All of lore.kernel.org
 help / color / mirror / Atom feed
From: Philipp Stanner <pstanner@redhat.com>
To: Kees Cook <keescook@chromium.org>,
	Andy Shevchenko <andy@kernel.org>,
	Eric Biederman <ebiederm@xmission.com>,
	Christian Brauner <brauner@kernel.org>,
	David Disseldorp <ddiss@suse.de>,
	Luis Chamberlain <mcgrof@kernel.org>,
	Siddh Raman Pant <code@siddh.me>,
	Nick Alcock <nick.alcock@oracle.com>,
	Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
	Maxime Ripard <mripard@kernel.org>,
	Thomas Zimmermann <tzimmermann@suse.de>,
	David Airlie <airlied@gmail.com>, Daniel Vetter <daniel@ffwll.ch>,
	Zack Rusin <zackr@vmware.com>
Cc: VMware Graphics Reviewers <linux-graphics-maintainer@vmware.com>,
	dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	kexec@lists.infradead.org, linux-hardening@vger.kernel.org,
	Philipp Stanner <pstanner@redhat.com>
Subject: [PATCH 0/5] Introduce new wrappers to copy user-arrays
Date: Wed, 30 Aug 2023 15:45:51 +0200	[thread overview]
Message-ID: <cover.1693386602.git.pstanner@redhat.com> (raw)

Hi!

David Airlie suggested that we could implement new wrappers around
(v)memdup_user() for duplicating user arrays.

This small patch series first implements the two new wrapper functions
memdup_array_user() and vmemdup_array_user(). They calculate the
array-sizes safely, i.e., they return an error in case of an overflow.

It then implements the new wrappers in two components in kernel/ and two
in the drm-subsystem.

In total, there are 18 files in the kernel that use (v)memdup_user() to
duplicate arrays. My plan is to provide patches for the other 14
successively once this series has been merged.

P.

Philipp Stanner (5):
  string.h: add array-wrappers for (v)memdup_user()
  kernel: kexec: copy user-array safely
  kernel: watch_queue: copy user-array safely
  drm_lease.c: copy user-array safely
  drm: vmgfx_surface.c: copy user-array safely

 drivers/gpu/drm/drm_lease.c             |  4 +--
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c |  4 +--
 include/linux/string.h                  | 42 +++++++++++++++++++++++++
 kernel/kexec.c                          |  2 +-
 kernel/watch_queue.c                    |  2 +-
 5 files changed, 48 insertions(+), 6 deletions(-)

-- 
2.41.0


_______________________________________________
kexec mailing list
kexec@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/kexec

WARNING: multiple messages have this Message-ID (diff)
From: Philipp Stanner <pstanner@redhat.com>
To: Kees Cook <keescook@chromium.org>,
	Andy Shevchenko <andy@kernel.org>,
	Eric Biederman <ebiederm@xmission.com>,
	Christian Brauner <brauner@kernel.org>,
	David Disseldorp <ddiss@suse.de>,
	Luis Chamberlain <mcgrof@kernel.org>,
	Siddh Raman Pant <code@siddh.me>,
	Nick Alcock <nick.alcock@oracle.com>,
	Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
	Maxime Ripard <mripard@kernel.org>,
	Thomas Zimmermann <tzimmermann@suse.de>,
	David Airlie <airlied@gmail.com>, Daniel Vetter <daniel@ffwll.ch>,
	Zack Rusin <zackr@vmware.com>
Cc: VMware Graphics Reviewers <linux-graphics-maintainer@vmware.com>,
	dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	kexec@lists.infradead.org, linux-hardening@vger.kernel.org,
	Philipp Stanner <pstanner@redhat.com>
Subject: [PATCH 0/5] Introduce new wrappers to copy user-arrays
Date: Wed, 30 Aug 2023 15:45:51 +0200	[thread overview]
Message-ID: <cover.1693386602.git.pstanner@redhat.com> (raw)

Hi!

David Airlie suggested that we could implement new wrappers around
(v)memdup_user() for duplicating user arrays.

This small patch series first implements the two new wrapper functions
memdup_array_user() and vmemdup_array_user(). They calculate the
array-sizes safely, i.e., they return an error in case of an overflow.

It then implements the new wrappers in two components in kernel/ and two
in the drm-subsystem.

In total, there are 18 files in the kernel that use (v)memdup_user() to
duplicate arrays. My plan is to provide patches for the other 14
successively once this series has been merged.

P.

Philipp Stanner (5):
  string.h: add array-wrappers for (v)memdup_user()
  kernel: kexec: copy user-array safely
  kernel: watch_queue: copy user-array safely
  drm_lease.c: copy user-array safely
  drm: vmgfx_surface.c: copy user-array safely

 drivers/gpu/drm/drm_lease.c             |  4 +--
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c |  4 +--
 include/linux/string.h                  | 42 +++++++++++++++++++++++++
 kernel/kexec.c                          |  2 +-
 kernel/watch_queue.c                    |  2 +-
 5 files changed, 48 insertions(+), 6 deletions(-)

-- 
2.41.0


WARNING: multiple messages have this Message-ID (diff)
From: Philipp Stanner <pstanner@redhat.com>
To: Kees Cook <keescook@chromium.org>,
	Andy Shevchenko <andy@kernel.org>,
	Eric Biederman <ebiederm@xmission.com>,
	Christian Brauner <brauner@kernel.org>,
	David Disseldorp <ddiss@suse.de>,
	Luis Chamberlain <mcgrof@kernel.org>,
	Siddh Raman Pant <code@siddh.me>,
	Nick Alcock <nick.alcock@oracle.com>,
	Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
	Maxime Ripard <mripard@kernel.org>,
	Thomas Zimmermann <tzimmermann@suse.de>,
	David Airlie <airlied@gmail.com>, Daniel Vetter <daniel@ffwll.ch>,
	Zack Rusin <zackr@vmware.com>
Cc: Philipp Stanner <pstanner@redhat.com>,
	kexec@lists.infradead.org, linux-kernel@vger.kernel.org,
	dri-devel@lists.freedesktop.org,
	VMware Graphics Reviewers <linux-graphics-maintainer@vmware.com>,
	linux-hardening@vger.kernel.org
Subject: [PATCH 0/5] Introduce new wrappers to copy user-arrays
Date: Wed, 30 Aug 2023 15:45:51 +0200	[thread overview]
Message-ID: <cover.1693386602.git.pstanner@redhat.com> (raw)

Hi!

David Airlie suggested that we could implement new wrappers around
(v)memdup_user() for duplicating user arrays.

This small patch series first implements the two new wrapper functions
memdup_array_user() and vmemdup_array_user(). They calculate the
array-sizes safely, i.e., they return an error in case of an overflow.

It then implements the new wrappers in two components in kernel/ and two
in the drm-subsystem.

In total, there are 18 files in the kernel that use (v)memdup_user() to
duplicate arrays. My plan is to provide patches for the other 14
successively once this series has been merged.

P.

Philipp Stanner (5):
  string.h: add array-wrappers for (v)memdup_user()
  kernel: kexec: copy user-array safely
  kernel: watch_queue: copy user-array safely
  drm_lease.c: copy user-array safely
  drm: vmgfx_surface.c: copy user-array safely

 drivers/gpu/drm/drm_lease.c             |  4 +--
 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c |  4 +--
 include/linux/string.h                  | 42 +++++++++++++++++++++++++
 kernel/kexec.c                          |  2 +-
 kernel/watch_queue.c                    |  2 +-
 5 files changed, 48 insertions(+), 6 deletions(-)

-- 
2.41.0


             reply	other threads:[~2023-08-30 13:46 UTC|newest]

Thread overview: 51+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-08-30 13:45 Philipp Stanner [this message]
2023-08-30 13:45 ` [PATCH 0/5] Introduce new wrappers to copy user-arrays Philipp Stanner
2023-08-30 13:45 ` Philipp Stanner
2023-08-30 13:45 ` [PATCH 1/5] string.h: add array-wrappers for (v)memdup_user() Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 14:11   ` Andy Shevchenko
2023-08-30 14:11     ` Andy Shevchenko
2023-08-30 14:11     ` Andy Shevchenko
2023-08-30 14:19     ` pstanner
2023-08-30 14:19       ` pstanner
2023-08-30 14:19       ` pstanner
2023-08-30 14:29       ` Andy Shevchenko
2023-08-30 14:29         ` Andy Shevchenko
2023-08-30 14:29         ` Andy Shevchenko
2023-08-30 19:15         ` pstanner
2023-08-30 19:15           ` pstanner
2023-08-30 19:15           ` pstanner
2023-08-31  8:59           ` Andy Shevchenko
2023-08-31  8:59             ` Andy Shevchenko
2023-08-31  8:59             ` Andy Shevchenko
2023-08-31 12:16             ` Philipp Stanner
2023-08-31 12:16               ` Philipp Stanner
2023-08-31 12:16               ` Philipp Stanner
2023-08-31 12:22     ` Philipp Stanner
2023-08-31 12:22       ` Philipp Stanner
2023-08-31 12:22       ` Philipp Stanner
2023-08-31 13:16       ` Andy Shevchenko
2023-08-31 13:16         ` Andy Shevchenko
2023-08-31 13:16         ` Andy Shevchenko
2023-08-31 13:17         ` Andy Shevchenko
2023-08-31 13:17           ` Andy Shevchenko
2023-08-31 13:17           ` Andy Shevchenko
2023-08-30 14:15   ` Andy Shevchenko
2023-08-30 14:15     ` Andy Shevchenko
2023-08-30 14:15     ` Andy Shevchenko
2023-08-30 14:23     ` pstanner
2023-08-30 14:23       ` pstanner
2023-08-30 14:23       ` pstanner
2023-08-30 13:45 ` [PATCH 2/5] kernel: kexec: copy user-array safely Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 13:45 ` [PATCH 3/5] kernel: watch_queue: " Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 13:45 ` [PATCH 4/5] drm_lease.c: " Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 13:45 ` [PATCH 5/5] drm: vmgfx_surface.c: " Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner
2023-08-30 13:45   ` Philipp Stanner

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=cover.1693386602.git.pstanner@redhat.com \
    --to=pstanner@redhat.com \
    --cc=airlied@gmail.com \
    --cc=andy@kernel.org \
    --cc=brauner@kernel.org \
    --cc=code@siddh.me \
    --cc=daniel@ffwll.ch \
    --cc=ddiss@suse.de \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=ebiederm@xmission.com \
    --cc=keescook@chromium.org \
    --cc=kexec@lists.infradead.org \
    --cc=linux-graphics-maintainer@vmware.com \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=maarten.lankhorst@linux.intel.com \
    --cc=mcgrof@kernel.org \
    --cc=mripard@kernel.org \
    --cc=nick.alcock@oracle.com \
    --cc=tzimmermann@suse.de \
    --cc=zackr@vmware.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.