lkml.org 
[lkml]   [2016]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v4 09/12] sparc/uaccess: Enable hardened usercopy
    Date
    Enables CONFIG_HARDENED_USERCOPY checks on sparc.

    Based on code from PaX and grsecurity.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    arch/sparc/Kconfig | 1 +
    arch/sparc/include/asm/uaccess_32.h | 14 ++++++++++----
    arch/sparc/include/asm/uaccess_64.h | 11 +++++++++--
    3 files changed, 20 insertions(+), 6 deletions(-)

    diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
    index 546293d9e6c5..59b09600dd32 100644
    --- a/arch/sparc/Kconfig
    +++ b/arch/sparc/Kconfig
    @@ -43,6 +43,7 @@ config SPARC
    select OLD_SIGSUSPEND
    select ARCH_HAS_SG_CHAIN
    select CPU_NO_EFFICIENT_FFS
    + select HAVE_ARCH_HARDENED_USERCOPY

    config SPARC32
    def_bool !64BIT
    diff --git a/arch/sparc/include/asm/uaccess_32.h b/arch/sparc/include/asm/uaccess_32.h
    index 57aca2792d29..341a5a133f48 100644
    --- a/arch/sparc/include/asm/uaccess_32.h
    +++ b/arch/sparc/include/asm/uaccess_32.h
    @@ -248,22 +248,28 @@ unsigned long __copy_user(void __user *to, const void __user *from, unsigned lon

    static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
    {
    - if (n && __access_ok((unsigned long) to, n))
    + if (n && __access_ok((unsigned long) to, n)) {
    + if (!__builtin_constant_p(n))
    + check_object_size(from, n, true);
    return __copy_user(to, (__force void __user *) from, n);
    - else
    + } else
    return n;
    }

    static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
    {
    + if (!__builtin_constant_p(n))
    + check_object_size(from, n, true);
    return __copy_user(to, (__force void __user *) from, n);
    }

    static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
    {
    - if (n && __access_ok((unsigned long) from, n))
    + if (n && __access_ok((unsigned long) from, n)) {
    + if (!__builtin_constant_p(n))
    + check_object_size(to, n, false);
    return __copy_user((__force void __user *) to, from, n);
    - else
    + } else
    return n;
    }

    diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
    index e9a51d64974d..8bda94fab8e8 100644
    --- a/arch/sparc/include/asm/uaccess_64.h
    +++ b/arch/sparc/include/asm/uaccess_64.h
    @@ -210,8 +210,12 @@ unsigned long copy_from_user_fixup(void *to, const void __user *from,
    static inline unsigned long __must_check
    copy_from_user(void *to, const void __user *from, unsigned long size)
    {
    - unsigned long ret = ___copy_from_user(to, from, size);
    + unsigned long ret;

    + if (!__builtin_constant_p(size))
    + check_object_size(to, size, false);
    +
    + ret = ___copy_from_user(to, from, size);
    if (unlikely(ret))
    ret = copy_from_user_fixup(to, from, size);

    @@ -227,8 +231,11 @@ unsigned long copy_to_user_fixup(void __user *to, const void *from,
    static inline unsigned long __must_check
    copy_to_user(void __user *to, const void *from, unsigned long size)
    {
    - unsigned long ret = ___copy_to_user(to, from, size);
    + unsigned long ret;

    + if (!__builtin_constant_p(size))
    + check_object_size(from, size, true);
    + ret = ___copy_to_user(to, from, size);
    if (unlikely(ret))
    ret = copy_to_user_fixup(to, from, size);
    return ret;
    --
    2.7.4
    \
     
     \ /
      Last update: 2016-07-20 23:21    [W:4.073 / U:0.468 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site