopy region in ufs_inode_cache slab cache ...
237 lines
6.0 KiB
C
237 lines
6.0 KiB
C
/*
|
|
* Based on arch/arm/include/asm/processor.h
|
|
*
|
|
* Copyright (C) 1995-1999 Russell King
|
|
* Copyright (C) 2012 ARM Ltd.
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
#ifndef __ASM_PROCESSOR_H
|
|
#define __ASM_PROCESSOR_H
|
|
|
|
#define TASK_SIZE_64 (UL(1) << VA_BITS)
|
|
|
|
#ifndef __ASSEMBLY__
|
|
|
|
/*
|
|
* Default implementation of macro that returns current
|
|
* instruction pointer ("program counter").
|
|
*/
|
|
#define current_text_addr() ({ __label__ _l; _l: &&_l;})
|
|
|
|
#ifdef __KERNEL__
|
|
|
|
#include <linux/string.h>
|
|
|
|
#include <asm/alternative.h>
|
|
#include <asm/fpsimd.h>
|
|
#include <asm/hw_breakpoint.h>
|
|
#include <asm/lse.h>
|
|
#include <asm/pgtable-hwdef.h>
|
|
#include <asm/ptrace.h>
|
|
#include <asm/types.h>
|
|
|
|
/*
|
|
* TASK_SIZE - the maximum size of a user space task.
|
|
* TASK_UNMAPPED_BASE - the lower boundary of the mmap VM area.
|
|
*/
|
|
#ifdef CONFIG_COMPAT
|
|
#define TASK_SIZE_32 UL(0x100000000)
|
|
#define TASK_SIZE (test_thread_flag(TIF_32BIT) ? \
|
|
TASK_SIZE_32 : TASK_SIZE_64)
|
|
#define TASK_SIZE_OF(tsk) (test_tsk_thread_flag(tsk, TIF_32BIT) ? \
|
|
TASK_SIZE_32 : TASK_SIZE_64)
|
|
#else
|
|
#define TASK_SIZE TASK_SIZE_64
|
|
#endif /* CONFIG_COMPAT */
|
|
|
|
#define TASK_UNMAPPED_BASE (PAGE_ALIGN(TASK_SIZE / 4))
|
|
|
|
#define STACK_TOP_MAX TASK_SIZE_64
|
|
#ifdef CONFIG_COMPAT
|
|
#define AARCH32_VECTORS_BASE 0xffff0000
|
|
#define STACK_TOP (test_thread_flag(TIF_32BIT) ? \
|
|
AARCH32_VECTORS_BASE : STACK_TOP_MAX)
|
|
#else
|
|
#define STACK_TOP STACK_TOP_MAX
|
|
#endif /* CONFIG_COMPAT */
|
|
|
|
extern phys_addr_t arm64_dma_phys_limit;
|
|
#define ARCH_LOW_ADDRESS_LIMIT (arm64_dma_phys_limit - 1)
|
|
|
|
struct debug_info {
|
|
#ifdef CONFIG_HAVE_HW_BREAKPOINT
|
|
/* Have we suspended stepping by a debugger? */
|
|
int suspended_step;
|
|
/* Allow breakpoints and watchpoints to be disabled for this thread. */
|
|
int bps_disabled;
|
|
int wps_disabled;
|
|
/* Hardware breakpoints pinned to this task. */
|
|
struct perf_event *hbp_break[ARM_MAX_BRP];
|
|
struct perf_event *hbp_watch[ARM_MAX_WRP];
|
|
#endif
|
|
};
|
|
|
|
struct cpu_context {
|
|
unsigned long x19;
|
|
unsigned long x20;
|
|
unsigned long x21;
|
|
unsigned long x22;
|
|
unsigned long x23;
|
|
unsigned long x24;
|
|
unsigned long x25;
|
|
unsigned long x26;
|
|
unsigned long x27;
|
|
unsigned long x28;
|
|
unsigned long fp;
|
|
unsigned long sp;
|
|
unsigned long pc;
|
|
};
|
|
|
|
struct thread_struct {
|
|
struct cpu_context cpu_context; /* cpu context */
|
|
unsigned long tp_value; /* TLS register */
|
|
#ifdef CONFIG_COMPAT
|
|
unsigned long tp2_value;
|
|
#endif
|
|
struct fpsimd_state fpsimd_state;
|
|
void *sve_state; /* SVE registers, if any */
|
|
unsigned int sve_vl; /* SVE vector length */
|
|
unsigned int sve_vl_onexec; /* SVE vl after next exec */
|
|
unsigned long fault_address; /* fault info */
|
|
unsigned long fault_code; /* ESR_EL1 value */
|
|
struct debug_info debug; /* debugging */
|
|
};
|
|
|
|
/*
|
|
* Everything usercopied to/from thread_struct is statically-sized, so
|
|
* no hardened usercopy whitelist is needed.
|
|
*/
|
|
static inline void arch_thread_struct_whitelist(unsigned long *offset,
|
|
unsigned long *size)
|
|
{
|
|
*offset = *size = 0;
|
|
}
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
#define task_user_tls(t) \
|
|
({ \
|
|
unsigned long *__tls; \
|
|
if (is_compat_thread(task_thread_info(t))) \
|
|
__tls = &(t)->thread.tp2_value; \
|
|
else \
|
|
__tls = &(t)->thread.tp_value; \
|
|
__tls; \
|
|
})
|
|
#else
|
|
#define task_user_tls(t) (&(t)->thread.tp_value)
|
|
#endif
|
|
|
|
/* Sync TPIDR_EL0 back to thread_struct for current */
|
|
void tls_preserve_current_state(void);
|
|
|
|
#define INIT_THREAD { }
|
|
|
|
static inline void start_thread_common(struct pt_regs *regs, unsigned long pc)
|
|
{
|
|
memset(regs, 0, sizeof(*regs));
|
|
forget_syscall(regs);
|
|
regs->pc = pc;
|
|
}
|
|
|
|
static inline void start_thread(struct pt_regs *regs, unsigned long pc,
|
|
unsigned long sp)
|
|
{
|
|
start_thread_common(regs, pc);
|
|
regs->pstate = PSR_MODE_EL0t;
|
|
regs->sp = sp;
|
|
}
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
static inline void compat_start_thread(struct pt_regs *regs, unsigned long pc,
|
|
unsigned long sp)
|
|
{
|
|
start_thread_common(regs, pc);
|
|
regs->pstate = COMPAT_PSR_MODE_USR;
|
|
if (pc & 1)
|
|
regs->pstate |= COMPAT_PSR_T_BIT;
|
|
|
|
#ifdef __AARCH64EB__
|
|
regs->pstate |= COMPAT_PSR_E_BIT;
|
|
#endif
|
|
|
|
regs->compat_sp = sp;
|
|
}
|
|
#endif
|
|
|
|
/* Forward declaration, a strange C thing */
|
|
struct task_struct;
|
|
|
|
/* Free all resources held by a thread. */
|
|
extern void release_thread(struct task_struct *);
|
|
|
|
unsigned long get_wchan(struct task_struct *p);
|
|
|
|
static inline void cpu_relax(void)
|
|
{
|
|
asm volatile("yield" ::: "memory");
|
|
}
|
|
|
|
/* Thread switching */
|
|
extern struct task_struct *cpu_switch_to(struct task_struct *prev,
|
|
struct task_struct *next);
|
|
|
|
#define task_pt_regs(p) \
|
|
((struct pt_regs *)(THREAD_SIZE + task_stack_page(p)) - 1)
|
|
|
|
#define KSTK_EIP(tsk) ((unsigned long)task_pt_regs(tsk)->pc)
|
|
#define KSTK_ESP(tsk) user_stack_pointer(task_pt_regs(tsk))
|
|
|
|
/*
|
|
* Prefetching support
|
|
*/
|
|
#define ARCH_HAS_PREFETCH
|
|
static inline void prefetch(const void *ptr)
|
|
{
|
|
asm volatile("prfm pldl1keep, %a0\n" : : "p" (ptr));
|
|
}
|
|
|
|
#define ARCH_HAS_PREFETCHW
|
|
static inline void prefetchw(const void *ptr)
|
|
{
|
|
asm volatile("prfm pstl1keep, %a0\n" : : "p" (ptr));
|
|
}
|
|
|
|
#define ARCH_HAS_SPINLOCK_PREFETCH
|
|
static inline void spin_lock_prefetch(const void *ptr)
|
|
{
|
|
asm volatile(ARM64_LSE_ATOMIC_INSN(
|
|
"prfm pstl1strm, %a0",
|
|
"nop") : : "p" (ptr));
|
|
}
|
|
|
|
#define HAVE_ARCH_PICK_MMAP_LAYOUT
|
|
|
|
#endif
|
|
|
|
int cpu_enable_pan(void *__unused);
|
|
int cpu_enable_cache_maint_trap(void *__unused);
|
|
int cpu_clear_disr(void *__unused);
|
|
|
|
/* Userspace interface for PR_SVE_{SET,GET}_VL prctl()s: */
|
|
#define SVE_SET_VL(arg) sve_set_current_vl(arg)
|
|
#define SVE_GET_VL() sve_get_current_vl()
|
|
|
|
#endif /* __ASSEMBLY__ */
|
|
#endif /* __ASM_PROCESSOR_H */
|