Re: [kernel-hardening] [RFC PATCH] lib: Harden csum_partial_copy_from_user

[Mark Rutland <mark.rutland@arm.com>]

Hi Vaishali,

On Thu, Nov 03, 2016 at 07:44:35AM +0530, Vaishali Thakkar wrote:
> On Thursday 03 November 2016 03:29 AM, Kees Cook wrote:
> > On Wed, Nov 2, 2016 at 2:44 PM, Mark Rutland <mark.rutland@arm.com> wrote:
> >> I know that both arm64 and x86 have a check_object_size() call in their
> >> __copy_from_user() implementations.

> >> Is that missing on some architectures?
> > 
> > Every architecture is _slightly_ different. Most put the check in
> > __copy_from_user() so it's correctly caught. (x86 puts them in both
> > since copy*() calls _copy*(), not __copy*() ... >_<)
> 
> I think still there are some architectures which didn't put the check
> in __copy_from_user() [eg. tile].

I see. :(

Looking again, a grep shows many (even those with MMUs) don't do anything at
all in v4.9-rc2:

[mark@remoulade:~/src/linux]% for ARCH in arch/*; do
printf "%d %s\n" $(git grep check_object_size -- "${ARCH}" | wc -l) ${ARCH};
done | sort -n
0 arch/alpha
0 arch/arc
0 arch/avr32
0 arch/blackfin
0 arch/c6x
0 arch/cris
0 arch/frv
0 arch/h8300
0 arch/hexagon
0 arch/Kconfig
0 arch/m32r
0 arch/m68k
0 arch/metag
0 arch/microblaze
0 arch/mn10300
0 arch/nios2
0 arch/openrisc
0 arch/score
0 arch/sh
0 arch/tile
0 arch/um
0 arch/unicore32
0 arch/xtensa
2 arch/parisc
2 arch/s390
3 arch/arm
4 arch/arm64
4 arch/ia64
4 arch/powerpc
5 arch/sparc
6 arch/mips
6 arch/x86

> I was actually wondering if there are any cases where we need any
> architecture specific extra check(s)?

Generally, I'd expect that to be orthogonal to the hardened usercopy work, and
that check would still be present in the low-level architecture-specific code
even if we made the check_object_size() checks common.

Do you have an example of the kind of thing you're worried about?

Thanks,
Mark.