linux.git/mm/usercopy.c, branch v6.12.80

mm: Fix copy_from_user_nofault().

2023-04-13T00:36:23+00:00

There are several issues with copy_from_user_nofault():

- access_ok() is designed for user context only and for that reason
it has WARN_ON_IN_IRQ() which triggers when bpf, kprobe, eprobe
and perf on ppc are calling it from irq.

- it's missing nmi_uaccess_okay() which is a nop on all architectures
except x86 where it's required.
The comment in arch/x86/mm/tlb.c explains the details why it's necessary.
Calling copy_from_user_nofault() from bpf, [ke]probe without this check is not safe.

- __copy_from_user_inatomic() under CONFIG_HARDENED_USERCOPY is calling
check_object_size()->__check_object_size()->check_heap_object()->find_vmap_area()->spin_lock()
which is not safe to do from bpf, [ke]probe and perf due to potential deadlock.

Fix all three issues. At the end the copy_from_user_nofault() becomes
equivalent to copy_from_user_nmi() from safety point of view with
a difference in the return value.

Reported-by: Hsin-Wei Hung 
Signed-off-by: Alexei Starovoitov 
Signed-off-by: Florian Lehner 
Tested-by: Hsin-Wei Hung 
Tested-by: Florian Lehner 
Link: https://lore.kernel.org/r/20230410174345.4376-2-dev@der-flo.net
Signed-off-by: Alexei Starovoitov

mm: use kstrtobool() instead of strtobool()

2022-11-30T23:58:45+00:00

strtobool() is the same as kstrtobool().  However, the latter is more used
within the kernel.

In order to remove strtobool() and slightly simplify kstrtox.h, switch to
the other function name.

While at it, include the corresponding header file ()

Link: https://lkml.kernel.org/r/03f9401a6c8b87a1c786a2138d16b048f8d0eb53.1667336095.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Christophe JAILLET 
Acked-by: Pasha Tatashin 
Signed-off-by: Andrew Morton

usercopy: use unsigned long instead of uintptr_t

2022-07-02T00:03:38+00:00

A recent commit factored out a series of annoying (unsigned long) casts
into a single variable declaration, but made the pointer type a
`uintptr_t` rather than the usual `unsigned long`. This patch changes it
to be the integer type more typically used by the kernel to represent
addresses.

Fixes: 35fb9ae4aa2e ("usercopy: Cast pointer to an integer once")
Cc: Matthew Wilcox 
Cc: Uladzislau Rezki 
Cc: Greg Kroah-Hartman 
Cc: Linus Torvalds 
Cc: Joe Perches 
Signed-off-by: Jason A. Donenfeld 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220616143617.449094-1-Jason@zx2c4.com

usercopy: Make usercopy resilient against ridiculously large copies

2022-06-13T16:54:52+00:00

If 'n' is so large that it's negative, we might wrap around and mistakenly
think that the copy is OK when it's not.  Such a copy would probably
crash, but just doing the arithmetic in a more simple way lets us detect
and refuse this case.

Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-4-willy@infradead.org

usercopy: Cast pointer to an integer once

2022-06-13T16:54:52+00:00

Get rid of a lot of annoying casts by setting 'addr' once at the top
of the function.

Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-3-willy@infradead.org

usercopy: Handle vm_map_ram() areas

2022-06-13T16:54:52+00:00

vmalloc does not allocate a vm_struct for vm_map_ram() areas.  That causes
us to deny usercopies from those areas.  This affects XFS which uses
vm_map_ram() for its directories.

Fix this by calling find_vmap_area() instead of find_vm_area().

Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-2-willy@infradead.org

mm: usercopy: move the virt_addr_valid() below the is_vmalloc_addr()

2022-05-16T23:02:21+00:00

The is_kmap_addr() and the is_vmalloc_addr() in the check_heap_object()
will not work, because the virt_addr_valid() will exclude the kmap and
vmalloc regions. So let's move the virt_addr_valid() below
the is_vmalloc_addr().

Signed-off-by: Yuanzheng Song 
Fixes: 4e140f59d285 ("mm/usercopy: Check kmap addresses properly")
Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
Cc: Matthew Wilcox (Oracle) 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220505071037.4121100-1-songyuanzheng@huawei.com

usercopy: Remove HARDENED_USERCOPY_PAGESPAN

2022-04-13T19:15:52+00:00

There isn't enough information to make this a useful check any more;
the useful parts of it were moved in earlier patches, so remove this
set of checks now.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Reviewed-by: David Hildenbrand 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-5-willy@infradead.org

mm/usercopy: Detect large folio overruns

2022-04-13T19:15:51+00:00

Move the compound page overrun detection out of
CONFIG_HARDENED_USERCOPY_PAGESPAN and convert it to use folios so it's
enabled for more people.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Reviewed-by: David Hildenbrand 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-4-willy@infradead.org

mm/usercopy: Detect vmalloc overruns

2022-04-13T19:15:51+00:00

If you have a vmalloc() allocation, or an address from calling vmap(),
you cannot overrun the vm_area which describes it, regardless of the
size of the underlying allocation.  This probably doesn't do much for
security because vmalloc comes with guard pages these days, but it
prevents usercopy aborts when copying to a vmap() of smaller pages.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-3-willy@infradead.org