summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@linux-foundation.org>2018-02-03 19:25:42 -0500
committerLinus Torvalds <torvalds@linux-foundation.org>2018-02-03 19:25:42 -0500
commit617aebe6a97efa539cc4b8a52adccd89596e6be0 (patch)
tree51c7753c940fd3727b8cc3e93553c57f89d1d9d2
parent0771ad44a20bc512d1123bac728d3a89ea6febe6 (diff)
parente47e311843dece8073146f3606871280ee9beb87 (diff)
Merge tag 'usercopy-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux
Pull hardened usercopy whitelisting from Kees Cook: "Currently, hardened usercopy performs dynamic bounds checking on slab cache objects. This is good, but still leaves a lot of kernel memory available to be copied to/from userspace in the face of bugs. To further restrict what memory is available for copying, this creates a way to whitelist specific areas of a given slab cache object for copying to/from userspace, allowing much finer granularity of access control. Slab caches that are never exposed to userspace can declare no whitelist for their objects, thereby keeping them unavailable to userspace via dynamic copy operations. (Note, an implicit form of whitelisting is the use of constant sizes in usercopy operations and get_user()/put_user(); these bypass all hardened usercopy checks since these sizes cannot change at runtime.) This new check is WARN-by-default, so any mistakes can be found over the next several releases without breaking anyone's system. The series has roughly the following sections: - remove %p and improve reporting with offset - prepare infrastructure and whitelist kmalloc - update VFS subsystem with whitelists - update SCSI subsystem with whitelists - update network subsystem with whitelists - update process memory with whitelists - update per-architecture thread_struct with whitelists - update KVM with whitelists and fix ioctl bug - mark all other allocations as not whitelisted - update lkdtm for more sensible test overage" * tag 'usercopy-v4.16-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (38 commits) lkdtm: Update usercopy tests for whitelisting usercopy: Restrict non-usercopy caches to size 0 kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl kvm: whitelist struct kvm_vcpu_arch arm: Implement thread_struct whitelist for hardened usercopy arm64: Implement thread_struct whitelist for hardened usercopy x86: Implement thread_struct whitelist for hardened usercopy fork: Provide usercopy whitelisting for task_struct fork: Define usercopy region in thread_stack slab caches fork: Define usercopy region in mm_struct slab caches net: Restrict unwhitelisted proto caches to size 0 sctp: Copy struct sctp_sock.autoclose to userspace using put_user() sctp: Define usercopy region in SCTP proto slab cache caif: Define usercopy region in caif proto slab cache ip: Define usercopy region in IP proto slab cache net: Define usercopy region in struct proto slab cache scsi: Define usercopy region in scsi_sense_cache slab cache cifs: Define usercopy region in cifs_request slab cache vxfs: Define usercopy region in vxfs_inode slab cache ufs: Define usercopy region in ufs_inode_cache slab cache ...
Diffstat
-rw-r--r--arch/Kconfig11
-rw-r--r--arch/arm/Kconfig1
-rw-r--r--arch/arm/include/asm/processor.h10
-rw-r--r--arch/arm64/Kconfig1
-rw-r--r--arch/arm64/include/asm/processor.h10
-rw-r--r--arch/x86/Kconfig1
-rw-r--r--arch/x86/include/asm/processor.h8
-rw-r--r--arch/x86/kvm/x86.c7
-rw-r--r--drivers/misc/lkdtm.h4
-rw-r--r--drivers/misc/lkdtm_core.c4
-rw-r--r--drivers/misc/lkdtm_usercopy.c101
-rw-r--r--drivers/scsi/scsi_lib.c9
-rw-r--r--fs/befs/linuxvfs.c14
-rw-r--r--fs/cifs/cifsfs.c10
-rw-r--r--fs/dcache.c9
-rw-r--r--fs/exofs/super.c7
-rw-r--r--fs/ext2/super.c12
-rw-r--r--fs/ext4/super.c12
-rw-r--r--fs/fhandle.c3
-rw-r--r--fs/freevxfs/vxfs_super.c8
-rw-r--r--fs/jfs/super.c8
-rw-r--r--fs/orangefs/super.c15
-rw-r--r--fs/ufs/super.c13
-rw-r--r--include/linux/sched/task.h14
-rw-r--r--include/linux/slab.h41
-rw-r--r--include/linux/slab_def.h3
-rw-r--r--include/linux/slub_def.h3
-rw-r--r--include/linux/stddef.h10
-rw-r--r--include/linux/uaccess.h8
-rw-r--r--include/net/sctp/structs.h9
-rw-r--r--include/net/sock.h2
-rw-r--r--kernel/fork.c31
-rw-r--r--mm/slab.c36
-rw-r--r--mm/slab.h8
-rw-r--r--mm/slab_common.c62
-rw-r--r--mm/slub.c49
-rw-r--r--mm/usercopy.c133
-rw-r--r--net/caif/caif_socket.c2
-rw-r--r--net/core/sock.c4
-rw-r--r--net/ipv4/raw.c2
-rw-r--r--net/ipv6/raw.c2
-rw-r--r--net/sctp/socket.c10
-rw-r--r--security/Kconfig14
-rw-r--r--tools/objtool/check.c1
-rw-r--r--virt/kvm/kvm_main.c8
45 files changed, 515 insertions, 215 deletions
diff --git a/arch/Kconfig b/arch/Kconfig
index d007b2a15b22..467dfa35bf96 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -245,6 +245,17 @@ config ARCH_TASK_STRUCT_ON_STACK
245config ARCH_TASK_STRUCT_ALLOCATOR 245config ARCH_TASK_STRUCT_ALLOCATOR
246 bool 246 bool
247 247
248config HAVE_ARCH_THREAD_STRUCT_WHITELIST
249 bool
250 depends on !ARCH_TASK_STRUCT_ALLOCATOR
251 help
252 An architecture should select this to provide hardened usercopy
253 knowledge about what region of the thread_struct should be
254 whitelisted for copying to userspace. Normally this is only the
255 FPU registers. Specifically, arch_thread_struct_whitelist()
256 should be implemented. Without this, the entire thread_struct
257 field in task_struct will be left whitelisted.
258
248# Select if arch has its private alloc_thread_stack() function 259# Select if arch has its private alloc_thread_stack() function
249config ARCH_THREAD_STACK_ALLOCATOR 260config ARCH_THREAD_STACK_ALLOCATOR
250 bool 261 bool
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 4daddc53e7bc..7e3d53575486 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -51,6 +51,7 @@ config ARM
51 select HAVE_ARCH_KGDB if !CPU_ENDIAN_BE32 && MMU 51 select HAVE_ARCH_KGDB if !CPU_ENDIAN_BE32 && MMU
52 select HAVE_ARCH_MMAP_RND_BITS if MMU 52 select HAVE_ARCH_MMAP_RND_BITS if MMU
53 select HAVE_ARCH_SECCOMP_FILTER if (AEABI && !OABI_COMPAT) 53 select HAVE_ARCH_SECCOMP_FILTER if (AEABI && !OABI_COMPAT)
54 select HAVE_ARCH_THREAD_STRUCT_WHITELIST
54 select HAVE_ARCH_TRACEHOOK 55 select HAVE_ARCH_TRACEHOOK
55 select HAVE_ARM_SMCCC if CPU_V7 56 select HAVE_ARM_SMCCC if CPU_V7
56 select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32 57 select HAVE_EBPF_JIT if !CPU_ENDIAN_BE32
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 338cbe0a18ef..1bf65b47808a 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -45,6 +45,16 @@ struct thread_struct {
45 struct debug_info debug; 45 struct debug_info debug;
46}; 46};
47 47
48/*
49 * Everything usercopied to/from thread_struct is statically-sized, so
50 * no hardened usercopy whitelist is needed.
51 */
52static inline void arch_thread_struct_whitelist(unsigned long *offset,
53 unsigned long *size)
54{
55 *offset = *size = 0;
56}
57
48#define INIT_THREAD { } 58#define INIT_THREAD { }
49 59
50#define start_thread(regs,pc,sp) \ 60#define start_thread(regs,pc,sp) \
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index b2b95f79c746..53612879fe56 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -91,6 +91,7 @@ config ARM64
91 select HAVE_ARCH_MMAP_RND_BITS 91 select HAVE_ARCH_MMAP_RND_BITS
92 select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT 92 select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT
93 select HAVE_ARCH_SECCOMP_FILTER 93 select HAVE_ARCH_SECCOMP_FILTER
94 select HAVE_ARCH_THREAD_STRUCT_WHITELIST
94 select HAVE_ARCH_TRACEHOOK 95 select HAVE_ARCH_TRACEHOOK
95 select HAVE_ARCH_TRANSPARENT_HUGEPAGE 96 select HAVE_ARCH_TRANSPARENT_HUGEPAGE
96 select HAVE_ARCH_VMAP_STACK 97 select HAVE_ARCH_VMAP_STACK
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index cee4ae25a5d1..6db43ebd648d 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h
@@ -113,6 +113,16 @@ struct thread_struct {
113 struct debug_info debug; /* debugging */ 113 struct debug_info debug; /* debugging */
114}; 114};
115 115
116/*
117 * Everything usercopied to/from thread_struct is statically-sized, so
118 * no hardened usercopy whitelist is needed.
119 */
120static inline void arch_thread_struct_whitelist(unsigned long *offset,
121 unsigned long *size)
122{
123 *offset = *size = 0;
124}
125
116#ifdef CONFIG_COMPAT 126#ifdef CONFIG_COMPAT
117#define task_user_tls(t) \ 127#define task_user_tls(t) \
118({ \ 128({ \
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 72d5149bcaa1..b0771ceabb4b 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -116,6 +116,7 @@ config X86
116 select HAVE_ARCH_MMAP_RND_COMPAT_BITS if MMU && COMPAT 116 select HAVE_ARCH_MMAP_RND_COMPAT_BITS if MMU && COMPAT
117 select HAVE_ARCH_COMPAT_MMAP_BASES if MMU && COMPAT 117 select HAVE_ARCH_COMPAT_MMAP_BASES if MMU && COMPAT
118 select HAVE_ARCH_SECCOMP_FILTER 118 select HAVE_ARCH_SECCOMP_FILTER
119 select HAVE_ARCH_THREAD_STRUCT_WHITELIST
119 select HAVE_ARCH_TRACEHOOK 120 select HAVE_ARCH_TRACEHOOK
120 select HAVE_ARCH_TRANSPARENT_HUGEPAGE 121 select HAVE_ARCH_TRANSPARENT_HUGEPAGE
121 select HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD if X86_64 122 select HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD if X86_64
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index efbde088a718..6207f2f740b6 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -507,6 +507,14 @@ struct thread_struct {
507 */ 507 */
508}; 508};
509 509
510/* Whitelist the FPU state from the task_struct for hardened usercopy. */
511static inline void arch_thread_struct_whitelist(unsigned long *offset,
512 unsigned long *size)
513{
514 *offset = offsetof(struct thread_struct, fpu.state);
515 *size = fpu_kernel_xstate_size;
516}
517
510/* 518/*
511 * Thread-synchronous status. 519 * Thread-synchronous status.
512 * 520 *
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index c53298dfbf50..5040ff9de6ab 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -4237,13 +4237,14 @@ set_identity_unlock:
4237 mutex_unlock(&kvm->lock); 4237 mutex_unlock(&kvm->lock);
4238 break; 4238 break;
4239 case KVM_XEN_HVM_CONFIG: { 4239 case KVM_XEN_HVM_CONFIG: {
4240 struct kvm_xen_hvm_config xhc;
4240 r = -EFAULT; 4241 r = -EFAULT;
4241 if (copy_from_user(&kvm->arch.xen_hvm_config, argp, 4242 if (copy_from_user(&xhc, argp, sizeof(xhc)))
4242 sizeof(struct kvm_xen_hvm_config)))
4243 goto out; 4243 goto out;
4244 r = -EINVAL; 4244 r = -EINVAL;
4245 if (kvm->arch.xen_hvm_config.flags) 4245 if (xhc.flags)
4246 goto out; 4246 goto out;
4247 memcpy(&kvm->arch.xen_hvm_config, &xhc, sizeof(xhc));
4247 r = 0; 4248 r = 0;
4248 break; 4249 break;
4249 } 4250 }
diff --git a/drivers/misc/lkdtm.h b/drivers/misc/lkdtm.h
index 687a0dbbe199..9e513dcfd809 100644
--- a/drivers/misc/lkdtm.h
+++ b/drivers/misc/lkdtm.h
@@ -76,8 +76,8 @@ void __init lkdtm_usercopy_init(void);
76void __exit lkdtm_usercopy_exit(void); 76void __exit lkdtm_usercopy_exit(void);
77void lkdtm_USERCOPY_HEAP_SIZE_TO(void); 77void lkdtm_USERCOPY_HEAP_SIZE_TO(void);
78void lkdtm_USERCOPY_HEAP_SIZE_FROM(void); 78void lkdtm_USERCOPY_HEAP_SIZE_FROM(void);
79void lkdtm_USERCOPY_HEAP_FLAG_TO(void); 79void lkdtm_USERCOPY_HEAP_WHITELIST_TO(void);
80void lkdtm_USERCOPY_HEAP_FLAG_FROM(void); 80void lkdtm_USERCOPY_HEAP_WHITELIST_FROM(void);
81void lkdtm_USERCOPY_STACK_FRAME_TO(void); 81void lkdtm_USERCOPY_STACK_FRAME_TO(void);
82void lkdtm_USERCOPY_STACK_FRAME_FROM(void); 82void lkdtm_USERCOPY_STACK_FRAME_FROM(void);
83void lkdtm_USERCOPY_STACK_BEYOND(void); 83void lkdtm_USERCOPY_STACK_BEYOND(void);
diff --git a/drivers/misc/lkdtm_core.c b/drivers/misc/lkdtm_core.c
index 4942da93d066..2154d1bfd18b 100644
--- a/drivers/misc/lkdtm_core.c
+++ b/drivers/misc/lkdtm_core.c
@@ -177,8 +177,8 @@ static const struct crashtype crashtypes[] = {
177 CRASHTYPE(ATOMIC_TIMING), 177 CRASHTYPE(ATOMIC_TIMING),
178 CRASHTYPE(USERCOPY_HEAP_SIZE_TO), 178 CRASHTYPE(USERCOPY_HEAP_SIZE_TO),
179 CRASHTYPE(USERCOPY_HEAP_SIZE_FROM), 179 CRASHTYPE(USERCOPY_HEAP_SIZE_FROM),
180 CRASHTYPE(USERCOPY_HEAP_FLAG_TO), 180 CRASHTYPE(USERCOPY_HEAP_WHITELIST_TO),
181 CRASHTYPE(USERCOPY_HEAP_FLAG_FROM), 181 CRASHTYPE(USERCOPY_HEAP_WHITELIST_FROM),
182 CRASHTYPE(USERCOPY_STACK_FRAME_TO), 182 CRASHTYPE(USERCOPY_STACK_FRAME_TO),
183 CRASHTYPE(USERCOPY_STACK_FRAME_FROM), 183 CRASHTYPE(USERCOPY_STACK_FRAME_FROM),
184 CRASHTYPE(USERCOPY_STACK_BEYOND), 184 CRASHTYPE(USERCOPY_STACK_BEYOND),
diff --git a/drivers/misc/lkdtm_usercopy.c b/drivers/misc/lkdtm_usercopy.c
index a64372cc148d..9725aed305bb 100644
--- a/drivers/misc/lkdtm_usercopy.c
+++ b/drivers/misc/lkdtm_usercopy.c
@@ -20,7 +20,7 @@
20 */ 20 */
21static volatile size_t unconst = 0; 21static volatile size_t unconst = 0;
22static volatile size_t cache_size = 1024; 22static volatile size_t cache_size = 1024;
23static struct kmem_cache *bad_cache; 23static struct kmem_cache *whitelist_cache;
24 24
25static const unsigned char test_text[] = "This is a test.\n"; 25static const unsigned char test_text[] = "This is a test.\n";
26 26
@@ -115,10 +115,16 @@ free_user:
115 vm_munmap(user_addr, PAGE_SIZE); 115 vm_munmap(user_addr, PAGE_SIZE);
116} 116}
117 117
118/*
119 * This checks for whole-object size validation with hardened usercopy,
120 * with or without usercopy whitelisting.
121 */
118static void do_usercopy_heap_size(bool to_user) 122static void do_usercopy_heap_size(bool to_user)
119{ 123{
120 unsigned long user_addr; 124 unsigned long user_addr;
121 unsigned char *one, *two; 125 unsigned char *one, *two;
126 void __user *test_user_addr;
127 void *test_kern_addr;
122 size_t size = unconst + 1024; 128 size_t size = unconst + 1024;
123 129
124 one = kmalloc(size, GFP_KERNEL); 130 one = kmalloc(size, GFP_KERNEL);
@@ -139,27 +145,30 @@ static void do_usercopy_heap_size(bool to_user)
139 memset(one, 'A', size); 145 memset(one, 'A', size);
140 memset(two, 'B', size); 146 memset(two, 'B', size);
141 147
148 test_user_addr = (void __user *)(user_addr + 16);
149 test_kern_addr = one + 16;
150
142 if (to_user) { 151 if (to_user) {
143 pr_info("attempting good copy_to_user of correct size\n"); 152 pr_info("attempting good copy_to_user of correct size\n");
144 if (copy_to_user((void __user *)user_addr, one, size)) { 153 if (copy_to_user(test_user_addr, test_kern_addr, size / 2)) {
145 pr_warn("copy_to_user failed unexpectedly?!\n"); 154 pr_warn("copy_to_user failed unexpectedly?!\n");
146 goto free_user; 155 goto free_user;
147 } 156 }
148 157
149 pr_info("attempting bad copy_to_user of too large size\n"); 158 pr_info("attempting bad copy_to_user of too large size\n");
150 if (copy_to_user((void __user *)user_addr, one, 2 * size)) { 159 if (copy_to_user(test_user_addr, test_kern_addr, size)) {
151 pr_warn("copy_to_user failed, but lacked Oops\n"); 160 pr_warn("copy_to_user failed, but lacked Oops\n");
152 goto free_user; 161 goto free_user;
153 } 162 }
154 } else { 163 } else {
155 pr_info("attempting good copy_from_user of correct size\n"); 164 pr_info("attempting good copy_from_user of correct size\n");
156 if (copy_from_user(one, (void __user *)user_addr, size)) { 165 if (copy_from_user(test_kern_addr, test_user_addr, size / 2)) {
157 pr_warn("copy_from_user failed unexpectedly?!\n"); 166 pr_warn("copy_from_user failed unexpectedly?!\n");
158 goto free_user; 167 goto free_user;
159 } 168 }
160 169
161 pr_info("attempting bad copy_from_user of too large size\n"); 170 pr_info("attempting bad copy_from_user of too large size\n");
162 if (copy_from_user(one, (void __user *)user_addr, 2 * size)) { 171 if (copy_from_user(test_kern_addr, test_user_addr, size)) {
163 pr_warn("copy_from_user failed, but lacked Oops\n"); 172 pr_warn("copy_from_user failed, but lacked Oops\n");
164 goto free_user; 173 goto free_user;
165 } 174 }
@@ -172,77 +181,79 @@ free_kernel:
172 kfree(two); 181 kfree(two);
173} 182}
174 183
175static void do_usercopy_heap_flag(bool to_user) 184/*
185 * This checks for the specific whitelist window within an object. If this
186 * test passes, then do_usercopy_heap_size() tests will pass too.
187 */
188static void do_usercopy_heap_whitelist(bool to_user)
176{ 189{
177 unsigned long user_addr; 190 unsigned long user_alloc;
178 unsigned char *good_buf = NULL; 191 unsigned char *buf = NULL;
179 unsigned char *bad_buf = NULL; 192 unsigned char __user *user_addr;
193 size_t offset, size;
180 194
181 /* Make sure cache was prepared. */ 195 /* Make sure cache was prepared. */
182 if (!bad_cache) { 196 if (!whitelist_cache) {
183 pr_warn("Failed to allocate kernel cache\n"); 197 pr_warn("Failed to allocate kernel cache\n");
184 return; 198 return;
185 } 199 }
186 200
187 /* 201 /*
188 * Allocate one buffer from each cache (kmalloc will have the 202 * Allocate a buffer with a whitelisted window in the buffer.
189 * SLAB_USERCOPY flag already, but "bad_cache" won't).
190 */ 203 */
191 good_buf = kmalloc(cache_size, GFP_KERNEL); 204 buf = kmem_cache_alloc(whitelist_cache, GFP_KERNEL);
192 bad_buf = kmem_cache_alloc(bad_cache, GFP_KERNEL); 205 if (!buf) {
193 if (!good_buf || !bad_buf) { 206 pr_warn("Failed to allocate buffer from whitelist cache\n");
194 pr_warn("Failed to allocate buffers from caches\n");
195 goto free_alloc; 207 goto free_alloc;
196 } 208 }
197 209
198 /* Allocate user memory we'll poke at. */ 210 /* Allocate user memory we'll poke at. */
199 user_addr = vm_mmap(NULL, 0, PAGE_SIZE, 211 user_alloc = vm_mmap(NULL, 0, PAGE_SIZE,
200 PROT_READ | PROT_WRITE | PROT_EXEC, 212 PROT_READ | PROT_WRITE | PROT_EXEC,
201 MAP_ANONYMOUS | MAP_PRIVATE, 0); 213 MAP_ANONYMOUS | MAP_PRIVATE, 0);
202 if (user_addr >= TASK_SIZE) { 214 if (user_alloc >= TASK_SIZE) {
203 pr_warn("Failed to allocate user memory\n"); 215 pr_warn("Failed to allocate user memory\n");
204 goto free_alloc; 216 goto free_alloc;
205 } 217 }
218 user_addr = (void __user *)user_alloc;
206 219
207 memset(good_buf, 'A', cache_size); 220 memset(buf, 'B', cache_size);
208 memset(bad_buf, 'B', cache_size); 221
222 /* Whitelisted window in buffer, from kmem_cache_create_usercopy. */
223 offset = (cache_size / 4) + unconst;
224 size = (cache_size / 16) + unconst;
209 225
210 if (to_user) { 226 if (to_user) {
211 pr_info("attempting good copy_to_user with SLAB_USERCOPY\n"); 227 pr_info("attempting good copy_to_user inside whitelist\n");
212 if (copy_to_user((void __user *)user_addr, good_buf, 228 if (copy_to_user(user_addr, buf + offset, size)) {
213 cache_size)) {
214 pr_warn("copy_to_user failed unexpectedly?!\n"); 229 pr_warn("copy_to_user failed unexpectedly?!\n");
215 goto free_user; 230 goto free_user;
216 } 231 }
217 232
218 pr_info("attempting bad copy_to_user w/o SLAB_USERCOPY\n"); 233 pr_info("attempting bad copy_to_user outside whitelist\n");
219 if (copy_to_user((void __user *)user_addr, bad_buf, 234 if (copy_to_user(user_addr, buf + offset - 1, size)) {
220 cache_size)) {
221 pr_warn("copy_to_user failed, but lacked Oops\n"); 235 pr_warn("copy_to_user failed, but lacked Oops\n");
222 goto free_user; 236 goto free_user;
223 } 237 }
224 } else { 238 } else {
225 pr_info("attempting good copy_from_user with SLAB_USERCOPY\n"); 239 pr_info("attempting good copy_from_user inside whitelist\n");
226 if (copy_from_user(good_buf, (void __user *)user_addr, 240 if (copy_from_user(buf + offset, user_addr, size)) {
227 cache_size)) {
228 pr_warn("copy_from_user failed unexpectedly?!\n"); 241 pr_warn("copy_from_user failed unexpectedly?!\n");
229 goto free_user; 242 goto free_user;
230 } 243 }
231 244
232 pr_info("attempting bad copy_from_user w/o SLAB_USERCOPY\n"); 245 pr_info("attempting bad copy_from_user outside whitelist\n");
233 if (copy_from_user(bad_buf, (void __user *)user_addr, 246 if (copy_from_user(buf + offset - 1, user_addr, size)) {
234 cache_size)) {
235 pr_warn("copy_from_user failed, but lacked Oops\n"); 247 pr_warn("copy_from_user failed, but lacked Oops\n");
236 goto free_user; 248 goto free_user;
237 } 249 }
238 } 250 }
239 251
240free_user: 252free_user:
241 vm_munmap(user_addr, PAGE_SIZE); 253 vm_munmap(user_alloc, PAGE_SIZE);
242free_alloc: 254free_alloc:
243 if (bad_buf) 255 if (buf)
244 kmem_cache_free(bad_cache, bad_buf); 256 kmem_cache_free(whitelist_cache, buf);
245 kfree(good_buf);
246} 257}
247 258
248/* Callable tests. */ 259/* Callable tests. */
@@ -256,14 +267,14 @@ void lkdtm_USERCOPY_HEAP_SIZE_FROM(void)
256 do_usercopy_heap_size(false); 267 do_usercopy_heap_size(false);
257} 268}
258 269
259void lkdtm_USERCOPY_HEAP_FLAG_TO(void) 270void lkdtm_USERCOPY_HEAP_WHITELIST_TO(void)
260{ 271{
261 do_usercopy_heap_flag(true); 272 do_usercopy_heap_whitelist(true);
262} 273}
263 274
264void lkdtm_USERCOPY_HEAP_FLAG_FROM(void) 275void lkdtm_USERCOPY_HEAP_WHITELIST_FROM(void)
265{ 276{
266 do_usercopy_heap_flag(false); 277 do_usercopy_heap_whitelist(false);
267} 278}
268 279
269void lkdtm_USERCOPY_STACK_FRAME_TO(void) 280void lkdtm_USERCOPY_STACK_FRAME_TO(void)
@@ -314,11 +325,15 @@ free_user:
314void __init lkdtm_usercopy_init(void) 325void __init lkdtm_usercopy_init(void)
315{ 326{
316 /* Prepare cache that lacks SLAB_USERCOPY flag. */ 327 /* Prepare cache that lacks SLAB_USERCOPY flag. */
317 bad_cache = kmem_cache_create("lkdtm-no-usercopy", cache_size, 0, 328 whitelist_cache =
318 0, NULL); 329 kmem_cache_create_usercopy("lkdtm-usercopy", cache_size,
330 0, 0,
331 cache_size / 4,
332 cache_size / 16,
333 NULL);
319} 334}
320 335
321void __exit lkdtm_usercopy_exit(void) 336void __exit lkdtm_usercopy_exit(void)
322{ 337{
323 kmem_cache_destroy(bad_cache); 338 kmem_cache_destroy(whitelist_cache);
324} 339}
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 976c936029cb..8efe4731ed89 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -79,14 +79,15 @@ int scsi_init_sense_cache(struct Scsi_Host *shost)
79 if (shost->unchecked_isa_dma) { 79 if (shost->unchecked_isa_dma) {
80 scsi_sense_isadma_cache = 80 scsi_sense_isadma_cache =
81 kmem_cache_create("scsi_sense_cache(DMA)", 81 kmem_cache_create("scsi_sense_cache(DMA)",
82 SCSI_SENSE_BUFFERSIZE, 0, 82 SCSI_SENSE_BUFFERSIZE, 0,
83 SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA, NULL); 83 SLAB_HWCACHE_ALIGN | SLAB_CACHE_DMA, NULL);
84 if (!scsi_sense_isadma_cache) 84 if (!scsi_sense_isadma_cache)
85 ret = -ENOMEM; 85 ret = -ENOMEM;
86 } else { 86 } else {
87 scsi_sense_cache = 87 scsi_sense_cache =
88 kmem_cache_create("scsi_sense_cache", 88 kmem_cache_create_usercopy("scsi_sense_cache",
89 SCSI_SENSE_BUFFERSIZE, 0, SLAB_HWCACHE_ALIGN, NULL); 89 SCSI_SENSE_BUFFERSIZE, 0, SLAB_HWCACHE_ALIGN,
90 0, SCSI_SENSE_BUFFERSIZE, NULL);
90 if (!scsi_sense_cache) 91 if (!scsi_sense_cache)
91 ret = -ENOMEM; 92 ret = -ENOMEM;
92 } 93 }
diff --git a/fs/befs/linuxvfs.c b/fs/befs/linuxvfs.c
index ee236231cafa..af2832aaeec5 100644
--- a/fs/befs/linuxvfs.c
+++ b/fs/befs/linuxvfs.c
@@ -444,11 +444,15 @@ unacquire_none:
444static int __init 444static int __init
445befs_init_inodecache(void) 445befs_init_inodecache(void)
446{ 446{
447 befs_inode_cachep = kmem_cache_create("befs_inode_cache", 447 befs_inode_cachep = kmem_cache_create_usercopy("befs_inode_cache",
448 sizeof (struct befs_inode_info), 448 sizeof(struct befs_inode_info), 0,
449 0, (SLAB_RECLAIM_ACCOUNT| 449 (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
450 SLAB_MEM_SPREAD|SLAB_ACCOUNT), 450 SLAB_ACCOUNT),
451 init_once); 451 offsetof(struct befs_inode_info,
452 i_data.symlink),
453 sizeof_field(struct befs_inode_info,
454 i_data.symlink),
455 init_once);
452 if (befs_inode_cachep == NULL) 456 if (befs_inode_cachep == NULL)
453 return -ENOMEM; 457 return -ENOMEM;
454 458
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index a7be591d8e18..32cdea67bbfd 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -1239,9 +1239,11 @@ cifs_init_request_bufs(void)
1239 cifs_dbg(VFS, "CIFSMaxBufSize %d 0x%x\n", 1239 cifs_dbg(VFS, "CIFSMaxBufSize %d 0x%x\n",
1240 CIFSMaxBufSize, CIFSMaxBufSize); 1240 CIFSMaxBufSize, CIFSMaxBufSize);
1241*/ 1241*/
1242 cifs_req_cachep = kmem_cache_create("cifs_request", 1242 cifs_req_cachep = kmem_cache_create_usercopy("cifs_request",
1243 CIFSMaxBufSize + max_hdr_size, 0, 1243 CIFSMaxBufSize + max_hdr_size, 0,
1244 SLAB_HWCACHE_ALIGN, NULL); 1244 SLAB_HWCACHE_ALIGN, 0,
1245 CIFSMaxBufSize + max_hdr_size,
1246 NULL);
1245 if (cifs_req_cachep == NULL) 1247 if (cifs_req_cachep == NULL)
1246 return -ENOMEM; 1248 return -ENOMEM;
1247 1249
@@ -1267,9 +1269,9 @@ cifs_init_request_bufs(void)
1267 more SMBs to use small buffer alloc and is still much more 1269 more SMBs to use small buffer alloc and is still much more
1268 efficient to alloc 1 per page off the slab compared to 17K (5page) 1270 efficient to alloc 1 per page off the slab compared to 17K (5page)
1269 alloc of large cifs buffers even when page debugging is on */ 1271 alloc of large cifs buffers even when page debugging is on */
1270 cifs_sm_req_cachep = kmem_cache_create("cifs_small_rq", 1272 cifs_sm_req_cachep = kmem_cache_create_usercopy("cifs_small_rq",
1271 MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN, 1273 MAX_CIFS_SMALL_BUFFER_SIZE, 0, SLAB_HWCACHE_ALIGN,
1272 NULL); 1274 0, MAX_CIFS_SMALL_BUFFER_SIZE, NULL);
1273 if (cifs_sm_req_cachep == NULL) { 1275 if (cifs_sm_req_cachep == NULL) {
1274 mempool_destroy(cifs_req_poolp); 1276 mempool_destroy(cifs_req_poolp);
1275 kmem_cache_destroy(cifs_req_cachep); 1277 kmem_cache_destroy(cifs_req_cachep);
diff --git a/fs/dcache.c b/fs/dcache.c
index 5b207e0de459..cca2b377ff0a 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -3602,8 +3602,9 @@ static void __init dcache_init(void)
3602 * but it is probably not worth it because of the cache nature 3602 * but it is probably not worth it because of the cache nature
3603 * of the dcache. 3603 * of the dcache.
3604 */ 3604 */
3605 dentry_cache = KMEM_CACHE(dentry, 3605 dentry_cache = KMEM_CACHE_USERCOPY(dentry,
3606 SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|SLAB_MEM_SPREAD|SLAB_ACCOUNT); 3606 SLAB_RECLAIM_ACCOUNT|SLAB_PANIC|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
3607 d_iname);
3607 3608
3608 /* Hash may have been set up in dcache_init_early */ 3609 /* Hash may have been set up in dcache_init_early */
3609 if (!hashdist) 3610 if (!hashdist)
@@ -3641,8 +3642,8 @@ void __init vfs_caches_init_early(void)
3641 3642
3642void __init vfs_caches_init(void) 3643void __init vfs_caches_init(void)
3643{ 3644{
3644 names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0, 3645 names_cachep = kmem_cache_create_usercopy("names_cache", PATH_MAX, 0,
3645 SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL); 3646 SLAB_HWCACHE_ALIGN|SLAB_PANIC, 0, PATH_MAX, NULL);
3646 3647
3647 dcache_init(); 3648 dcache_init();
3648 inode_init(); 3649 inode_init();
diff --git a/fs/exofs/super.c b/fs/exofs/super.c
index 7e244093c0e5..179cd5c2f52a 100644
--- a/fs/exofs/super.c
+++ b/fs/exofs/super.c
@@ -193,10 +193,13 @@ static void exofs_init_once(void *foo)
193 */ 193 */
194static int init_inodecache(void) 194static int init_inodecache(void)
195{ 195{
196 exofs_inode_cachep = kmem_cache_create("exofs_inode_cache", 196 exofs_inode_cachep = kmem_cache_create_usercopy("exofs_inode_cache",
197 sizeof(struct exofs_i_info), 0, 197 sizeof(struct exofs_i_info), 0,
198 SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD | 198 SLAB_RECLAIM_ACCOUNT | SLAB_MEM_SPREAD |
199 SLAB_ACCOUNT, exofs_init_once); 199 SLAB_ACCOUNT,
200 offsetof(struct exofs_i_info, i_data),
201 sizeof_field(struct exofs_i_info, i_data),
202 exofs_init_once);
200 if (exofs_inode_cachep == NULL) 203 if (exofs_inode_cachep == NULL)
201 return -ENOMEM; 204 return -ENOMEM;
202 return 0; 205 return 0;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 554c98b8a93a..db5f9daa7780 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -221,11 +221,13 @@ static void init_once(void *foo)
221 221
222static int __init init_inodecache(void) 222static int __init init_inodecache(void)
223{ 223{
224 ext2_inode_cachep = kmem_cache_create("ext2_inode_cache", 224 ext2_inode_cachep = kmem_cache_create_usercopy("ext2_inode_cache",
225 sizeof(struct ext2_inode_info), 225 sizeof(struct ext2_inode_info), 0,
226 0, (SLAB_RECLAIM_ACCOUNT| 226 (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
227 SLAB_MEM_SPREAD|SLAB_ACCOUNT), 227 SLAB_ACCOUNT),
228 init_once); 228 offsetof(struct ext2_inode_info, i_data),
229 sizeof_field(struct ext2_inode_info, i_data),
230 init_once);
229 if (ext2_inode_cachep == NULL) 231 if (ext2_inode_cachep == NULL)
230 return -ENOMEM; 232 return -ENOMEM;
231 return 0; 233 return 0;
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index 82eead1c8b84..899e6faf3381 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -1038,11 +1038,13 @@ static void init_once(void *foo)
1038 1038
1039static int __init init_inodecache(void) 1039static int __init init_inodecache(void)
1040{ 1040{
1041 ext4_inode_cachep = kmem_cache_create("ext4_inode_cache", 1041 ext4_inode_cachep = kmem_cache_create_usercopy("ext4_inode_cache",
1042 sizeof(struct ext4_inode_info), 1042 sizeof(struct ext4_inode_info), 0,
1043 0, (SLAB_RECLAIM_ACCOUNT| 1043 (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
1044 SLAB_MEM_SPREAD|SLAB_ACCOUNT), 1044 SLAB_ACCOUNT),
1045 init_once); 1045 offsetof(struct ext4_inode_info, i_data),
1046 sizeof_field(struct ext4_inode_info, i_data),
1047 init_once);
1046 if (ext4_inode_cachep == NULL) 1048 if (ext4_inode_cachep == NULL)
1047 return -ENOMEM; 1049 return -ENOMEM;
1048 return 0; 1050 return 0;
diff --git a/fs/fhandle.c b/fs/fhandle.c
index 0ace128f5d23..0ee727485615 100644
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -69,8 +69,7 @@ static long do_sys_name_to_handle(struct path *path,
69 } else 69 } else
70 retval = 0; 70 retval = 0;
71 /* copy the mount id */ 71 /* copy the mount id */
72 if (copy_to_user(mnt_id, &real_mount(path->mnt)->mnt_id, 72 if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
73 sizeof(*mnt_id)) ||
74 copy_to_user(ufh, handle, 73 copy_to_user(ufh, handle,
75 sizeof(struct file_handle) + handle_bytes)) 74 sizeof(struct file_handle) + handle_bytes))
76 retval = -EFAULT; 75 retval = -EFAULT;
diff --git a/fs/freevxfs/vxfs_super.c b/fs/freevxfs/vxfs_super.c
index f989efa051a0..48b24bb50d02 100644
--- a/fs/freevxfs/vxfs_super.c
+++ b/fs/freevxfs/vxfs_super.c
@@ -332,9 +332,13 @@ vxfs_init(void)
332{ 332{
333 int rv; 333 int rv;
334 334
335 vxfs_inode_cachep = kmem_cache_create("vxfs_inode", 335 vxfs_inode_cachep = kmem_cache_create_usercopy("vxfs_inode",
336 sizeof(struct vxfs_inode_info), 0, 336 sizeof(struct vxfs_inode_info), 0,
337 SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD, NULL); 337 SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
338 offsetof(struct vxfs_inode_info, vii_immed.vi_immed),
339 sizeof_field(struct vxfs_inode_info,
340 vii_immed.vi_immed),
341 NULL);
338 if (!vxfs_inode_cachep) 342 if (!vxfs_inode_cachep)
339 return -ENOMEM; 343 return -ENOMEM;
340 rv = register_filesystem(&vxfs_fs_type); 344 rv = register_filesystem(&vxfs_fs_type);
diff --git a/fs/jfs/super.c b/fs/jfs/super.c
index 90373aebfdca..1b9264fd54b6 100644
--- a/fs/jfs/super.c
+++ b/fs/jfs/super.c
@@ -965,9 +965,11 @@ static int __init init_jfs_fs(void)
965 int rc; 965 int rc;
966 966
967 jfs_inode_cachep = 967 jfs_inode_cachep =
968 kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0, 968 kmem_cache_create_usercopy("jfs_ip", sizeof(struct jfs_inode_info),
969 SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_ACCOUNT, 969 0, SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_ACCOUNT,
970 init_once); 970 offsetof(struct jfs_inode_info, i_inline),
971 sizeof_field(struct jfs_inode_info, i_inline),
972 init_once);
971 if (jfs_inode_cachep == NULL) 973 if (jfs_inode_cachep == NULL)
972 return -ENOMEM; 974 return -ENOMEM;
973 975
diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c
index 36f1390b5ed7..62d49e53061c 100644
--- a/fs/orangefs/super.c
+++ b/fs/orangefs/super.c
@@ -610,11 +610,16 @@ void orangefs_kill_sb(struct super_block *sb)
610 610
611int orangefs_inode_cache_initialize(void) 611int orangefs_inode_cache_initialize(void)
612{ 612{
613 orangefs_inode_cache = kmem_cache_create("orangefs_inode_cache", 613 orangefs_inode_cache = kmem_cache_create_usercopy(
614 sizeof(struct orangefs_inode_s), 614 "orangefs_inode_cache",
615 0, 615 sizeof(struct orangefs_inode_s),
616 ORANGEFS_CACHE_CREATE_FLAGS, 616 0,
617 orangefs_inode_cache_ctor); 617 ORANGEFS_CACHE_CREATE_FLAGS,
618 offsetof(struct orangefs_inode_s,
619 link_target),
620 sizeof_field(struct orangefs_inode_s,
621 link_target),
622 orangefs_inode_cache_ctor);
618 623
619 if (!orangefs_inode_cache) { 624 if (!orangefs_inode_cache) {
620 gossip_err("Cannot create orangefs_inode_cache\n"); 625 gossip_err("Cannot create orangefs_inode_cache\n");
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index b6ba80e05bff..8254b8b3690f 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -1467,11 +1467,14 @@ static void init_once(void *foo)
1467 1467
1468static int __init init_inodecache(void) 1468static int __init init_inodecache(void)
1469{ 1469{
1470 ufs_inode_cachep = kmem_cache_create("ufs_inode_cache", 1470 ufs_inode_cachep = kmem_cache_create_usercopy("ufs_inode_cache",
1471 sizeof(struct ufs_inode_info), 1471 sizeof(struct ufs_inode_info), 0,
1472 0, (SLAB_RECLAIM_ACCOUNT| 1472 (SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|
1473 SLAB_MEM_SPREAD|SLAB_ACCOUNT), 1473 SLAB_ACCOUNT),
1474 init_once); 1474 offsetof(struct ufs_inode_info, i_u1.i_symlink),
1475 sizeof_field(struct ufs_inode_info,
1476 i_u1.i_symlink),
1477 init_once);
1475 if (ufs_inode_cachep == NULL) 1478 if (ufs_inode_cachep == NULL)
1476 return -ENOMEM; 1479 return -ENOMEM;
1477 return 0; 1480 return 0;
diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h
index 05b8650f06f5..5be31eb7b266 100644
--- a/include/linux/sched/task.h
+++ b/include/linux/sched/task.h
@@ -104,6 +104,20 @@ extern int arch_task_struct_size __read_mostly;
104# define arch_task_struct_size (sizeof(struct task_struct)) 104# define arch_task_struct_size (sizeof(struct task_struct))
105#endif 105#endif
106 106
107#ifndef CONFIG_HAVE_ARCH_THREAD_STRUCT_WHITELIST
108/*
109 * If an architecture has not declared a thread_struct whitelist we
110 * must assume something there may need to be copied to userspace.
111 */
112static inline void arch_thread_struct_whitelist(unsigned long *offset,
113 unsigned long *size)
114{
115 *offset = 0;
116 /* Handle dynamically sized thread_struct. */
117 *size = arch_task_struct_size - offsetof(struct task_struct, thread);
118}
119#endif
120
107#ifdef CONFIG_VMAP_STACK 121#ifdef CONFIG_VMAP_STACK
108static inline struct vm_struct *task_stack_vm_area(const struct task_struct *t) 122static inline struct vm_struct *task_stack_vm_area(const struct task_struct *t)
109{ 123{
diff --git a/include/linux/slab.h b/include/linux/slab.h
index 50697a1d6621..231abc8976c5 100644
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -135,9 +135,15 @@ struct mem_cgroup;
135void __init kmem_cache_init(void); 135void __init kmem_cache_init(void);
136bool slab_is_available(void); 136bool slab_is_available(void);
137 137
138struct kmem_cache *kmem_cache_create(const char *, size_t, size_t, 138extern bool usercopy_fallback;
139 slab_flags_t, 139
140 void (*)(void *)); 140struct kmem_cache *kmem_cache_create(const char *name, size_t size,
141 size_t align, slab_flags_t flags,
142 void (*ctor)(void *));
143struct kmem_cache *kmem_cache_create_usercopy(const char *name,
144 size_t size, size_t align, slab_flags_t flags,
145 size_t useroffset, size_t usersize,
146 void (*ctor)(void *));
141void kmem_cache_destroy(struct kmem_cache *); 147void kmem_cache_destroy(struct kmem_cache *);
142int kmem_cache_shrink(struct kmem_cache *); 148int kmem_cache_shrink(struct kmem_cache *);
143 149
@@ -153,9 +159,20 @@ void memcg_destroy_kmem_caches(struct mem_cgroup *);
153 * f.e. add ____cacheline_aligned_in_smp to the struct declaration 159 * f.e. add ____cacheline_aligned_in_smp to the struct declaration
154 * then the objects will be properly aligned in SMP configurations. 160 * then the objects will be properly aligned in SMP configurations.
155 */ 161 */
156#define KMEM_CACHE(__struct, __flags) kmem_cache_create(#__struct,\ 162#define KMEM_CACHE(__struct, __flags) \
157 sizeof(struct __struct), __alignof__(struct __struct),\ 163 kmem_cache_create(#__struct, sizeof(struct __struct), \
158 (__flags), NULL) 164 __alignof__(struct __struct), (__flags), NULL)
165
166/*
167 * To whitelist a single field for copying to/from usercopy, use this
168 * macro instead for KMEM_CACHE() above.
169 */
170#define KMEM_CACHE_USERCOPY(__struct, __flags, __field) \
171 kmem_cache_create_usercopy(#__struct, \
172 sizeof(struct __struct), \
173 __alignof__(struct __struct), (__flags), \
174 offsetof(struct __struct, __field), \
175 sizeof_field(struct __struct, __field), NULL)
159 176
160/* 177/*
161 * Common kmalloc functions provided by all allocators 178 * Common kmalloc functions provided by all allocators
@@ -167,15 +184,11 @@ void kzfree(const void *);
167size_t ksize(const void *); 184size_t ksize(const void *);
168 185
169#ifdef CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR 186#ifdef CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR
170const char *__check_heap_object(const void *ptr, unsigned long n, 187void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
171 struct page *page); 188 bool to_user);
172#else 189#else
173static inline const char *__check_heap_object(const void *ptr, 190static inline void __check_heap_object(const void *ptr, unsigned long n,
174 unsigned long n, 191 struct page *page, bool to_user) { }
175 struct page *page)
176{
177 return NULL;
178}
179#endif 192#endif
180 193
181/* 194/*
diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
index 072e46e9e1d5..7385547c04b1 100644
--- a/include/linux/slab_def.h
+++ b/include/linux/slab_def.h
@@ -85,6 +85,9 @@ struct kmem_cache {
85 unsigned int *random_seq; 85 unsigned int *random_seq;
86#endif 86#endif
87 87
88 size_t useroffset; /* Usercopy region offset */
89 size_t usersize; /* Usercopy region size */
90
88 struct kmem_cache_node *node[MAX_NUMNODES]; 91 struct kmem_cache_node *node[MAX_NUMNODES];
89}; 92};
90 93
diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
index 0adae162dc8f..8ad99c47b19c 100644
--- a/include/linux/slub_def.h
+++ b/include/linux/slub_def.h
@@ -135,6 +135,9 @@ struct kmem_cache {
135 struct kasan_cache kasan_info; 135 struct kasan_cache kasan_info;
136#endif 136#endif
137 137
138 size_t useroffset; /* Usercopy region offset */
139 size_t usersize; /* Usercopy region size */
140
138 struct kmem_cache_node *node[MAX_NUMNODES]; 141 struct kmem_cache_node *node[MAX_NUMNODES];
139}; 142};
140 143
diff --git a/include/linux/stddef.h b/include/linux/stddef.h
index 2181719fd907..998a4ba28eba 100644
--- a/include/linux/stddef.h
+++ b/include/linux/stddef.h
@@ -20,12 +20,20 @@ enum {
20#endif 20#endif
21 21
22/** 22/**
23 * sizeof_field(TYPE, MEMBER)
24 *
25 * @TYPE: The structure containing the field of interest
26 * @MEMBER: The field to return the size of
27 */
28#define sizeof_field(TYPE, MEMBER) sizeof((((TYPE *)0)->MEMBER))
29
30/**
23 * offsetofend(TYPE, MEMBER) 31 * offsetofend(TYPE, MEMBER)
24 * 32 *
25 * @TYPE: The type of the structure 33 * @TYPE: The type of the structure
26 * @MEMBER: The member within the structure to get the end offset of 34 * @MEMBER: The member within the structure to get the end offset of
27 */ 35 */
28#define offsetofend(TYPE, MEMBER) \ 36#define offsetofend(TYPE, MEMBER) \
29 (offsetof(TYPE, MEMBER) + sizeof(((TYPE *)0)->MEMBER)) 37 (offsetof(TYPE, MEMBER) + sizeof_field(TYPE, MEMBER))
30 38
31#endif 39#endif
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 251e655d407f..efe79c1cdd47 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -273,4 +273,12 @@ extern long strncpy_from_unsafe(char *dst, const void *unsafe_addr, long count);
273#define unsafe_put_user(x, ptr, err) do { if (unlikely(__put_user(x, ptr))) goto err; } while (0) 273#define unsafe_put_user(x, ptr, err) do { if (unlikely(__put_user(x, ptr))) goto err; } while (0)
274#endif 274#endif
275 275
276#ifdef CONFIG_HARDENED_USERCOPY
277void usercopy_warn(const char *name, const char *detail, bool to_user,
278 unsigned long offset, unsigned long len);
279void __noreturn usercopy_abort(const char *name, const char *detail,
280 bool to_user, unsigned long offset,
281 unsigned long len);
282#endif
283
276#endif /* __LINUX_UACCESS_H__ */ 284#endif /* __LINUX_UACCESS_H__ */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 02369e379d35..03e92dda1813 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -203,12 +203,17 @@ struct sctp_sock {
203 /* Flags controlling Heartbeat, SACK delay, and Path MTU Discovery. */ 203 /* Flags controlling Heartbeat, SACK delay, and Path MTU Discovery. */
204 __u32 param_flags; 204 __u32 param_flags;
205 205
206 struct sctp_initmsg initmsg;
207 struct sctp_rtoinfo rtoinfo; 206 struct sctp_rtoinfo rtoinfo;
208 struct sctp_paddrparams paddrparam; 207 struct sctp_paddrparams paddrparam;
209 struct sctp_event_subscribe subscribe;
210 struct sctp_assocparams assocparams; 208 struct sctp_assocparams assocparams;
211 209
210 /*
211 * These two structures must be grouped together for the usercopy
212 * whitelist region.
213 */
214 struct sctp_event_subscribe subscribe;
215 struct sctp_initmsg initmsg;
216
212 int user_frag; 217 int user_frag;
213 218
214 __u32 autoclose; 219 __u32 autoclose;
diff --git a/include/net/sock.h b/include/net/sock.h
index 63731289186a..169c92afcafa 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1109,6 +1109,8 @@ struct proto {
1109 struct kmem_cache *slab; 1109 struct kmem_cache *slab;
1110 unsigned int obj_size; 1110 unsigned int obj_size;
1111 slab_flags_t slab_flags; 1111 slab_flags_t slab_flags;
1112 size_t useroffset; /* Usercopy region offset */
1113 size_t usersize; /* Usercopy region size */
1112 1114
1113 struct percpu_counter *orphan_count; 1115 struct percpu_counter *orphan_count;
1114 1116
diff --git a/kernel/fork.c b/kernel/fork.c
index 5e6cf0dd031c..5c372c954f3b 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -283,8 +283,9 @@ static void free_thread_stack(struct task_struct *tsk)
283 283
284void thread_stack_cache_init(void) 284void thread_stack_cache_init(void)
285{ 285{
286 thread_stack_cache = kmem_cache_create("thread_stack", THREAD_SIZE, 286 thread_stack_cache = kmem_cache_create_usercopy("thread_stack",
287 THREAD_SIZE, 0, NULL); 287 THREAD_SIZE, THREAD_SIZE, 0, 0,
288 THREAD_SIZE, NULL);
288 BUG_ON(thread_stack_cache == NULL); 289 BUG_ON(thread_stack_cache == NULL);
289} 290}
290# endif 291# endif
@@ -693,6 +694,21 @@ static void set_max_threads(unsigned int max_threads_suggested)
693int arch_task_struct_size __read_mostly; 694int arch_task_struct_size __read_mostly;
694#endif 695#endif
695 696
697static void task_struct_whitelist(unsigned long *offset, unsigned long *size)
698{
699 /* Fetch thread_struct whitelist for the architecture. */
700 arch_thread_struct_whitelist(offset, size);
701
702 /*
703 * Handle zero-sized whitelist or empty thread_struct, otherwise
704 * adjust offset to position of thread_struct in task_struct.
705 */
706 if (unlikely(*size == 0))
707 *offset = 0;
708 else
709 *offset += offsetof(struct task_struct, thread);
710}
711
696void __init fork_init(void) 712void __init fork_init(void)
697{ 713{
698 int i; 714 int i;
@@ -701,11 +717,14 @@ void __init fork_init(void)
701#define ARCH_MIN_TASKALIGN 0 717#define ARCH_MIN_TASKALIGN 0
702#endif 718#endif
703 int align = max_t(int, L1_CACHE_BYTES, ARCH_MIN_TASKALIGN); 719 int align = max_t(int, L1_CACHE_BYTES, ARCH_MIN_TASKALIGN);
720 unsigned long useroffset, usersize;
704 721
705 /* create a slab on which task_structs can be allocated */ 722 /* create a slab on which task_structs can be allocated */
706 task_struct_cachep = kmem_cache_create("task_struct", 723 task_struct_whitelist(&useroffset, &usersize);
724 task_struct_cachep = kmem_cache_create_usercopy("task_struct",
707 arch_task_struct_size, align, 725 arch_task_struct_size, align,
708 SLAB_PANIC|SLAB_ACCOUNT, NULL); 726 SLAB_PANIC|SLAB_ACCOUNT,
727 useroffset, usersize, NULL);
709#endif 728#endif
710 729
711 /* do the arch specific task caches init */ 730 /* do the arch specific task caches init */
@@ -2248,9 +2267,11 @@ void __init proc_caches_init(void)
2248 * maximum number of CPU's we can ever have. The cpumask_allocation 2267 * maximum number of CPU's we can ever have. The cpumask_allocation
2249 * is at the end of the structure, exactly for that reason. 2268 * is at the end of the structure, exactly for that reason.
2250 */ 2269 */
2251 mm_cachep = kmem_cache_create("mm_struct", 2270 mm_cachep = kmem_cache_create_usercopy("mm_struct",
2252 sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN, 2271 sizeof(struct mm_struct), ARCH_MIN_MMSTRUCT_ALIGN,
2253 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, 2272 SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT,
2273 offsetof(struct mm_struct, saved_auxv),
2274 sizeof_field(struct mm_struct, saved_auxv),
2254 NULL); 2275 NULL);
2255 vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT); 2276 vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT);
2256 mmap_init(); 2277 mmap_init();
diff --git a/mm/slab.c b/mm/slab.c
index 226906294183..cd86f15071ad 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -1281,7 +1281,7 @@ void __init kmem_cache_init(void)
1281 create_boot_cache(kmem_cache, "kmem_cache", 1281 create_boot_cache(kmem_cache, "kmem_cache",
1282 offsetof(struct kmem_cache, node) + 1282 offsetof(struct kmem_cache, node) +
1283 nr_node_ids * sizeof(struct kmem_cache_node *), 1283 nr_node_ids * sizeof(struct kmem_cache_node *),
1284 SLAB_HWCACHE_ALIGN); 1284 SLAB_HWCACHE_ALIGN, 0, 0);
1285 list_add(&kmem_cache->list, &slab_caches); 1285 list_add(&kmem_cache->list, &slab_caches);
1286 slab_state = PARTIAL; 1286 slab_state = PARTIAL;
1287 1287
@@ -1291,7 +1291,8 @@ void __init kmem_cache_init(void)
1291 */ 1291 */
1292 kmalloc_caches[INDEX_NODE] = create_kmalloc_cache( 1292 kmalloc_caches[INDEX_NODE] = create_kmalloc_cache(
1293 kmalloc_info[INDEX_NODE].name, 1293 kmalloc_info[INDEX_NODE].name,
1294 kmalloc_size(INDEX_NODE), ARCH_KMALLOC_FLAGS); 1294 kmalloc_size(INDEX_NODE), ARCH_KMALLOC_FLAGS,
1295 0, kmalloc_size(INDEX_NODE));
1295 slab_state = PARTIAL_NODE; 1296 slab_state = PARTIAL_NODE;
1296 setup_kmalloc_cache_index_table(); 1297 setup_kmalloc_cache_index_table();
1297 1298
@@ -4385,13 +4386,15 @@ module_init(slab_proc_init);
4385 4386
4386#ifdef CONFIG_HARDENED_USERCOPY 4387#ifdef CONFIG_HARDENED_USERCOPY
4387/* 4388/*
4388 * Rejects objects that are incorrectly sized. 4389 * Rejects incorrectly sized objects and objects that are to be copied
4390 * to/from userspace but do not fall entirely within the containing slab
4391 * cache's usercopy region.
4389 * 4392 *
4390 * Returns NULL if check passes, otherwise const char * to name of cache 4393 * Returns NULL if check passes, otherwise const char * to name of cache
4391 * to indicate an error. 4394 * to indicate an error.
4392 */ 4395 */
4393const char *__check_heap_object(const void *ptr, unsigned long n, 4396void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
4394 struct page *page) 4397 bool to_user)
4395{ 4398{
4396 struct kmem_cache *cachep; 4399 struct kmem_cache *cachep;
4397 unsigned int objnr; 4400 unsigned int objnr;
@@ -4405,11 +4408,26 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
4405 /* Find offset within object. */ 4408 /* Find offset within object. */
4406 offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep); 4409 offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
4407 4410
4408 /* Allow address range falling entirely within object size. */ 4411 /* Allow address range falling entirely within usercopy region. */
4409 if (offset <= cachep->object_size && n <= cachep->object_size - offset) 4412 if (offset >= cachep->useroffset &&
4410 return NULL; 4413 offset - cachep->useroffset <= cachep->usersize &&
4414 n <= cachep->useroffset - offset + cachep->usersize)
4415 return;
4416
4417 /*
4418 * If the copy is still within the allocated object, produce
4419 * a warning instead of rejecting the copy. This is intended
4420 * to be a temporary method to find any missing usercopy
4421 * whitelists.
4422 */
4423 if (usercopy_fallback &&
4424 offset <= cachep->object_size &&
4425 n <= cachep->object_size - offset) {
4426 usercopy_warn("SLAB object", cachep->name, to_user, offset, n);
4427 return;
4428 }
4411 4429
4412 return cachep->name; 4430 usercopy_abort("SLAB object", cachep->name, to_user, offset, n);
4413} 4431}
4414#endif /* CONFIG_HARDENED_USERCOPY */ 4432#endif /* CONFIG_HARDENED_USERCOPY */
4415 4433
diff --git a/mm/slab.h b/mm/slab.h
index e8e2095a6185..51813236e773 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -22,6 +22,8 @@ struct kmem_cache {
22 unsigned int size; /* The aligned/padded/added on size */ 22 unsigned int size; /* The aligned/padded/added on size */
23 unsigned int align; /* Alignment as calculated */ 23 unsigned int align; /* Alignment as calculated */
24 slab_flags_t flags; /* Active flags on the slab */ 24 slab_flags_t flags; /* Active flags on the slab */
25 size_t useroffset; /* Usercopy region offset */
26 size_t usersize; /* Usercopy region size */
25 const char *name; /* Slab name for sysfs */ 27 const char *name; /* Slab name for sysfs */
26 int refcount; /* Use counter */ 28 int refcount; /* Use counter */
27 void (*ctor)(void *); /* Called on object slot creation */ 29 void (*ctor)(void *); /* Called on object slot creation */
@@ -92,9 +94,11 @@ struct kmem_cache *kmalloc_slab(size_t, gfp_t);
92int __kmem_cache_create(struct kmem_cache *, slab_flags_t flags); 94int __kmem_cache_create(struct kmem_cache *, slab_flags_t flags);
93 95
94extern struct kmem_cache *create_kmalloc_cache(const char *name, size_t size, 96extern struct kmem_cache *create_kmalloc_cache(const char *name, size_t size,
95 slab_flags_t flags); 97 slab_flags_t flags, size_t useroffset,
98 size_t usersize);
96extern void create_boot_cache(struct kmem_cache *, const char *name, 99extern void create_boot_cache(struct kmem_cache *, const char *name,
97 size_t size, slab_flags_t flags); 100 size_t size, slab_flags_t flags, size_t useroffset,
101 size_t usersize);
98 102
99int slab_unmergeable(struct kmem_cache *s); 103int slab_unmergeable(struct kmem_cache *s);
100struct kmem_cache *find_mergeable(size_t size, size_t align, 104struct kmem_cache *find_mergeable(size_t size, size_t align,
diff --git a/mm/slab_common.c b/mm/slab_common.c
index deeddf95cdcf..10f127b2de7c 100644
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -31,6 +31,14 @@ LIST_HEAD(slab_caches);
31DEFINE_MUTEX(slab_mutex); 31DEFINE_MUTEX(slab_mutex);
32struct kmem_cache *kmem_cache; 32struct kmem_cache *kmem_cache;
33 33
34#ifdef CONFIG_HARDENED_USERCOPY
35bool usercopy_fallback __ro_after_init =
36 IS_ENABLED(CONFIG_HARDENED_USERCOPY_FALLBACK);
37module_param(usercopy_fallback, bool, 0400);
38MODULE_PARM_DESC(usercopy_fallback,
39 "WARN instead of reject usercopy whitelist violations");
40#endif
41
34static LIST_HEAD(slab_caches_to_rcu_destroy); 42static LIST_HEAD(slab_caches_to_rcu_destroy);
35static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work); 43static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work);
36static DECLARE_WORK(slab_caches_to_rcu_destroy_work, 44static DECLARE_WORK(slab_caches_to_rcu_destroy_work,
@@ -310,6 +318,9 @@ int slab_unmergeable(struct kmem_cache *s)
310 if (s->ctor) 318 if (s->ctor)
311 return 1; 319 return 1;
312 320
321 if (s->usersize)
322 return 1;
323
313 /* 324 /*
314 * We may have set a slab to be unmergeable during bootstrap. 325 * We may have set a slab to be unmergeable during bootstrap.
315 */ 326 */
@@ -368,12 +379,16 @@ struct kmem_cache *find_mergeable(size_t size, size_t align,
368 379
369static struct kmem_cache *create_cache(const char *name, 380static struct kmem_cache *create_cache(const char *name,
370 size_t object_size, size_t size, size_t align, 381 size_t object_size, size_t size, size_t align,
371 slab_flags_t flags, void (*ctor)(void *), 382 slab_flags_t flags, size_t useroffset,
383 size_t usersize, void (*ctor)(void *),
372 struct mem_cgroup *memcg, struct kmem_cache *root_cache) 384 struct mem_cgroup *memcg, struct kmem_cache *root_cache)
373{ 385{
374 struct kmem_cache *s; 386 struct kmem_cache *s;
375 int err; 387 int err;
376 388
389 if (WARN_ON(useroffset + usersize > object_size))
390 useroffset = usersize = 0;
391
377 err = -ENOMEM; 392 err = -ENOMEM;
378 s = kmem_cache_zalloc(kmem_cache, GFP_KERNEL); 393 s = kmem_cache_zalloc(kmem_cache, GFP_KERNEL);
379 if (!s) 394 if (!s)
@@ -384,6 +399,8 @@ static struct kmem_cache *create_cache(const char *name,
384 s->size = size; 399 s->size = size;
385 s->align = align; 400 s->align = align;
386 s->ctor = ctor; 401 s->ctor = ctor;
402 s->useroffset = useroffset;
403 s->usersize = usersize;
387 404
388 err = init_memcg_params(s, memcg, root_cache); 405 err = init_memcg_params(s, memcg, root_cache);
389 if (err) 406 if (err)
@@ -408,11 +425,13 @@ out_free_cache:
408} 425}
409 426
410/* 427/*
411 * kmem_cache_create - Create a cache. 428 * kmem_cache_create_usercopy - Create a cache.
412 * @name: A string which is used in /proc/slabinfo to identify this cache. 429 * @name: A string which is used in /proc/slabinfo to identify this cache.
413 * @size: The size of objects to be created in this cache. 430 * @size: The size of objects to be created in this cache.
414 * @align: The required alignment for the objects. 431 * @align: The required alignment for the objects.
415 * @flags: SLAB flags 432 * @flags: SLAB flags
433 * @useroffset: Usercopy region offset
434 * @usersize: Usercopy region size
416 * @ctor: A constructor for the objects. 435 * @ctor: A constructor for the objects.
417 * 436 *
418 * Returns a ptr to the cache on success, NULL on failure. 437 * Returns a ptr to the cache on success, NULL on failure.
@@ -432,8 +451,9 @@ out_free_cache:
432 * as davem. 451 * as davem.
433 */ 452 */
434struct kmem_cache * 453struct kmem_cache *
435kmem_cache_create(const char *name, size_t size, size_t align, 454kmem_cache_create_usercopy(const char *name, size_t size, size_t align,
436 slab_flags_t flags, void (*ctor)(void *)) 455 slab_flags_t flags, size_t useroffset, size_t usersize,
456 void (*ctor)(void *))
437{ 457{
438 struct kmem_cache *s = NULL; 458 struct kmem_cache *s = NULL;
439 const char *cache_name; 459 const char *cache_name;
@@ -464,7 +484,13 @@ kmem_cache_create(const char *name, size_t size, size_t align,
464 */ 484 */
465 flags &= CACHE_CREATE_MASK; 485 flags &= CACHE_CREATE_MASK;
466 486
467 s = __kmem_cache_alias(name, size, align, flags, ctor); 487 /* Fail closed on bad usersize of useroffset values. */
488 if (WARN_ON(!usersize && useroffset) ||
489 WARN_ON(size < usersize || size - usersize < useroffset))
490 usersize = useroffset = 0;
491
492 if (!usersize)
493 s = __kmem_cache_alias(name, size, align, flags, ctor);
468 if (s) 494 if (s)
469 goto out_unlock; 495 goto out_unlock;
470 496
@@ -476,7 +502,7 @@ kmem_cache_create(const char *name, size_t size, size_t align,
476 502
477 s = create_cache(cache_name, size, size, 503 s = create_cache(cache_name, size, size,
478 calculate_alignment(flags, align, size), 504 calculate_alignment(flags, align, size),
479 flags, ctor, NULL, NULL); 505 flags, useroffset, usersize, ctor, NULL, NULL);
480 if (IS_ERR(s)) { 506 if (IS_ERR(s)) {
481 err = PTR_ERR(s); 507 err = PTR_ERR(s);
482 kfree_const(cache_name); 508 kfree_const(cache_name);
@@ -502,6 +528,15 @@ out_unlock:
502 } 528 }
503 return s; 529 return s;
504} 530}
531EXPORT_SYMBOL(kmem_cache_create_usercopy);
532
533struct kmem_cache *
534kmem_cache_create(const char *name, size_t size, size_t align,
535 slab_flags_t flags, void (*ctor)(void *))
536{
537 return kmem_cache_create_usercopy(name, size, align, flags, 0, 0,
538 ctor);
539}
505EXPORT_SYMBOL(kmem_cache_create); 540EXPORT_SYMBOL(kmem_cache_create);
506 541
507static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work) 542static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work)
@@ -614,6 +649,7 @@ void memcg_create_kmem_cache(struct mem_cgroup *memcg,
614 s = create_cache(cache_name, root_cache->object_size, 649 s = create_cache(cache_name, root_cache->object_size,
615 root_cache->size, root_cache->align, 650 root_cache->size, root_cache->align,
616 root_cache->flags & CACHE_CREATE_MASK, 651 root_cache->flags & CACHE_CREATE_MASK,
652 root_cache->useroffset, root_cache->usersize,
617 root_cache->ctor, memcg, root_cache); 653 root_cache->ctor, memcg, root_cache);
618 /* 654 /*
619 * If we could not create a memcg cache, do not complain, because 655 * If we could not create a memcg cache, do not complain, because
@@ -881,13 +917,15 @@ bool slab_is_available(void)
881#ifndef CONFIG_SLOB 917#ifndef CONFIG_SLOB
882/* Create a cache during boot when no slab services are available yet */ 918/* Create a cache during boot when no slab services are available yet */
883void __init create_boot_cache(struct kmem_cache *s, const char *name, size_t size, 919void __init create_boot_cache(struct kmem_cache *s, const char *name, size_t size,
884 slab_flags_t flags) 920 slab_flags_t flags, size_t useroffset, size_t usersize)
885{ 921{
886 int err; 922 int err;
887 923
888 s->name = name; 924 s->name = name;
889 s->size = s->object_size = size; 925 s->size = s->object_size = size;
890 s->align = calculate_alignment(flags, ARCH_KMALLOC_MINALIGN, size); 926 s->align = calculate_alignment(flags, ARCH_KMALLOC_MINALIGN, size);
927 s->useroffset = useroffset;
928 s->usersize = usersize;
891 929
892 slab_init_memcg_params(s); 930 slab_init_memcg_params(s);
893 931
@@ -901,14 +939,15 @@ void __init create_boot_cache(struct kmem_cache *s, const char *name, size_t siz
901} 939}
902 940
903struct kmem_cache *__init create_kmalloc_cache(const char *name, size_t size, 941struct kmem_cache *__init create_kmalloc_cache(const char *name, size_t size,
904 slab_flags_t flags) 942 slab_flags_t flags, size_t useroffset,
943 size_t usersize)
905{ 944{
906 struct kmem_cache *s = kmem_cache_zalloc(kmem_cache, GFP_NOWAIT); 945 struct kmem_cache *s = kmem_cache_zalloc(kmem_cache, GFP_NOWAIT);
907 946
908 if (!s) 947 if (!s)
909 panic("Out of memory when creating slab %s\n", name); 948 panic("Out of memory when creating slab %s\n", name);
910 949
911 create_boot_cache(s, name, size, flags); 950 create_boot_cache(s, name, size, flags, useroffset, usersize);
912 list_add(&s->list, &slab_caches); 951 list_add(&s->list, &slab_caches);
913 memcg_link_cache(s); 952 memcg_link_cache(s);
914 s->refcount = 1; 953 s->refcount = 1;
@@ -1062,7 +1101,8 @@ void __init setup_kmalloc_cache_index_table(void)
1062static void __init new_kmalloc_cache(int idx, slab_flags_t flags) 1101static void __init new_kmalloc_cache(int idx, slab_flags_t flags)
1063{ 1102{
1064 kmalloc_caches[idx] = create_kmalloc_cache(kmalloc_info[idx].name, 1103 kmalloc_caches[idx] = create_kmalloc_cache(kmalloc_info[idx].name,
1065 kmalloc_info[idx].size, flags); 1104 kmalloc_info[idx].size, flags, 0,
1105 kmalloc_info[idx].size);
1066} 1106}
1067 1107
1068/* 1108/*
@@ -1103,7 +1143,7 @@ void __init create_kmalloc_caches(slab_flags_t flags)
1103 1143
1104 BUG_ON(!n); 1144 BUG_ON(!n);
1105 kmalloc_dma_caches[i] = create_kmalloc_cache(n, 1145 kmalloc_dma_caches[i] = create_kmalloc_cache(n,
1106 size, SLAB_CACHE_DMA | flags); 1146 size, SLAB_CACHE_DMA | flags, 0, 0);
1107 } 1147 }
1108 } 1148 }
1109#endif 1149#endif
diff --git a/mm/slub.c b/mm/slub.c
index 693b7074bc53..cc71176c6eef 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -3813,13 +3813,15 @@ EXPORT_SYMBOL(__kmalloc_node);
3813 3813
3814#ifdef CONFIG_HARDENED_USERCOPY 3814#ifdef CONFIG_HARDENED_USERCOPY
3815/* 3815/*
3816 * Rejects objects that are incorrectly sized. 3816 * Rejects incorrectly sized objects and objects that are to be copied
3817 * to/from userspace but do not fall entirely within the containing slab
3818 * cache's usercopy region.
3817 * 3819 *
3818 * Returns NULL if check passes, otherwise const char * to name of cache 3820 * Returns NULL if check passes, otherwise const char * to name of cache
3819 * to indicate an error. 3821 * to indicate an error.
3820 */ 3822 */
3821const char *__check_heap_object(const void *ptr, unsigned long n, 3823void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
3822 struct page *page) 3824 bool to_user)
3823{ 3825{
3824 struct kmem_cache *s; 3826 struct kmem_cache *s;
3825 unsigned long offset; 3827 unsigned long offset;
@@ -3827,11 +3829,11 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
3827 3829
3828 /* Find object and usable object size. */ 3830 /* Find object and usable object size. */
3829 s = page->slab_cache; 3831 s = page->slab_cache;
3830 object_size = slab_ksize(s);
3831 3832
3832 /* Reject impossible pointers. */ 3833 /* Reject impossible pointers. */
3833 if (ptr < page_address(page)) 3834 if (ptr < page_address(page))
3834 return s->name; 3835 usercopy_abort("SLUB object not in SLUB page?!", NULL,
3836 to_user, 0, n);
3835 3837
3836 /* Find offset within object. */ 3838 /* Find offset within object. */
3837 offset = (ptr - page_address(page)) % s->size; 3839 offset = (ptr - page_address(page)) % s->size;
@@ -3839,15 +3841,31 @@ const char *__check_heap_object(const void *ptr, unsigned long n,
3839 /* Adjust for redzone and reject if within the redzone. */ 3841 /* Adjust for redzone and reject if within the redzone. */
3840 if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE) { 3842 if (kmem_cache_debug(s) && s->flags & SLAB_RED_ZONE) {
3841 if (offset < s->red_left_pad) 3843 if (offset < s->red_left_pad)
3842 return s->name; 3844 usercopy_abort("SLUB object in left red zone",
3845 s->name, to_user, offset, n);
3843 offset -= s->red_left_pad; 3846 offset -= s->red_left_pad;
3844 } 3847 }
3845 3848
3846 /* Allow address range falling entirely within object size. */ 3849 /* Allow address range falling entirely within usercopy region. */
3847 if (offset <= object_size && n <= object_size - offset) 3850 if (offset >= s->useroffset &&
3848 return NULL; 3851 offset - s->useroffset <= s->usersize &&
3852 n <= s->useroffset - offset + s->usersize)
3853 return;
3854
3855 /*
3856 * If the copy is still within the allocated object, produce
3857 * a warning instead of rejecting the copy. This is intended
3858 * to be a temporary method to find any missing usercopy
3859 * whitelists.
3860 */
3861 object_size = slab_ksize(s);
3862 if (usercopy_fallback &&
3863 offset <= object_size && n <= object_size - offset) {
3864 usercopy_warn("SLUB object", s->name, to_user, offset, n);
3865 return;
3866 }
3849 3867
3850 return s->name; 3868 usercopy_abort("SLUB object", s->name, to_user, offset, n);
3851} 3869}
3852#endif /* CONFIG_HARDENED_USERCOPY */ 3870#endif /* CONFIG_HARDENED_USERCOPY */
3853 3871
@@ -4181,7 +4199,7 @@ void __init kmem_cache_init(void)
4181 kmem_cache = &boot_kmem_cache; 4199 kmem_cache = &boot_kmem_cache;
4182 4200
4183 create_boot_cache(kmem_cache_node, "kmem_cache_node", 4201 create_boot_cache(kmem_cache_node, "kmem_cache_node",
4184 sizeof(struct kmem_cache_node), SLAB_HWCACHE_ALIGN); 4202 sizeof(struct kmem_cache_node), SLAB_HWCACHE_ALIGN, 0, 0);
4185 4203
4186 register_hotmemory_notifier(&slab_memory_callback_nb); 4204 register_hotmemory_notifier(&slab_memory_callback_nb);
4187 4205
@@ -4191,7 +4209,7 @@ void __init kmem_cache_init(void)
4191 create_boot_cache(kmem_cache, "kmem_cache", 4209 create_boot_cache(kmem_cache, "kmem_cache",
4192 offsetof(struct kmem_cache, node) + 4210 offsetof(struct kmem_cache, node) +
4193 nr_node_ids * sizeof(struct kmem_cache_node *), 4211 nr_node_ids * sizeof(struct kmem_cache_node *),
4194 SLAB_HWCACHE_ALIGN); 4212 SLAB_HWCACHE_ALIGN, 0, 0);
4195 4213
4196 kmem_cache = bootstrap(&boot_kmem_cache); 4214 kmem_cache = bootstrap(&boot_kmem_cache);
4197 4215
@@ -5061,6 +5079,12 @@ static ssize_t cache_dma_show(struct kmem_cache *s, char *buf)
5061SLAB_ATTR_RO(cache_dma); 5079SLAB_ATTR_RO(cache_dma);
5062#endif 5080#endif
5063 5081
5082static ssize_t usersize_show(struct kmem_cache *s, char *buf)
5083{
5084 return sprintf(buf, "%zu\n", s->usersize);
5085}
5086SLAB_ATTR_RO(usersize);
5087
5064static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf) 5088static ssize_t destroy_by_rcu_show(struct kmem_cache *s, char *buf)
5065{ 5089{
5066 return sprintf(buf, "%d\n", !!(s->flags & SLAB_TYPESAFE_BY_RCU)); 5090 return sprintf(buf, "%d\n", !!(s->flags & SLAB_TYPESAFE_BY_RCU));
@@ -5435,6 +5459,7 @@ static struct attribute *slab_attrs[] = {
5435#ifdef CONFIG_FAILSLAB 5459#ifdef CONFIG_FAILSLAB
5436 &failslab_attr.attr, 5460 &failslab_attr.attr,
5437#endif 5461#endif
5462 &usersize_attr.attr,
5438 5463
5439 NULL 5464 NULL
5440}; 5465};
diff --git a/mm/usercopy.c b/mm/usercopy.c
index a9852b24715d..e9e9325f7638 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -58,12 +58,40 @@ static noinline int check_stack_object(const void *obj, unsigned long len)
58 return GOOD_STACK; 58 return GOOD_STACK;
59} 59}
60 60
61static void report_usercopy(const void *ptr, unsigned long len, 61/*
62 bool to_user, const char *type) 62 * If these functions are reached, then CONFIG_HARDENED_USERCOPY has found
63 * an unexpected state during a copy_from_user() or copy_to_user() call.
64 * There are several checks being performed on the buffer by the
65 * __check_object_size() function. Normal stack buffer usage should never
66 * trip the checks, and kernel text addressing will always trip the check.
67 * For cache objects, it is checking that only the whitelisted range of
68 * bytes for a given cache is being accessed (via the cache's usersize and
69 * useroffset fields). To adjust a cache whitelist, use the usercopy-aware
70 * kmem_cache_create_usercopy() function to create the cache (and
71 * carefully audit the whitelist range).
72 */
73void usercopy_warn(const char *name, const char *detail, bool to_user,
74 unsigned long offset, unsigned long len)
75{
76 WARN_ONCE(1, "Bad or missing usercopy whitelist? Kernel memory %s attempt detected %s %s%s%s%s (offset %lu, size %lu)!\n",
77 to_user ? "exposure" : "overwrite",
78 to_user ? "from" : "to",
79 name ? : "unknown?!",
80 detail ? " '" : "", detail ? : "", detail ? "'" : "",
81 offset, len);
82}
83
84void __noreturn usercopy_abort(const char *name, const char *detail,
85 bool to_user, unsigned long offset,
86 unsigned long len)
63{ 87{
64 pr_emerg("kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n", 88 pr_emerg("Kernel memory %s attempt detected %s %s%s%s%s (offset %lu, size %lu)!\n",
65 to_user ? "exposure" : "overwrite", 89 to_user ? "exposure" : "overwrite",
66 to_user ? "from" : "to", ptr, type ? : "unknown", len); 90 to_user ? "from" : "to",
91 name ? : "unknown?!",
92 detail ? " '" : "", detail ? : "", detail ? "'" : "",
93 offset, len);
94
67 /* 95 /*
68 * For greater effect, it would be nice to do do_group_exit(), 96 * For greater effect, it would be nice to do do_group_exit(),
69 * but BUG() actually hooks all the lock-breaking and per-arch 97 * but BUG() actually hooks all the lock-breaking and per-arch
@@ -73,10 +101,10 @@ static void report_usercopy(const void *ptr, unsigned long len,
73} 101}
74 102
75/* Returns true if any portion of [ptr,ptr+n) over laps with [low,high). */ 103/* Returns true if any portion of [ptr,ptr+n) over laps with [low,high). */
76static bool overlaps(const void *ptr, unsigned long n, unsigned long low, 104static bool overlaps(const unsigned long ptr, unsigned long n,
77 unsigned long high) 105 unsigned long low, unsigned long high)
78{ 106{
79 unsigned long check_low = (uintptr_t)ptr; 107 const unsigned long check_low = ptr;
80 unsigned long check_high = check_low + n; 108 unsigned long check_high = check_low + n;
81 109
82 /* Does not overlap if entirely above or entirely below. */ 110 /* Does not overlap if entirely above or entirely below. */
@@ -87,15 +115,15 @@ static bool overlaps(const void *ptr, unsigned long n, unsigned long low,
87} 115}
88 116
89/* Is this address range in the kernel text area? */ 117/* Is this address range in the kernel text area? */
90static inline const char *check_kernel_text_object(const void *ptr, 118static inline void check_kernel_text_object(const unsigned long ptr,
91 unsigned long n) 119 unsigned long n, bool to_user)
92{ 120{
93 unsigned long textlow = (unsigned long)_stext; 121 unsigned long textlow = (unsigned long)_stext;
94 unsigned long texthigh = (unsigned long)_etext; 122 unsigned long texthigh = (unsigned long)_etext;
95 unsigned long textlow_linear, texthigh_linear; 123 unsigned long textlow_linear, texthigh_linear;
96 124
97 if (overlaps(ptr, n, textlow, texthigh)) 125 if (overlaps(ptr, n, textlow, texthigh))
98 return "<kernel text>"; 126 usercopy_abort("kernel text", NULL, to_user, ptr - textlow, n);
99 127
100 /* 128 /*
101 * Some architectures have virtual memory mappings with a secondary 129 * Some architectures have virtual memory mappings with a secondary
@@ -108,32 +136,30 @@ static inline const char *check_kernel_text_object(const void *ptr,
108 textlow_linear = (unsigned long)lm_alias(textlow); 136 textlow_linear = (unsigned long)lm_alias(textlow);
109 /* No different mapping: we're done. */ 137 /* No different mapping: we're done. */
110 if (textlow_linear == textlow) 138 if (textlow_linear == textlow)
111 return NULL; 139 return;
112 140
113 /* Check the secondary mapping... */ 141 /* Check the secondary mapping... */
114 texthigh_linear = (unsigned long)lm_alias(texthigh); 142 texthigh_linear = (unsigned long)lm_alias(texthigh);
115 if (overlaps(ptr, n, textlow_linear, texthigh_linear)) 143 if (overlaps(ptr, n, textlow_linear, texthigh_linear))
116 return "<linear kernel text>"; 144 usercopy_abort("linear kernel text", NULL, to_user,
117 145 ptr - textlow_linear, n);
118 return NULL;
119} 146}
120 147
121static inline const char *check_bogus_address(const void *ptr, unsigned long n) 148static inline void check_bogus_address(const unsigned long ptr, unsigned long n,
149 bool to_user)
122{ 150{
123 /* Reject if object wraps past end of memory. */ 151 /* Reject if object wraps past end of memory. */
124 if ((unsigned long)ptr + n < (unsigned long)ptr) 152 if (ptr + n < ptr)
125 return "<wrapped address>"; 153 usercopy_abort("wrapped address", NULL, to_user, 0, ptr + n);
126 154
127 /* Reject if NULL or ZERO-allocation. */ 155 /* Reject if NULL or ZERO-allocation. */
128 if (ZERO_OR_NULL_PTR(ptr)) 156 if (ZERO_OR_NULL_PTR(ptr))
129 return "<null>"; 157 usercopy_abort("null address", NULL, to_user, ptr, n);
130
131 return NULL;
132} 158}
133 159
134/* Checks for allocs that are marked in some way as spanning multiple pages. */ 160/* Checks for allocs that are marked in some way as spanning multiple pages. */
135static inline const char *check_page_span(const void *ptr, unsigned long n, 161static inline void check_page_span(const void *ptr, unsigned long n,
136 struct page *page, bool to_user) 162 struct page *page, bool to_user)
137{ 163{
138#ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN 164#ifdef CONFIG_HARDENED_USERCOPY_PAGESPAN
139 const void *end = ptr + n - 1; 165 const void *end = ptr + n - 1;
@@ -150,28 +176,28 @@ static inline const char *check_page_span(const void *ptr, unsigned long n,
150 if (ptr >= (const void *)__start_rodata && 176 if (ptr >= (const void *)__start_rodata &&
151 end <= (const void *)__end_rodata) { 177 end <= (const void *)__end_rodata) {
152 if (!to_user) 178 if (!to_user)
153 return "<rodata>"; 179 usercopy_abort("rodata", NULL, to_user, 0, n);
154 return NULL; 180 return;
155 } 181 }
156 182
157 /* Allow kernel data region (if not marked as Reserved). */ 183 /* Allow kernel data region (if not marked as Reserved). */
158 if (ptr >= (const void *)_sdata && end <= (const void *)_edata) 184 if (ptr >= (const void *)_sdata && end <= (const void *)_edata)
159 return NULL; 185 return;
160 186
161 /* Allow kernel bss region (if not marked as Reserved). */ 187 /* Allow kernel bss region (if not marked as Reserved). */
162 if (ptr >= (const void *)__bss_start && 188 if (ptr >= (const void *)__bss_start &&
163 end <= (const void *)__bss_stop) 189 end <= (const void *)__bss_stop)
164 return NULL; 190 return;
165 191
166 /* Is the object wholly within one base page? */ 192 /* Is the object wholly within one base page? */
167 if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) == 193 if (likely(((unsigned long)ptr & (unsigned long)PAGE_MASK) ==
168 ((unsigned long)end & (unsigned long)PAGE_MASK))) 194 ((unsigned long)end & (unsigned long)PAGE_MASK)))
169 return NULL; 195 return;
170 196
171 /* Allow if fully inside the same compound (__GFP_COMP) page. */ 197 /* Allow if fully inside the same compound (__GFP_COMP) page. */
172 endpage = virt_to_head_page(end); 198 endpage = virt_to_head_page(end);
173 if (likely(endpage == page)) 199 if (likely(endpage == page))
174 return NULL; 200 return;
175 201
176 /* 202 /*
177 * Reject if range is entirely either Reserved (i.e. special or 203 * Reject if range is entirely either Reserved (i.e. special or
@@ -181,36 +207,37 @@ static inline const char *check_page_span(const void *ptr, unsigned long n,
181 is_reserved = PageReserved(page); 207 is_reserved = PageReserved(page);
182 is_cma = is_migrate_cma_page(page); 208 is_cma = is_migrate_cma_page(page);
183 if (!is_reserved && !is_cma) 209 if (!is_reserved && !is_cma)
184 return "<spans multiple pages>"; 210 usercopy_abort("spans multiple pages", NULL, to_user, 0, n);
185 211
186 for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) { 212 for (ptr += PAGE_SIZE; ptr <= end; ptr += PAGE_SIZE) {
187 page = virt_to_head_page(ptr); 213 page = virt_to_head_page(ptr);
188 if (is_reserved && !PageReserved(page)) 214 if (is_reserved && !PageReserved(page))
189 return "<spans Reserved and non-Reserved pages>"; 215 usercopy_abort("spans Reserved and non-Reserved pages",
216 NULL, to_user, 0, n);
190 if (is_cma && !is_migrate_cma_page(page)) 217 if (is_cma && !is_migrate_cma_page(page))
191 return "<spans CMA and non-CMA pages>"; 218 usercopy_abort("spans CMA and non-CMA pages", NULL,
219 to_user, 0, n);
192 } 220 }
193#endif 221#endif
194
195 return NULL;
196} 222}
197 223
198static inline const char *check_heap_object(const void *ptr, unsigned long n, 224static inline void check_heap_object(const void *ptr, unsigned long n,
199 bool to_user) 225 bool to_user)
200{ 226{
201 struct page *page; 227 struct page *page;
202 228
203 if (!virt_addr_valid(ptr)) 229 if (!virt_addr_valid(ptr))
204 return NULL; 230 return;
205 231
206 page = virt_to_head_page(ptr); 232 page = virt_to_head_page(ptr);
207 233
208 /* Check slab allocator for flags and size. */ 234 if (PageSlab(page)) {
209 if (PageSlab(page)) 235 /* Check slab allocator for flags and size. */
210 return __check_heap_object(ptr, n, page); 236 __check_heap_object(ptr, n, page, to_user);
211 237 } else {
212 /* Verify object does not incorrectly span multiple pages. */ 238 /* Verify object does not incorrectly span multiple pages. */
213 return check_page_span(ptr, n, page, to_user); 239 check_page_span(ptr, n, page, to_user);
240 }
214} 241}
215 242
216/* 243/*
@@ -221,21 +248,15 @@ static inline const char *check_heap_object(const void *ptr, unsigned long n,
221 */ 248 */
222void __check_object_size(const void *ptr, unsigned long n, bool to_user) 249void __check_object_size(const void *ptr, unsigned long n, bool to_user)
223{ 250{
224 const char *err;
225
226 /* Skip all tests if size is zero. */ 251 /* Skip all tests if size is zero. */
227 if (!n) 252 if (!n)
228 return; 253 return;
229 254
230 /* Check for invalid addresses. */ 255 /* Check for invalid addresses. */
231 err = check_bogus_address(ptr, n); 256 check_bogus_address((const unsigned long)ptr, n, to_user);
232 if (err)
233 goto report;
234 257
235 /* Check for bad heap object. */ 258 /* Check for bad heap object. */
236 err = check_heap_object(ptr, n, to_user); 259 check_heap_object(ptr, n, to_user);
237 if (err)
238 goto report;
239 260
240 /* Check for bad stack object. */ 261 /* Check for bad stack object. */
241 switch (check_stack_object(ptr, n)) { 262 switch (check_stack_object(ptr, n)) {
@@ -251,16 +272,10 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
251 */ 272 */
252 return; 273 return;
253 default: 274 default:
254 err = "<process stack>"; 275 usercopy_abort("process stack", NULL, to_user, 0, n);
255 goto report;
256 } 276 }
257 277
258 /* Check for object in kernel to avoid text exposure. */ 278 /* Check for object in kernel to avoid text exposure. */
259 err = check_kernel_text_object(ptr, n); 279 check_kernel_text_object((const unsigned long)ptr, n, to_user);
260 if (!err)
261 return;
262
263report:
264 report_usercopy(ptr, n, to_user, err);
265} 280}
266EXPORT_SYMBOL(__check_object_size); 281EXPORT_SYMBOL(__check_object_size);
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 64048cec41e0..b109445a1df9 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -1032,6 +1032,8 @@ static int caif_create(struct net *net, struct socket *sock, int protocol,
1032 static struct proto prot = {.name = "PF_CAIF", 1032 static struct proto prot = {.name = "PF_CAIF",
1033 .owner = THIS_MODULE, 1033 .owner = THIS_MODULE,
1034 .obj_size = sizeof(struct caifsock), 1034 .obj_size = sizeof(struct caifsock),
1035 .useroffset = offsetof(struct caifsock, conn_req.param),
1036 .usersize = sizeof_field(struct caifsock, conn_req.param)
1035 }; 1037 };
1036 1038
1037 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_NET_ADMIN)) 1039 if (!capable(CAP_SYS_ADMIN) && !capable(CAP_NET_ADMIN))
diff --git a/net/core/sock.c b/net/core/sock.c
index e50e7b3f2223..b026e1717df4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -3191,8 +3191,10 @@ static int req_prot_init(const struct proto *prot)
3191int proto_register(struct proto *prot, int alloc_slab) 3191int proto_register(struct proto *prot, int alloc_slab)
3192{ 3192{
3193 if (alloc_slab) { 3193 if (alloc_slab) {
3194 prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0, 3194 prot->slab = kmem_cache_create_usercopy(prot->name,
3195 prot->obj_size, 0,
3195 SLAB_HWCACHE_ALIGN | prot->slab_flags, 3196 SLAB_HWCACHE_ALIGN | prot->slab_flags,
3197 prot->useroffset, prot->usersize,
3196 NULL); 3198 NULL);
3197 3199
3198 if (prot->slab == NULL) { 3200 if (prot->slab == NULL) {
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 7c509697ebc7..9b367fc48d7d 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -990,6 +990,8 @@ struct proto raw_prot = {
990 .hash = raw_hash_sk, 990 .hash = raw_hash_sk,
991 .unhash = raw_unhash_sk, 991 .unhash = raw_unhash_sk,
992 .obj_size = sizeof(struct raw_sock), 992 .obj_size = sizeof(struct raw_sock),
993 .useroffset = offsetof(struct raw_sock, filter),
994 .usersize = sizeof_field(struct raw_sock, filter),
993 .h.raw_hash = &raw_v4_hashinfo, 995 .h.raw_hash = &raw_v4_hashinfo,
994#ifdef CONFIG_COMPAT 996#ifdef CONFIG_COMPAT
995 .compat_setsockopt = compat_raw_setsockopt, 997 .compat_setsockopt = compat_raw_setsockopt,
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ddda7eb3c623..4c25339b1984 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1272,6 +1272,8 @@ struct proto rawv6_prot = {
1272 .hash = raw_hash_sk, 1272 .hash = raw_hash_sk,
1273 .unhash = raw_unhash_sk, 1273 .unhash = raw_unhash_sk,
1274 .obj_size = sizeof(struct raw6_sock), 1274 .obj_size = sizeof(struct raw6_sock),
1275 .useroffset = offsetof(struct raw6_sock, filter),
1276 .usersize = sizeof_field(struct raw6_sock, filter),
1275 .h.raw_hash = &raw_v6_hashinfo, 1277 .h.raw_hash = &raw_v6_hashinfo,
1276#ifdef CONFIG_COMPAT 1278#ifdef CONFIG_COMPAT
1277 .compat_setsockopt = compat_rawv6_setsockopt, 1279 .compat_setsockopt = compat_rawv6_setsockopt,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 356e387f82e7..ebb8cb9eb0bd 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5053,7 +5053,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv
5053 len = sizeof(int); 5053 len = sizeof(int);
5054 if (put_user(len, optlen)) 5054 if (put_user(len, optlen))
5055 return -EFAULT; 5055 return -EFAULT;
5056 if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len)) 5056 if (put_user(sctp_sk(sk)->autoclose, (int __user *)optval))
5057 return -EFAULT; 5057 return -EFAULT;
5058 return 0; 5058 return 0;
5059} 5059}
@@ -8552,6 +8552,10 @@ struct proto sctp_prot = {
8552 .unhash = sctp_unhash, 8552 .unhash = sctp_unhash,
8553 .get_port = sctp_get_port, 8553 .get_port = sctp_get_port,
8554 .obj_size = sizeof(struct sctp_sock), 8554 .obj_size = sizeof(struct sctp_sock),
8555 .useroffset = offsetof(struct sctp_sock, subscribe),
8556 .usersize = offsetof(struct sctp_sock, initmsg) -
8557 offsetof(struct sctp_sock, subscribe) +
8558 sizeof_field(struct sctp_sock, initmsg),
8555 .sysctl_mem = sysctl_sctp_mem, 8559 .sysctl_mem = sysctl_sctp_mem,
8556 .sysctl_rmem = sysctl_sctp_rmem, 8560 .sysctl_rmem = sysctl_sctp_rmem,
8557 .sysctl_wmem = sysctl_sctp_wmem, 8561 .sysctl_wmem = sysctl_sctp_wmem,
@@ -8591,6 +8595,10 @@ struct proto sctpv6_prot = {
8591 .unhash = sctp_unhash, 8595 .unhash = sctp_unhash,
8592 .get_port = sctp_get_port, 8596 .get_port = sctp_get_port,
8593 .obj_size = sizeof(struct sctp6_sock), 8597 .obj_size = sizeof(struct sctp6_sock),
8598 .useroffset = offsetof(struct sctp6_sock, sctp.subscribe),
8599 .usersize = offsetof(struct sctp6_sock, sctp.initmsg) -
8600 offsetof(struct sctp6_sock, sctp.subscribe) +
8601 sizeof_field(struct sctp6_sock, sctp.initmsg),
8594 .sysctl_mem = sysctl_sctp_mem, 8602 .sysctl_mem = sysctl_sctp_mem,
8595 .sysctl_rmem = sysctl_sctp_rmem, 8603 .sysctl_rmem = sysctl_sctp_rmem,
8596 .sysctl_wmem = sysctl_sctp_wmem, 8604 .sysctl_wmem = sysctl_sctp_wmem,
diff --git a/security/Kconfig b/security/Kconfig
index 3709db95027f..c4302067a3ad 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -164,6 +164,20 @@ config HARDENED_USERCOPY
164 or are part of the kernel text. This kills entire classes 164 or are part of the kernel text. This kills entire classes
165 of heap overflow exploits and similar kernel memory exposures. 165 of heap overflow exploits and similar kernel memory exposures.
166 166
167config HARDENED_USERCOPY_FALLBACK
168 bool "Allow usercopy whitelist violations to fallback to object size"
169 depends on HARDENED_USERCOPY
170 default y
171 help
172 This is a temporary option that allows missing usercopy whitelists
173 to be discovered via a WARN() to the kernel log, instead of
174 rejecting the copy, falling back to non-whitelisted hardened
175 usercopy that checks the slab allocation size instead of the
176 whitelist size. This option will be removed once it seems like
177 all missing usercopy whitelists have been identified and fixed.
178 Booting with "slab_common.usercopy_fallback=Y/N" can change
179 this setting.
180
167config HARDENED_USERCOPY_PAGESPAN 181config HARDENED_USERCOPY_PAGESPAN
168 bool "Refuse to copy allocations that span multiple pages" 182 bool "Refuse to copy allocations that span multiple pages"
169 depends on HARDENED_USERCOPY 183 depends on HARDENED_USERCOPY
diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index f40d46e24bcc..524becf88e04 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -138,6 +138,7 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func,
138 "__reiserfs_panic", 138 "__reiserfs_panic",
139 "lbug_with_loc", 139 "lbug_with_loc",
140 "fortify_panic", 140 "fortify_panic",
141 "usercopy_abort",
141 }; 142 };
142 143
143 if (func->bind == STB_WEAK) 144 if (func->bind == STB_WEAK)
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 35db929f92f0..001085b611ad 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -4019,8 +4019,12 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
4019 /* A kmem cache lets us meet the alignment requirements of fx_save. */ 4019 /* A kmem cache lets us meet the alignment requirements of fx_save. */
4020 if (!vcpu_align) 4020 if (!vcpu_align)
4021 vcpu_align = __alignof__(struct kvm_vcpu); 4021 vcpu_align = __alignof__(struct kvm_vcpu);
4022 kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align, 4022 kvm_vcpu_cache =
4023 SLAB_ACCOUNT, NULL); 4023 kmem_cache_create_usercopy("kvm_vcpu", vcpu_size, vcpu_align,
4024 SLAB_ACCOUNT,
4025 offsetof(struct kvm_vcpu, arch),
4026 sizeof_field(struct kvm_vcpu, arch),
4027 NULL);
4024 if (!kvm_vcpu_cache) { 4028 if (!kvm_vcpu_cache) {
4025 r = -ENOMEM; 4029 r = -ENOMEM;
4026 goto out_free_3; 4030 goto out_free_3;
generated by cgit v1.2.2 (git 2.25.0) at 2025-09-10 16:29:52 -0400