Messages in this thread |  | | Date | Sun, 3 Jul 2011 23:24:42 +0400 | | From | Vasiliy Kulikov <> | | Subject | Re: [kernel-hardening] Re: [RFC v1] implement SL*B and stack usercopy runtime checks |
| |
On Sun, Jul 03, 2011 at 12:10 -0700, Linus Torvalds wrote: > On Sun, Jul 3, 2011 at 11:57 AM, Vasiliy Kulikov <segoon@openwall.com> wrote: > >> If you seriously clean it up (that at a minimum includes things like > >> making it configurable using some pretty helper function that just > >> compiles away for all the normal cases, > > > > Hm, it is not as simple as it looks at the first glance - even if the > > object size is known at the compile time (__compiletime_object_size), it > > might be a field of a structure, which crosses the slab object > > boundaries because of an overflow. > > No, I was more talking about having something like > > #ifdef CONFIG_EXPENSIVE_CHECK_USERCOPY > extern int check_user_copy(const void *kptr, unsigned long size); > #else > static inline int check_user_copy(const void *kptr, unsigned long size) > { return 0; } > #endif
Sure, will do. This is what I mean by kernel_access_ok() as it is a weak equivalent of access_ok(), check_user_copy() is a bit confusing name IMO.
> so that the actual user-copy routines end up being clean and not have > #ifdefs in them or any implementation details like what you check > (stack, slab, page cache - whatever) > > If you can also make it automatically not generate any code for cases > that are somehow obviously safe, then that's an added bonus.
OK, then let's stop on "checks for overflows" and remove the check if __compiletime_object_size() says something or length is constant. It should remove most of the checks in fast pathes.
> But my concern is that performance is a real issue, and the strict > user-copy checking sounds like mostly a "let's enable this for testing > kernels when chasing some particular issue" feature, the way > DEBUG_PAGEALLOC is.
I will measure the perfomance penalty tomorrow.
Btw, if the perfomance will be acceptable, what do you think about logging/reacting on the spotted overflows?
Thanks,
-- Vasiliy Kulikov http://www.openwall.com - bringing security into open computing environments
|  |