Commit 2792d84e authored by Kees Cook's avatar Kees Cook
Browse files

usercopy: Check valid lifetime via stack depth 

One of the things that CONFIG_HARDENED_USERCOPY sanity-checks is whether
an object that is about to be copied to/from userspace is overlapping
the stack at all. If it is, it performs a number of inexpensive
bounds checks. One of the finer-grained checks is whether an object
crosses stack frames within the stack region. Doing this on x86 with
CONFIG_FRAME_POINTER was cheap/easy. Doing it with ORC was deemed too
heavy, and was left out (a while ago), leaving the courser whole-stack
check.

The LKDTM tests USERCOPY_STACK_FRAME_TO and USERCOPY_STACK_FRAME_FROM
try to exercise these cross-frame cases to validate the defense is
working. They have been failing ever since ORC was added (which was
expected). While Muhammad was investigating various LKDTM failures[1],
he asked me for additional details on them, and I realized that when
exact stack frame boundary checking is not available (i.e. everything
except x86 with FRAME_POINTER), it could check if a stack object is at
least "current depth valid", in the sense that any object within the
stack region but not between start-of-stack and current_stack_pointer
should be considered unavailable (i.e. its lifetime is from a call no
longer present on the stack).

Introduce ARCH_HAS_CURRENT_STACK_POINTER to track which architectures
have actually implemented the common global register alias.

Additionally report usercopy bounds checking failures with an offset
from current_stack_pointer, which may assist with diagnosing failures.

The LKDTM USERCOPY_STACK_FRAME_TO and USERCOPY_STACK_FRAME_FROM tests
(once slightly adjusted in a separate patch) pass again with this fixed.

[1] https://github.com/kernelci/kernelci-project/issues/84



Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: linux-mm@kvack.org
Reported-by: default avatarMuhammad Usama Anjum <usama.anjum@collabora.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
---
v1: https://lore.kernel.org/lkml/20220216201449.2087956-1-keescook@chromium.org
v2: https://lore.kernel.org/lkml/20220224060342.1855457-1-keescook@chromium.org
v3: https://lore.kernel.org/lkml/20220225173345.3358109-1-keescook@chromium.org
v4: - improve commit log (akpm)
parent efa90c11

arch/arm/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -5,6 +5,7 @@ config ARM 
	select ARCH_32BIT_OFF_T

	select ARCH_CORRECT_STACKTRACE_ON_KRETPROBE if HAVE_KRETPROBES && FRAME_POINTER && !ARM_UNWIND

	select ARCH_HAS_BINFMT_FLAT

	select ARCH_HAS_CURRENT_STACK_POINTER

	select ARCH_HAS_DEBUG_VIRTUAL if MMU

	select ARCH_HAS_DMA_WRITE_COMBINE if !ARM_DMA_MEM_BUFFERABLE

	select ARCH_HAS_ELF_RANDOMIZE

arch/arm64/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ config ARM64 
	select ARCH_ENABLE_SPLIT_PMD_PTLOCK if PGTABLE_LEVELS > 2

	select ARCH_ENABLE_THP_MIGRATION if TRANSPARENT_HUGEPAGE

	select ARCH_HAS_CACHE_LINE_SIZE

	select ARCH_HAS_CURRENT_STACK_POINTER

	select ARCH_HAS_DEBUG_VIRTUAL

	select ARCH_HAS_DEBUG_VM_PGTABLE

	select ARCH_HAS_DMA_PREP_COHERENT

arch/powerpc/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -108,6 +108,7 @@ config PPC 
	select ARCH_ENABLE_MEMORY_HOTPLUG

	select ARCH_ENABLE_MEMORY_HOTREMOVE

	select ARCH_HAS_COPY_MC			if PPC64

	select ARCH_HAS_CURRENT_STACK_POINTER

	select ARCH_HAS_DEBUG_VIRTUAL

	select ARCH_HAS_DEBUG_VM_PGTABLE

	select ARCH_HAS_DEBUG_WX		if STRICT_KERNEL_RWX

arch/s390/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -60,6 +60,7 @@ config S390 
	select ARCH_ENABLE_MEMORY_HOTPLUG if SPARSEMEM

	select ARCH_ENABLE_MEMORY_HOTREMOVE

	select ARCH_ENABLE_SPLIT_PMD_PTLOCK if PGTABLE_LEVELS > 2

	select ARCH_HAS_CURRENT_STACK_POINTER

	select ARCH_HAS_DEBUG_VM_PGTABLE

	select ARCH_HAS_DEBUG_WX

	select ARCH_HAS_DEVMEM_IS_ALLOWED

arch/sh/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -7,6 +7,7 @@ config SUPERH 
	select ARCH_HAVE_CUSTOM_GPIO_H

	select ARCH_HAVE_NMI_SAFE_CMPXCHG if (GUSA_RB || CPU_SH4A)

	select ARCH_HAS_BINFMT_FLAT if !MMU

	select ARCH_HAS_CURRENT_STACK_POINTER

	select ARCH_HAS_GIGANTIC_PAGE

	select ARCH_HAS_GCOV_PROFILE_ALL

	select ARCH_HAS_PTE_SPECIAL