From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail18.out.titan.email (mail18.out.titan.email [3.64.226.212])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 562242153C4
	for <linux-hardening@vger.kernel.org>; Wed, 22 Jan 2025 17:19:43 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=3.64.226.212
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737566387; cv=none; b=lnB+OYPL24c4sWyYXl/VdekVallYuOz29TuE3JS5SntAATHys3iNZ9yuChag2VZ15sJM2hEbKJi+i8geIUk4mpATKKxiS47/7v95ZgOj9QDH0ywyL3rXPef0s1anFqoRboeZOrxLdBsCrleNGVCVEnP6wWh6IIlKTlhDy18pEI8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737566387; c=relaxed/simple;
	bh=iK09qufNgJuDPPak6RhKr/1Xfb8f0RwJMff2E1K4Xjk=;
	h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=a72LSAdhpJ6EnHoVaxHXTTiDIyyWQuw1IeBifc3X/qfEthZwF6zqO0XO2T1CeL7ksHEVmW/5DEcNsRa44bgqsKwkeGByikye0P5G0LB3WQFVVuxAA46rVVSzx6Njw64S+UVgGgc0SzcYQoFVupy4Kd+0mNp/Xv9uGIcQvEc9+Z8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=Aa8faVMU; arc=none smtp.client-ip=3.64.226.212
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="Aa8faVMU"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id 6B05BA004C;
	Wed, 22 Jan 2025 17:19:37 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=4djku+6EqFOgLL/qaKFUmPRsXvTJBcQLpvpQYtOF4ss=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=message-id:from:to:cc:subject:date:mime-version:from:to:cc:subject:date:message-id:in-reply-to:reply-to:references;
	q=dns/txt; s=titan1; t=1737566377; v=1;
	b=Aa8faVMUJ6GqjC+lWfBwlVvvVGfw/KLW5fomE4y6IB060+mJ5/DcerLAiy3RahfLkyQzTqn/
	VCvwXYPlKJC0e9+9nA+qc810J/fNecX11FaYfaBxemVAYvz0Jo8IFi4Ms0jdJQ7OgykjRcdkV/W
	bGg6Ep/aV4hIGB2YAsZuPiRw=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id E5A4CA0004;
	Wed, 22 Jan 2025 17:19:36 +0000 (UTC)
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>,
	Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Mel Gorman <mgorman@techsingularity.net>
Subject: [PATCH v2 0/4] Allow default HARDENED_USERCOPY to be set at compile time
Date: Wed, 22 Jan 2025 17:19:21 +0000
Message-ID: <20250122171925.25472-1-mgorman@techsingularity.net>
X-Mailer: git-send-email 2.43.0
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737566377314830560.9138.3654567428906523320@prod-euc1-smtp-out1002.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=UdNXSrSN c=1 sm=1 tr=0 ts=679128a9
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=CEWIc4RMnpUA:10 a=F_ROk3OM8dyGBT-qa-4A:9
X-Virus-Scanned: ClamAV using ClamSMTP

Changelog since v1
o Menu section rename
o Make static branch usage similar to init_on_alloc
o Change ordering of menu options

Some hardening options like HARDENED_USERCOPY can be set at boot time
and have negligible cost when disabled. The default for options like
init_on_alloc= can be set at compile time but hardened usercopy is
enabled by default if built in. This incurs overhead when a kernel
wishes to provide optional hardening but the user does not necessarily
care.

Hardening is desirable in some environments but ideally they would be opt-in
by kernel command line as hardening is typically a deliberate decision
whereas the performance overhead is not always obvious to all users.
Patches 1 and 2 move HARDENED_USERCOPY to the Kconfig.hardening and
default it to disabled. Patch 3 moves the static branch check to a fast
path similar to init_on_*. Patch 4 moves FORTIFY_SOURCE to hardening only
because the option is related to hardening and happened to be declared
near HARDENED_USERCOPY.

Building HARDENED_USERCOPY but disabled at runtime has neligible effect
within the noise. Enabling the option by default generally incurs 2-10%
of overhead depending on the workload with some extreme outliers depending
on the exact CPU. While the benchmarks are somewhat synthetic, the overhead
IO-intensive and network-intensive is easily detectable but the root cause
may not be obvious (e.g. 2-14% overhead for netperf TCP_STREAM running
over localhost with different ranges depending on the CPU).

 .../admin-guide/kernel-parameters.txt         |  4 ++-
 include/linux/thread_info.h                   |  8 +++++
 mm/usercopy.c                                 | 14 ++++----
 security/Kconfig                              | 21 ------------
 security/Kconfig.hardening                    | 33 +++++++++++++++++++
 5 files changed, 52 insertions(+), 28 deletions(-)

-- 
2.43.0


From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail13.out.titan.email (mail13.out.titan.email [18.198.78.245])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id D40DF21505F;
	Wed, 22 Jan 2025 17:20:05 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=18.198.78.245
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737566408; cv=none; b=e66ls4YZ1fttG6UR/6iCZ0wX9OVaSB4Fe0E22ywogTGZ2A9WwN5KgUNEmRRKmh4ylj42ncHfRodTyYaeHkqCotBDlRAoSD8gVXZtAu9WHNj/xPseWledzUXORyV3N5lPiJ6A7M5LuhvuyczNjMcmH9Rqu7sXMvhjAPISBK21/gs=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737566408; c=relaxed/simple;
	bh=SuG5hvAQgjxhXm9LGjN9dYWNlAAqBwyJpF59KcRtkR4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=PLHhrSYdzweam+Kgqe4Ix0NhfIC4ykOfbTPU9aKHICkIE6eicDhvhTLu7IrW88e28uIdqtWMK6RA0jEuT2LKG9m5FRG/JaEoheVP+ddZn8vENT+V+suxolAaHxfGlDVwo7fMThB4gLgUkSvg5Rlp8JHjGfU9cWw6pjfBKKKoNLc=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=Bpnsrt+X; arc=none smtp.client-ip=18.198.78.245
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="Bpnsrt+X"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id A0C49A015A;
	Wed, 22 Jan 2025 17:19:58 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=Z2jYOWM8hUV6J3bzYS5e2M9sLIUUWbq7B6uKhS/GsCs=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=mime-version:from:to:cc:message-id:in-reply-to:subject:date:references:from:to:cc:subject:date:message-id:in-reply-to:references:reply-to;
	q=dns/txt; s=titan1; t=1737566398; v=1;
	b=Bpnsrt+XYCpXjb4LOgVfgwsOpx/9Q7ZydDgH4UuJRheEiW3AHJAIB4mclRxQbwCFWzYu9/E9
	LDApje3CjvtfkI2u0OXsR03GQyfT1EVJNCYQ1GFK0DiRF2s/Hz3JEDWgvcr5C6+2ZVFSxfFc4VE
	NgWkQ5xP5Bw789VU4DxEV+40=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id 33020A0008;
	Wed, 22 Jan 2025 17:19:58 +0000 (UTC)
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>,
	Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Mel Gorman <mgorman@techsingularity.net>
Subject: [PATCH 2/4] mm: security: Allow default HARDENED_USERCOPY to be set at compile time
Date: Wed, 22 Jan 2025 17:19:23 +0000
Message-ID: <20250122171925.25472-3-mgorman@techsingularity.net>
X-Mailer: git-send-email 2.43.0
In-Reply-To: <20250122171925.25472-1-mgorman@techsingularity.net>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737566398543734204.9138.2594461423631213783@prod-euc1-smtp-out1002.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=UdNXSrSN c=1 sm=1 tr=0 ts=679128be
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=CEWIc4RMnpUA:10 a=R_Myd5XaAAAA:8 a=0z80O7jHjOjBg2F2ajAA:9
	a=L2g4Dz8VuBQ37YGmWQah:22
X-Virus-Scanned: ClamAV using ClamSMTP

HARDENED_USERCOPY defaults to on if enabled at compile time. Allow
hardened_usercopy= default to be set at compile time similar to
init_on_alloc= and init_on_free=. The intent is that hardening
options that can be disabled at runtime can set their default at
build time.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
---
 Documentation/admin-guide/kernel-parameters.txt | 4 +++-
 mm/usercopy.c                                   | 3 ++-
 security/Kconfig.hardening                      | 8 ++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 3872bc6ec49d..5d759b20540a 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1773,7 +1773,9 @@
 			allocation boundaries as a proactive defense
 			against bounds-checking flaws in the kernel's
 			copy_to_user()/copy_from_user() interface.
-		on	Perform hardened usercopy checks (default).
+			The default is determined by
+			CONFIG_HARDENED_USERCOPY_DEFAULT_ON.
+		on	Perform hardened usercopy checks.
 		off	Disable hardened usercopy checks.
 
 	hardlockup_all_cpu_backtrace=
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 83c164aba6e0..4cf33305347a 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -255,7 +255,8 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
 }
 EXPORT_SYMBOL(__check_object_size);
 
-static bool enable_checks __initdata = true;
+static bool enable_checks __initdata =
+		IS_ENABLED(CONFIG_HARDENED_USERCOPY_DEFAULT_ON);
 
 static int __init parse_hardened_usercopy(char *str)
 {
diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
index 9088d613d519..adcc260839c7 100644
--- a/security/Kconfig.hardening
+++ b/security/Kconfig.hardening
@@ -293,6 +293,14 @@ config HARDENED_USERCOPY
 	  or are part of the kernel text. This prevents entire classes
 	  of heap overflow exploits and similar kernel memory exposures.
 
+config HARDENED_USERCOPY_DEFAULT_ON
+	bool "Harden memory copies by default"
+	depends on HARDENED_USERCOPY
+	default n
+	help
+	  This has the effect of setting "hardened_usercopy=on" on the kernel
+	  command line. This can be disabled with "hardened_usercopy=off".
+
 endmenu
 
 menu "Hardening of kernel data structures"
-- 
2.43.0


From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail18.out.titan.email (mail18.out.titan.email [3.64.226.212])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD2F42153C6
	for <linux-hardening@vger.kernel.org>; Wed, 22 Jan 2025 17:20:10 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=3.64.226.212
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737566412; cv=none; b=DcC/186H4zVbIgD3LLkCdNb7hcHwSWogvhX4hqwv8yM7D38Yl3ZCImbq/bLId8Sac08WHnmt3pArmcfL4/ScFKWhptWJvIHmiiPs3DC1kwDDw3rmx5fY2SlREg2csh4GP8O4449ijVIhLiKDBNuefy7W7iUmOSSqGI4fdrlB7cI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737566412; c=relaxed/simple;
	bh=6su9UrgLxfeY+Y7fVw1qRBBhgcWMQoVDEU8h6Q2G298=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=Fs4o+Vc9W4YRKO9OPfpa4qiZ2WUnkUUrYv3v/eIPRtDWOsmTXi9duGAetVrsTqLmJx2adq3X3bUG4k4EgriPb+ZDYhFPG+4zRn9L+dkbnHNT14Z0WNEbE7Qqln8mQ4+1/JDm4DcJhchNABBHQgBYj410obeXyngtjhhv8e/rUtQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=Ey8CgysZ; arc=none smtp.client-ip=3.64.226.212
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="Ey8CgysZ"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id 374A1A00D9;
	Wed, 22 Jan 2025 17:20:09 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=Y09jPq5GH+jLn+U5pAD6Zl5SbOMjMXu/OVlJSNYhum8=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=subject:from:date:message-id:in-reply-to:references:mime-version:cc:to:from:to:cc:subject:date:message-id:in-reply-to:references:reply-to;
	q=dns/txt; s=titan1; t=1737566409; v=1;
	b=Ey8CgysZ9TAeWFDrjBCTOlZ7Wb1Knd7+3IimYe6w3M29wDeI+Io3YkM84i2YHyvXdCdd3NsL
	McJgYyTjl1Uccy6Wz6BRxz3e3hj/h+h62Z+qUDxn63VFdxAA/nDoe/ypDY/CSRqFwzBZtkCAmw0
	sWj0RjA7TMhhY1YJhtBRfhA8=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id B188FA0008;
	Wed, 22 Jan 2025 17:20:08 +0000 (UTC)
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>,
	Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Mel Gorman <mgorman@techsingularity.net>
Subject: [PATCH 3/4] mm: security: Check early if HARDENED_USERCOPY is enabled
Date: Wed, 22 Jan 2025 17:19:24 +0000
Message-ID: <20250122171925.25472-4-mgorman@techsingularity.net>
X-Mailer: git-send-email 2.43.0
In-Reply-To: <20250122171925.25472-1-mgorman@techsingularity.net>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737566409105785618.9138.6377992846655049101@prod-euc1-smtp-out1002.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=UdNXSrSN c=1 sm=1 tr=0 ts=679128c9
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=CEWIc4RMnpUA:10 a=VwQbUJbxAAAA:8 a=R_Myd5XaAAAA:8
	a=4yXJT0XmbIIbJQ27IpEA:9 a=L2g4Dz8VuBQ37YGmWQah:22
X-Virus-Scanned: ClamAV using ClamSMTP

HARDENED_USERCOPY is checked within a function so even if disabled, the
function overhead still exists. Move the static check inline.

This is at best a micro-optimisation and any difference in performance
was within noise but it is relatively consistent with the init_on_*
implementations.

Suggested-by: Kees Cook <kees@kernel.org>
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
---
 include/linux/thread_info.h |  8 ++++++++
 mm/usercopy.c               | 11 ++++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index cf2446c9c30d..832f6a97e64c 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -221,9 +221,17 @@ static inline int arch_within_stack_frames(const void * const stack,
 extern void __check_object_size(const void *ptr, unsigned long n,
 					bool to_user);
 
+DECLARE_STATIC_KEY_MAYBE(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
+			   validate_usercopy_range);
+
 static __always_inline void check_object_size(const void *ptr, unsigned long n,
 					      bool to_user)
 {
+	if (static_branch_maybe(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
+				&validate_usercopy_range)) {
+		return;
+	}
+
 	if (!__builtin_constant_p(n))
 		__check_object_size(ptr, n, to_user);
 }
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 4cf33305347a..2e86413ed244 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -201,7 +201,9 @@ static inline void check_heap_object(const void *ptr, unsigned long n,
 	}
 }
 
-static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
+DEFINE_STATIC_KEY_MAYBE_RO(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
+			   validate_usercopy_range);
+EXPORT_SYMBOL(validate_usercopy_range);
 
 /*
  * Validates that the given object is:
@@ -212,9 +214,6 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
  */
 void __check_object_size(const void *ptr, unsigned long n, bool to_user)
 {
-	if (static_branch_unlikely(&bypass_usercopy_checks))
-		return;
-
 	/* Skip all tests if size is zero. */
 	if (!n)
 		return;
@@ -271,7 +270,9 @@ __setup("hardened_usercopy=", parse_hardened_usercopy);
 static int __init set_hardened_usercopy(void)
 {
 	if (enable_checks == false)
-		static_branch_enable(&bypass_usercopy_checks);
+		static_branch_enable(&validate_usercopy_range);
+	else
+		static_branch_disable(&validate_usercopy_range);
 	return 1;
 }
 
-- 
2.43.0


From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail13.out.titan.email (mail13.out.titan.email [18.198.78.245])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2ABD921505C;
	Wed, 22 Jan 2025 17:20:20 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=18.198.78.245
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737566422; cv=none; b=GYmhhLcshkAXIkxWLlv5P150PNm83ZEpSMrosdWE6bPl3hxdXqoopVxkGsmtC+T8yoPPquR7wf4pKnqwboSEnmF6H2cN/p6cwnHSH3DB+IxQZslAwAnttObE+wD9BC2YhpliCor1dWIpXsoakIfJ5G1c0B7hWF2xQaSE3MdD8rQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737566422; c=relaxed/simple;
	bh=KrjSVaIoP+BpwwMwb3WYVndUBetVLdni2EXBCUvc5sE=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=pJsdO9cwsVr6Cb9Q/tHOK5Nab1yB0w1OjgY/eAEaqqNY+HCer1/LfrSBAbkvAK8gJ05ra0g27nj3+NszNB40AOZj0C/sd86p0TxdJoWavib5D0xW2duWWYqGSDq2z2rboeNKA9dIzmiY533E/lLOE+rhYsfW6qXY0AABMBrU8yE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=I1QCkv0E; arc=none smtp.client-ip=18.198.78.245
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="I1QCkv0E"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id B63F1A004C;
	Wed, 22 Jan 2025 17:20:19 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=BaW9mABtKsoIJb+CbhxfD7184LG2W72FFvHkaZBiFVw=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=in-reply-to:references:cc:date:mime-version:from:to:subject:message-id:from:to:cc:subject:date:message-id:in-reply-to:references:reply-to;
	q=dns/txt; s=titan1; t=1737566419; v=1;
	b=I1QCkv0Eg/MH2uGO1edQyJOOZM80Tehnol1UXOq6NcQv9m3kwdKrTIB+TA/Og00F/0Li4SH3
	7gxjKe3CwqiDmakweBlwVQ/EmXh1eNwpJcNbExbK9slad3OB2q/D/VKahpwyfsIKS0drRcn+MCK
	fJBlSSWA8C1/zq9zJUwb0Jao=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id 47F13A00D9;
	Wed, 22 Jan 2025 17:20:19 +0000 (UTC)
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>,
	Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Mel Gorman <mgorman@techsingularity.net>
Subject: [PATCH 4/4] fortify: Move FORTIFY_SOURCE under 'Kernel hardening options'
Date: Wed, 22 Jan 2025 17:19:25 +0000
Message-ID: <20250122171925.25472-5-mgorman@techsingularity.net>
X-Mailer: git-send-email 2.43.0
In-Reply-To: <20250122171925.25472-1-mgorman@techsingularity.net>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737566419624532139.9138.5752076647353518555@prod-euc1-smtp-out1002.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=UdNXSrSN c=1 sm=1 tr=0 ts=679128d3
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=CEWIc4RMnpUA:10 a=NEAV23lmAAAA:8 a=R_Myd5XaAAAA:8
	a=Q9Z_rya5RYYz_BbIbTgA:9 a=L2g4Dz8VuBQ37YGmWQah:22
X-Virus-Scanned: ClamAV using ClamSMTP

FORTIFY_SOURCE is a hardening option both at build and runtime. Move
it under 'Kernel hardening options'.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
---
 security/Kconfig           | 9 ---------
 security/Kconfig.hardening | 9 +++++++++
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/security/Kconfig b/security/Kconfig
index fe7346dc4bc3..bca84f839fbe 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -159,15 +159,6 @@ config LSM_MMAP_MIN_ADDR
 	  this low address space will need the permission specific to the
 	  systems running LSM.
 
-config FORTIFY_SOURCE
-	bool "Harden common str/mem functions against buffer overflows"
-	depends on ARCH_HAS_FORTIFY_SOURCE
-	# https://github.com/llvm/llvm-project/issues/53645
-	depends on !CC_IS_CLANG || !X86_32
-	help
-	  Detect overflows of buffers in common string and memory functions
-	  where the compiler can determine and validate the buffer sizes.
-
 config STATIC_USERMODEHELPER
 	bool "Force all usermode helper calls through a single binary"
 	help
diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
index adcc260839c7..e22dc1801bee 100644
--- a/security/Kconfig.hardening
+++ b/security/Kconfig.hardening
@@ -281,6 +281,15 @@ endmenu
 
 menu "Bounds checking"
 
+config FORTIFY_SOURCE
+	bool "Harden common str/mem functions against buffer overflows"
+	depends on ARCH_HAS_FORTIFY_SOURCE
+	# https://github.com/llvm/llvm-project/issues/53645
+	depends on !CC_IS_CLANG || !X86_32
+	help
+	  Detect overflows of buffers in common string and memory functions
+	  where the compiler can determine and validate the buffer sizes.
+
 config HARDENED_USERCOPY
 	bool "Harden memory copies between kernel and userspace"
 	imply STRICT_DEVMEM
-- 
2.43.0


From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail13.out.titan.email (mail13.out.titan.email [18.198.78.245])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F487215173
	for <linux-hardening@vger.kernel.org>; Wed, 22 Jan 2025 17:29:23 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=18.198.78.245
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737566965; cv=none; b=G92tsdEEd5h62I8SMONJiO9mJMmnVk0+nr1F0SgKKlPdpSK/Xi5EHIxQwS+axPGft2EVDlIxGa/XDSJ0hMoShiQpum9bPFtTZkyh4aEFG1pglDbSgyX7rs0e2lPWMOpbADSMgA6K+lXjvKgZtZgvugBDu0Di6inykwll3Jr9pbk=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737566965; c=relaxed/simple;
	bh=AB+mmaXt7qGEW2WBJZAyCRpDhmRf7S/C4nkaGQVaxq4=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=JitK53l2zJFw0LVSGnG0U3ZosWxp0+v3HCbqhwRbIiaopIWv06Xl3AWK+M7t3w+OZJz8OLNojSHPRRJ3yE9G/weY6/KGQHovKJ0vo3qAaSKbAfNPsHvSiLflbGbws4LqhmYFroBpsKCEUYceq4Zl1OXzR0hS7vEOkUJ9TsylQBs=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=XLhOb0vr; arc=none smtp.client-ip=18.198.78.245
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="XLhOb0vr"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id 24322A0150;
	Wed, 22 Jan 2025 17:19:48 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=VWeq9rkukUyqf9ybH2ttB19u6OPJ/p54PCmlZ5v3Sl4=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=from:to:cc:date:references:mime-version:subject:message-id:in-reply-to:from:to:cc:subject:date:message-id:in-reply-to:references:reply-to;
	q=dns/txt; s=titan1; t=1737566388; v=1;
	b=XLhOb0vrs4TMeU2TNsPr5AZQeARDCWVE2GbqaujkS+juHenwZyNyQvYHyz2KIkg6m0pac2w2
	vXGeKGmzbeVK0qZFX88ZBaSu18fiKoQTPDzP0XSh3IisDQJ95wUJZHOVS/pr3qYH78eQA7l/0Hl
	cz6SWIsAdvDs9mwZHnUlt2uA=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id 8DB7BA0004;
	Wed, 22 Jan 2025 17:19:47 +0000 (UTC)
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>,
	Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Mel Gorman <mgorman@techsingularity.net>
Subject: [PATCH 1/4] mm: security: Move hardened usercopy under 'Kernel hardening options'
Date: Wed, 22 Jan 2025 17:19:22 +0000
Message-ID: <20250122171925.25472-2-mgorman@techsingularity.net>
X-Mailer: git-send-email 2.43.0
In-Reply-To: <20250122171925.25472-1-mgorman@techsingularity.net>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737566388028479881.9138.5572320255195962264@prod-euc1-smtp-out1002.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=UdNXSrSN c=1 sm=1 tr=0 ts=679128b4
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=CEWIc4RMnpUA:10 a=R_Myd5XaAAAA:8 a=xVhDTqbCAAAA:8
	a=KkbEisfxgXDdCi-76G0A:9 a=L2g4Dz8VuBQ37YGmWQah:22
	a=GrmWmAYt4dzCMttCBZOh:22
X-Virus-Scanned: ClamAV using ClamSMTP

There is a submenu for 'Kernel hardening options' under "Security".
Move HARDENED_USERCOPY under the hardening options as it is clearly
related.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Paul Moore <paul@paul-moore.com>
---
 security/Kconfig           | 12 ------------
 security/Kconfig.hardening | 16 ++++++++++++++++
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/security/Kconfig b/security/Kconfig
index 28e685f53bd1..fe7346dc4bc3 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -159,18 +159,6 @@ config LSM_MMAP_MIN_ADDR
 	  this low address space will need the permission specific to the
 	  systems running LSM.
 
-config HARDENED_USERCOPY
-	bool "Harden memory copies between kernel and userspace"
-	imply STRICT_DEVMEM
-	help
-	  This option checks for obviously wrong memory regions when
-	  copying memory to/from the kernel (via copy_to_user() and
-	  copy_from_user() functions) by rejecting memory ranges that
-	  are larger than the specified heap object, span multiple
-	  separately allocated pages, are not on the process stack,
-	  or are part of the kernel text. This prevents entire classes
-	  of heap overflow exploits and similar kernel memory exposures.
-
 config FORTIFY_SOURCE
 	bool "Harden common str/mem functions against buffer overflows"
 	depends on ARCH_HAS_FORTIFY_SOURCE
diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
index c9d5ca3d8d08..9088d613d519 100644
--- a/security/Kconfig.hardening
+++ b/security/Kconfig.hardening
@@ -279,6 +279,22 @@ config ZERO_CALL_USED_REGS
 
 endmenu
 
+menu "Bounds checking"
+
+config HARDENED_USERCOPY
+	bool "Harden memory copies between kernel and userspace"
+	imply STRICT_DEVMEM
+	help
+	  This option checks for obviously wrong memory regions when
+	  copying memory to/from the kernel (via copy_to_user() and
+	  copy_from_user() functions) by rejecting memory ranges that
+	  are larger than the specified heap object, span multiple
+	  separately allocated pages, are not on the process stack,
+	  or are part of the kernel text. This prevents entire classes
+	  of heap overflow exploits and similar kernel memory exposures.
+
+endmenu
+
 menu "Hardening of kernel data structures"
 
 config LIST_HARDENED
-- 
2.43.0


From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail-yb1-f180.google.com (mail-yb1-f180.google.com [209.85.219.180])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 245201C5D53
	for <linux-hardening@vger.kernel.org>; Wed, 22 Jan 2025 21:43:01 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.180
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737582183; cv=none; b=SwKCdHOFg9SpiW6+epSvGrb3eq+UvTAT7WOe5tJoUQOzNZr/Zi1LGj/Rbf+GRZB/pqKj6jitKs6q4fEa/dcPKwy+RfkK43eK8ny0uCTDe7L8URUvx61SsPBNkxrW08zz0wJTczAitv2kR6DrGlcQNXcwrT6jt3F+57ANgexK1dQ=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737582183; c=relaxed/simple;
	bh=8RZQwvkObKO3VPaU8AP0DGsDo0NJ00EaX2NgXrz68wE=;
	h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject:
	 To:Cc:Content-Type; b=G+aKSZeIGK20rtZAvUBY28f5xtFOXtmzg+AOneS/AMtQwW5v8i9KLbhEKAJ+TSNHaeipocM0TmF0/K+vC+Fhe5DaHMOAVE9+Bi7yrSTWVkVUK9KoZ+HWGzko3Z7z18ZhFK6O/ErRiIrLfcGXJswEgjT4rWU/kMFKgaOVrCdxhsA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=paul-moore.com; spf=pass smtp.mailfrom=paul-moore.com; dkim=pass (2048-bit key) header.d=paul-moore.com header.i=@paul-moore.com header.b=AQV/XWb5; arc=none smtp.client-ip=209.85.219.180
Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=paul-moore.com
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=paul-moore.com
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=paul-moore.com header.i=@paul-moore.com header.b="AQV/XWb5"
Received: by mail-yb1-f180.google.com with SMTP id 3f1490d57ef6-e479e529ebcso325897276.3
        for <linux-hardening@vger.kernel.org>; Wed, 22 Jan 2025 13:43:01 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=paul-moore.com; s=google; t=1737582181; x=1738186981; darn=vger.kernel.org;
        h=content-transfer-encoding:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:from:to:cc:subject:date
         :message-id:reply-to;
        bh=uiAqQAK7hqknGKjdZ8POIoXOOsj+wqhP5h4NBzi8MsI=;
        b=AQV/XWb5YV4xE7BET6aAS0SUT6g51LQ5P0FdIPjyCf9JfH5wL3h/cktxEAMXXjsFPm
         5Aj2zphmq/fkDd+BFwNgyGAfY9sDvW5AdGC5gBiEce4IIXwhPo8zbGY2PZB/Us9Xizso
         CVI2BMh2INw1S1lp/hFP6xwDFUQxWqpQ91+o9BORo/xpvDUNsod+NDU7wR/+AGLSm1Wn
         YnxJt3kG9JNLUbPvYf5WztPAnj5f5GSJSuBnqKrKioxCB6CHwYIgrpzQcDEMFg+Tx/LG
         TnET6c2LVxsKHq+74mtHyk2soIVTsQGCRRvvz8PXC8wAx+e14CWECfxdV3H9rVjcXjmj
         eBEA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1737582181; x=1738186981;
        h=content-transfer-encoding:cc:to:subject:message-id:date:from
         :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc
         :subject:date:message-id:reply-to;
        bh=uiAqQAK7hqknGKjdZ8POIoXOOsj+wqhP5h4NBzi8MsI=;
        b=Nd02pMvQSH4i+yB/AFQBS8uIfKVgj+eBHSRkV3mFpTDxE3ao7qi2z/7wVkFVlfMK47
         OM5kOTakItKwtD3xiOUCUDcvkAshosXdLO9JzrnvUbLm2rQrNaV2ZYAR95+LdyhhpF09
         rRv3jdgYuMSC9lbFLDPMJwN3ks6kNdBd4yenNE6tXixq1NFIDxcLxr7DWNVZm5fZUSnT
         eJR4M8BctDneSsuekH82GuGxIOojCOf7aS59NU6x8p+EYeoJ76NMlPaAyOb1BoLkVMV+
         qtUmd4dK4Bp31jZOWzDix+h897yvPEvLmCbnz2scR+4eJ7cVwdrs9T7JBmDPtcktsgrf
         rNKA==
X-Forwarded-Encrypted: i=1; AJvYcCU6AQ9bLXFAMvyOi/NRXRfo1l5UXuzdepOE6K6FX5z7OFizzoKy7HiQ9mDS2ATLR/7XrbrfyecNfNROjiG5DYU=@vger.kernel.org
X-Gm-Message-State: AOJu0YyGdX6bc80L6/CH/tasvbfCH19G3pvgTzuCrKsXeH+A/tsUer1v
	hym5RcPCbGLiCu7Rk3HrxGg0vf5b/66RyWBadgh98uEDEW9TQujn0NW1nNzr7jLMpW4WMY1HPPS
	giYU6o0Rtx3Tf7xcNi7VJ5xUKKt8GKleC/kJU
X-Gm-Gg: ASbGncvcQdcYnhmctIPkl6JEcAVmG8W0EFfvN/qrOXT/F3rS12vyVBxWoZZ5o0OUFyJ
	f8mLopWftTUQo/vlgMfen8TOt3ErO5rnSP6c4hWwc2uylcQxNJw==
X-Google-Smtp-Source: AGHT+IHjbM8XWw2S213mJA7xg42sApoplPKhSuwLodljWFQbVP+NNpz2kwU/BLY9KqeUNH/teMyMbxwFtWN/ex/GmTc=
X-Received: by 2002:a05:690c:6b86:b0:6ef:63cb:61d0 with SMTP id
 00721157ae682-6f6eb6770d0mr190636487b3.10.1737582181128; Wed, 22 Jan 2025
 13:43:01 -0800 (PST)
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
References: <20250122171925.25472-1-mgorman@techsingularity.net> <20250122171925.25472-5-mgorman@techsingularity.net>
In-Reply-To: <20250122171925.25472-5-mgorman@techsingularity.net>
From: Paul Moore <paul@paul-moore.com>
Date: Wed, 22 Jan 2025 16:42:50 -0500
X-Gm-Features: AWEUYZkjgty0BKaF0DyZmCr_vP5mMoV7zxq15zhIkT0o3W09u_L0GjfztLJyY9w
Message-ID: <CAHC9VhSgSk0+JFJdFAngZf6s+TapNyF-vzsW3a4gQ0jpKUiMCg@mail.gmail.com>
Subject: Re: [PATCH 4/4] fortify: Move FORTIFY_SOURCE under 'Kernel hardening options'
To: Mel Gorman <mgorman@techsingularity.net>
Cc: Kees Cook <kees@kernel.org>, Daniel Micay <danielmicay@gmail.com>, 
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Jan 22, 2025 at 12:20=E2=80=AFPM Mel Gorman <mgorman@techsingularit=
y.net> wrote:
>
> FORTIFY_SOURCE is a hardening option both at build and runtime. Move
> it under 'Kernel hardening options'.
>
> Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
> ---
>  security/Kconfig           | 9 ---------
>  security/Kconfig.hardening | 9 +++++++++
>  2 files changed, 9 insertions(+), 9 deletions(-)

Acked-by: Paul Moore <paul@paul-moore.com>

--=20
paul-moore.com

From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBF161E49B;
	Thu, 23 Jan 2025 00:57:41 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737593861; cv=none; b=p5xsB77D2YbMYwT2kRaawNm2OnNgzrf43XK8/GmGiZ0hHc2kGEb+tUKtlmPCqhVnJwELDktLWTC0TfhBGnFiYAhoeJbw1w7QNlNCuFH7OEfIXnl1605Qo0TIFP5jjYl2VUiUemAFpVJDeO90rL9dGwkJLJKyg4W0gCd9IilGdWI=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737593861; c=relaxed/simple;
	bh=3IZ9gXoNl/HLe+ZSOCWj/1mf1cqNCXh92IJ/RCIjrrI=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=JtwurBTvra80sU5mTxJ5rSqzkULizBHcjeQ4LQMBSpIgGU87vJrQYHqaE78619YEXQnycd0Znoxa4gOh7Kob/D+3pNy6b9tL7xtRTiXOKKX5rXC4Ejaxyam+SdE3RASkUhcMqxcaKfRQF9lSbyUY/p06g88+C0l6/X/H0wcco/8=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=EQ+aXal5; arc=none smtp.client-ip=10.30.226.201
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="EQ+aXal5"
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34DE7C4CED2;
	Thu, 23 Jan 2025 00:57:41 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1737593861;
	bh=3IZ9gXoNl/HLe+ZSOCWj/1mf1cqNCXh92IJ/RCIjrrI=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=EQ+aXal5DU1WV4juxX8u17f1Ccf9iUbdsy7iwdnqZzzSDi1oaSn4wqfaroC6e77He
	 Sppxg1AuU0IMUdFdswx8M8AmTIavgRTx1Dl0grnLzZFHu+fAjY34wZ/6Y32ZSoEKxM
	 1RgAEPpNJWXKbaHMcQPI40m3hkPUQft94L0+V/QIfoz6PMYkcXNxysmamAe74L1Ds0
	 hrgcnkicvBM4jIkWA04V3LDuKFiqF90XgUVtNtauHINCO/TRD1dg2XDl6tHkcsC4Mc
	 jkWc6x4EMF4YG0OQpHqyyAPLTyT3uAH6vxxDhiPMI4wf3jfm6oj9v9NMCxR9YxQHF7
	 icYMpY5JJhJZw==
Date: Wed, 22 Jan 2025 16:57:37 -0800
From: Kees Cook <kees@kernel.org>
To: Mel Gorman <mgorman@techsingularity.net>
Cc: Daniel Micay <danielmicay@gmail.com>, Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/4] mm: security: Allow default HARDENED_USERCOPY to be
 set at compile time
Message-ID: <202501221651.3F5A6ACD@keescook>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
 <20250122171925.25472-3-mgorman@techsingularity.net>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20250122171925.25472-3-mgorman@techsingularity.net>

On Wed, Jan 22, 2025 at 05:19:23PM +0000, Mel Gorman wrote:
> HARDENED_USERCOPY defaults to on if enabled at compile time. Allow
> hardened_usercopy= default to be set at compile time similar to
> init_on_alloc= and init_on_free=. The intent is that hardening
> options that can be disabled at runtime can set their default at
> build time.
> 
> Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
> ---
>  Documentation/admin-guide/kernel-parameters.txt | 4 +++-
>  mm/usercopy.c                                   | 3 ++-
>  security/Kconfig.hardening                      | 8 ++++++++
>  3 files changed, 13 insertions(+), 2 deletions(-)
> 
> diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> index 3872bc6ec49d..5d759b20540a 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -1773,7 +1773,9 @@
>  			allocation boundaries as a proactive defense
>  			against bounds-checking flaws in the kernel's
>  			copy_to_user()/copy_from_user() interface.
> -		on	Perform hardened usercopy checks (default).
> +			The default is determined by
> +			CONFIG_HARDENED_USERCOPY_DEFAULT_ON.
> +		on	Perform hardened usercopy checks.
>  		off	Disable hardened usercopy checks.
>  
>  	hardlockup_all_cpu_backtrace=
> diff --git a/mm/usercopy.c b/mm/usercopy.c
> index 83c164aba6e0..4cf33305347a 100644
> --- a/mm/usercopy.c
> +++ b/mm/usercopy.c
> @@ -255,7 +255,8 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
>  }
>  EXPORT_SYMBOL(__check_object_size);
>  
> -static bool enable_checks __initdata = true;
> +static bool enable_checks __initdata =
> +		IS_ENABLED(CONFIG_HARDENED_USERCOPY_DEFAULT_ON);
>  
>  static int __init parse_hardened_usercopy(char *str)
>  {
> diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
> index 9088d613d519..adcc260839c7 100644
> --- a/security/Kconfig.hardening
> +++ b/security/Kconfig.hardening
> @@ -293,6 +293,14 @@ config HARDENED_USERCOPY
>  	  or are part of the kernel text. This prevents entire classes
>  	  of heap overflow exploits and similar kernel memory exposures.
>  
> +config HARDENED_USERCOPY_DEFAULT_ON
> +	bool "Harden memory copies by default"
> +	depends on HARDENED_USERCOPY
> +	default n

This must be "default HARDENED_USERCOPY" or existing distro builds will
break. All major distros enable this by default, and I don't want to
risk HARDENED_USERCOPY_DEFAULT_ON getting missed and getting globally
disabled.

> +	help
> +	  This has the effect of setting "hardened_usercopy=on" on the kernel
> +	  command line. This can be disabled with "hardened_usercopy=off".
> +
>  endmenu
>  
>  menu "Hardening of kernel data structures"

-Kees

-- 
Kees Cook

From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id B083533F9;
	Thu, 23 Jan 2025 01:01:25 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737594085; cv=none; b=c29G6XndJNcOg2BS+/9QvZZmVBDE858NFQ0pMCLL7votDItvgI8aiC4Z4SWTrvTebm+KsUCdswIID2TxCGeDiLm7t1bWc+5MpL7yAi9W/kwbMavGHIVyvMQbvHgny0v5V70+Sxa1IvHq6l1nyvX1jcPGZHeTaXja1a8ADOH5xY8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737594085; c=relaxed/simple;
	bh=FzTDNqwA3Pthmmg1rBKFrLjwzrfQE9uSIA/nSnLLkuM=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=sUyMb0ZWWN4UUEFY/V0JPgg51eX0VFwhpWT+z2GVlFL9BcDeizArfyIokodJmJHkhb0FOZhiaKvEr7vz48JSruay2FufBdtvm+RJK8/p+ioxVUtoRLW9vTs+k5zYoBs/VlEOvdo6Y7vj2ieIYU6OtdJHUhq2Tw0VCy46NczwsgU=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=aYuJgqRJ; arc=none smtp.client-ip=10.30.226.201
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="aYuJgqRJ"
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 19C8BC4CED2;
	Thu, 23 Jan 2025 01:01:25 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1737594085;
	bh=FzTDNqwA3Pthmmg1rBKFrLjwzrfQE9uSIA/nSnLLkuM=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=aYuJgqRJyJptzMSHVAxj5PHzIeUJEdLJFb1hGn3I3qX9zscU1M5YJFwz4QzFzzcUL
	 3X1Lv0ngVePf0CsqklohPHOcaKhQDmUAxfOVh7TfugZ3R5zys64J8BycM9GtlMjCex
	 j1SMSW1WHoNqaq0sdxgs4zvpQ9o+SJc4PgRRImKKguVJO7tXkvXBXXJvIxH6ma+c5Q
	 HFQ/ACyGcNRaFlO0c6IrwnOcMfApmidLN6h9x3Fs32eqehCqz0hu9Fht32Xez3vHaR
	 mPkK4lWCumzY0XZ/H5HsKjGFGgVj0rtTeLPUZCGVneY2EkaMq6Yv4KmiN6dQObWb6h
	 8Qi9ZShpl5IVg==
Date: Wed, 22 Jan 2025 17:01:21 -0800
From: Kees Cook <kees@kernel.org>
To: Mel Gorman <mgorman@techsingularity.net>
Cc: Daniel Micay <danielmicay@gmail.com>, Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 3/4] mm: security: Check early if HARDENED_USERCOPY is
 enabled
Message-ID: <202501221657.E657471E6B@keescook>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
 <20250122171925.25472-4-mgorman@techsingularity.net>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20250122171925.25472-4-mgorman@techsingularity.net>

On Wed, Jan 22, 2025 at 05:19:24PM +0000, Mel Gorman wrote:
> HARDENED_USERCOPY is checked within a function so even if disabled, the
> function overhead still exists. Move the static check inline.
> 
> This is at best a micro-optimisation and any difference in performance
> was within noise but it is relatively consistent with the init_on_*
> implementations.
> 
> Suggested-by: Kees Cook <kees@kernel.org>
> Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
> ---
>  include/linux/thread_info.h |  8 ++++++++
>  mm/usercopy.c               | 11 ++++++-----
>  2 files changed, 14 insertions(+), 5 deletions(-)
> 
> diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
> index cf2446c9c30d..832f6a97e64c 100644
> --- a/include/linux/thread_info.h
> +++ b/include/linux/thread_info.h
> @@ -221,9 +221,17 @@ static inline int arch_within_stack_frames(const void * const stack,
>  extern void __check_object_size(const void *ptr, unsigned long n,
>  					bool to_user);
>  
> +DECLARE_STATIC_KEY_MAYBE(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
> +			   validate_usercopy_range);

This should be DECLARE_STATIC_KEY_MAYBE_RO()

>  static __always_inline void check_object_size(const void *ptr, unsigned long n,
>  					      bool to_user)
>  {
> +	if (static_branch_maybe(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
> +				&validate_usercopy_range)) {
> +		return;
> +	}
> +
>  	if (!__builtin_constant_p(n))
>  		__check_object_size(ptr, n, to_user);
>  }

This is accidentally correct ("if validate, skip" matches "if not
enabled, disable validation" below, but is very confusing. Also, yes,
this is good to be moved into the inline, but let's wrap it in the
compile-time __builtin_constant_p() check:

static __always_inline void check_object_size(const void *ptr, unsigned long n,
					      bool to_user)
{
	if (!__builtin_constant_p(n) &&
	    static_branch_maybe(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
				&validate_usercopy_range))
		__check_object_size(ptr, n, to_user);
}

> diff --git a/mm/usercopy.c b/mm/usercopy.c
> index 4cf33305347a..2e86413ed244 100644
> --- a/mm/usercopy.c
> +++ b/mm/usercopy.c
> @@ -201,7 +201,9 @@ static inline void check_heap_object(const void *ptr, unsigned long n,
>  	}
>  }
>  
> -static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
> +DEFINE_STATIC_KEY_MAYBE_RO(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
> +			   validate_usercopy_range);
> +EXPORT_SYMBOL(validate_usercopy_range);
>  
>  /*
>   * Validates that the given object is:
> @@ -212,9 +214,6 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
>   */
>  void __check_object_size(const void *ptr, unsigned long n, bool to_user)
>  {
> -	if (static_branch_unlikely(&bypass_usercopy_checks))
> -		return;
> -
>  	/* Skip all tests if size is zero. */
>  	if (!n)
>  		return;
> @@ -271,7 +270,9 @@ __setup("hardened_usercopy=", parse_hardened_usercopy);
>  static int __init set_hardened_usercopy(void)
>  {
>  	if (enable_checks == false)
> -		static_branch_enable(&bypass_usercopy_checks);
> +		static_branch_enable(&validate_usercopy_range);
> +	else
> +		static_branch_disable(&validate_usercopy_range);

This should be:

	if (enable_checks)
		static_branch_enable(&validate_usercopy_range);
	else
		static_branch_disable(&validate_usercopy_range);

>  	return 1;
>  }
>  
> -- 
> 2.43.0
> 

-- 
Kees Cook

From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 93D264690;
	Thu, 23 Jan 2025 01:02:33 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737594153; cv=none; b=W0C4bOH0ljh3D5k5KHCL0cvu67UWZvKLor+xZCWQDm2VN/MCOHjMfoT9vkSeoksBUMF9qCa2Z4avW3L9bS0vM+5+dEvHTdBZXMtgt6yz4nBXMElWG5EsYL5MsKHhkoaWhJnhyBLKX6XaPd4qkNRqv0+A84HrNdy/UJ1lG9lfkac=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737594153; c=relaxed/simple;
	bh=qr9lhHLgJK7uC+8egibzqrHwFu5QVZ4kucW5t0aKolQ=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=dx7uijBvtEVIly8eb+3dkdir7oU0CPZOwfH+jfwm66HPG1IuXw8+TaeXPp7tdjT6nZgKMS9TjeMS4q/Lu3Vr64vwtN0GJ8hr95PObridAFBb1m3NhBcc+2ADyGvE3jMQ9FCB1NNX83cs1Pr4/LVJNTLX7w0nu2sI7YqUiufaDlA=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DdgWBhrs; arc=none smtp.client-ip=10.30.226.201
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DdgWBhrs"
Received: by smtp.kernel.org (Postfix) with ESMTPSA id 11F7DC4CED2;
	Thu, 23 Jan 2025 01:02:33 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org;
	s=k20201202; t=1737594153;
	bh=qr9lhHLgJK7uC+8egibzqrHwFu5QVZ4kucW5t0aKolQ=;
	h=Date:From:To:Cc:Subject:References:In-Reply-To:From;
	b=DdgWBhrsgzJwUjXz3X8U/i4idkxuv+zFrhQjC1q+qLX/06b55OWwuP3wzki2caKU9
	 PXKaZeSDaI5ELc4vDco3ylpBjMcBFDAMzGbpkupL2bpXRJWLxlULse+5iUY2vHpeqO
	 MCp1MtLkaIYtIhWdZloRnDT1tWZ1kqu5agO5shofAtxqFsVP7GfGxcKHaOZI+p//8R
	 rrFOllL7slvqFcbcvIn+rGQEpffjDujFwKiTXJtt5gvFm15+K7kPQtPpQ+k0eHjNz4
	 txXwfIY6uRlBeOAQ6kCJOrGmqJaSjWi238USnWIwi0qYZD0L/SaN+u2PlNI9IDZ+pQ
	 J6/ia32OSNang==
Date: Wed, 22 Jan 2025 17:02:29 -0800
From: Kees Cook <kees@kernel.org>
To: Mel Gorman <mgorman@techsingularity.net>
Cc: Daniel Micay <danielmicay@gmail.com>, Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 0/4] Allow default HARDENED_USERCOPY to be set at
 compile time
Message-ID: <202501221701.61D4E17@keescook>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20250122171925.25472-1-mgorman@techsingularity.net>

On Wed, Jan 22, 2025 at 05:19:21PM +0000, Mel Gorman wrote:
> on the exact CPU. While the benchmarks are somewhat synthetic, the overhead
> IO-intensive and network-intensive is easily detectable but the root cause
> may not be obvious (e.g. 2-14% overhead for netperf TCP_STREAM running
> over localhost with different ranges depending on the CPU).

I would be curious to see where this overhead is coming from. That seems
extraordinarily high, and makes me think there is something more we
should be fixing. :)

-- 
Kees Cook

From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail31.out.titan.email (mail31.out.titan.email [3.66.49.190])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id F213B20CCC3
	for <linux-hardening@vger.kernel.org>; Thu, 23 Jan 2025 11:37:33 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=3.66.49.190
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737632257; cv=none; b=OxGCTkuK1vM/QBNjYuUi97mKwiPvzCt9M31+qtg/tLmxrAQooLXVFIB+XNbr3AiEV0eRbQ1FkcFd842wYtRNYohJMRyj4mk5NJiS2aLXdUJI0dp4xUBgiNOLuUEKhJoie2xrVLnXvs5TM5Zk1izrXncIg2z+ayRCziyRuTqMOKY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737632257; c=relaxed/simple;
	bh=9XDvLCp9IVXCNgwBV7Pq4aqXxXSvhGqbBINcYppjCL8=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=d2lLKr7oAZ37Op/teN+YvXDy5beyig8iYCHxwfy+QdDa5+J+OFD5BJcwbLopNbpvsydRcXQuu9DabDkQrVw/QAvoe9tYU7dKg1JH+zIGOl5+Mhg/mv3mLbTNFcCZ1wy18ajZK4hbEPAqz2WX08I2zCLG36Mr99VDwAWU5slP5VQ=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=VicYzkGm; arc=none smtp.client-ip=3.66.49.190
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="VicYzkGm"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id BD4E11000A7;
	Thu, 23 Jan 2025 11:37:25 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=+IlzZHyCEJh/xltUPPsa1hQ8E6BqvoLQPao3GlXCDJE=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=to:cc:subject:from:mime-version:message-id:in-reply-to:references:date:from:to:cc:subject:date:message-id:in-reply-to:references:reply-to;
	q=dns/txt; s=titan1; t=1737632245; v=1;
	b=VicYzkGmwrJriyKk/u3FrnqNlz+D7VsP5sWz0vaYWodMgkhtQJPmvEvWGGrlrGba9hNIGTJ0
	FlEh5z2/ThDnKe3NbVuUzHVVJrBlwPNF/5m+xPmawXR8q+xkUMtTqLGeprtCs2GrP2aXacO+yc9
	Km3g+ThYlMdkPeKoWLlB4Id4=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id 5F08410006B;
	Thu, 23 Jan 2025 11:37:25 +0000 (UTC)
Date: Thu, 23 Jan 2025 11:37:24 +0000
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>, Paul Moore <paul@paul-moore.com>, 
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/4] mm: security: Allow default HARDENED_USERCOPY to be
 set at compile time
Message-ID: <jgyz66gu5ormzmr2jrgyyksbm5q2mduvb7w7zxefoamlwe7l6a@o3j77ebpjwyx>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
 <20250122171925.25472-3-mgorman@techsingularity.net>
 <202501221651.3F5A6ACD@keescook>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Disposition: inline
In-Reply-To: <202501221651.3F5A6ACD@keescook>
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737632245640493528.2117.2181088510976086906@prod-euc1-smtp-out1001.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=UdNXSrSN c=1 sm=1 tr=0 ts=679229f5
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=Q9fys5e9bTEA:10 a=CEWIc4RMnpUA:10 a=R_Myd5XaAAAA:8
	a=BE4pPNmKF6ZOhpLNiO0A:9 a=PUjeQqilurYA:10 a=L2g4Dz8VuBQ37YGmWQah:22
X-Virus-Scanned: ClamAV using ClamSMTP

On Wed, Jan 22, 2025 at 04:57:37PM -0800, Kees Cook wrote:
> On Wed, Jan 22, 2025 at 05:19:23PM +0000, Mel Gorman wrote:
> > HARDENED_USERCOPY defaults to on if enabled at compile time. Allow
> > hardened_usercopy= default to be set at compile time similar to
> > init_on_alloc= and init_on_free=. The intent is that hardening
> > options that can be disabled at runtime can set their default at
> > build time.
> > 
> > Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
> > ---
> >  Documentation/admin-guide/kernel-parameters.txt | 4 +++-
> >  mm/usercopy.c                                   | 3 ++-
> >  security/Kconfig.hardening                      | 8 ++++++++
> >  3 files changed, 13 insertions(+), 2 deletions(-)
> > 
> > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> > index 3872bc6ec49d..5d759b20540a 100644
> > --- a/Documentation/admin-guide/kernel-parameters.txt
> > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > @@ -1773,7 +1773,9 @@
> >  			allocation boundaries as a proactive defense
> >  			against bounds-checking flaws in the kernel's
> >  			copy_to_user()/copy_from_user() interface.
> > -		on	Perform hardened usercopy checks (default).
> > +			The default is determined by
> > +			CONFIG_HARDENED_USERCOPY_DEFAULT_ON.
> > +		on	Perform hardened usercopy checks.
> >  		off	Disable hardened usercopy checks.
> >  
> >  	hardlockup_all_cpu_backtrace=
> > diff --git a/mm/usercopy.c b/mm/usercopy.c
> > index 83c164aba6e0..4cf33305347a 100644
> > --- a/mm/usercopy.c
> > +++ b/mm/usercopy.c
> > @@ -255,7 +255,8 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
> >  }
> >  EXPORT_SYMBOL(__check_object_size);
> >  
> > -static bool enable_checks __initdata = true;
> > +static bool enable_checks __initdata =
> > +		IS_ENABLED(CONFIG_HARDENED_USERCOPY_DEFAULT_ON);
> >  
> >  static int __init parse_hardened_usercopy(char *str)
> >  {
> > diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
> > index 9088d613d519..adcc260839c7 100644
> > --- a/security/Kconfig.hardening
> > +++ b/security/Kconfig.hardening
> > @@ -293,6 +293,14 @@ config HARDENED_USERCOPY
> >  	  or are part of the kernel text. This prevents entire classes
> >  	  of heap overflow exploits and similar kernel memory exposures.
> >  
> > +config HARDENED_USERCOPY_DEFAULT_ON
> > +	bool "Harden memory copies by default"
> > +	depends on HARDENED_USERCOPY
> > +	default n
> 
> This must be "default HARDENED_USERCOPY" or existing distro builds will
> break. All major distros enable this by default, and I don't want to
> risk HARDENED_USERCOPY_DEFAULT_ON getting missed and getting globally
> disabled.
> 

Ok. I dislike that HARDENED_USERCOPY will be inconsistent with INIT_ON*
but it's not a hill I'm willing to die on. Will be in v3

-- 
Mel Gorman
SUSE Labs

From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail18.out.titan.email (mail18.out.titan.email [3.64.226.212])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id DDACC381AF;
	Thu, 23 Jan 2025 11:47:14 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=3.64.226.212
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737632837; cv=none; b=Hyqi7Cr0D3ptxA5/qOnJU6ROXzFDam9QRmwCfhANdi0NusFvkfKqo0UT+OlQG/GLC3gS0CViYyBl5bSqxiQm8yE4lUctCvI+uSkK+4GT9mQgW5faDeynyfKjvGdN+D1upTeeBCvXR4X8fE7Gw4IeVPSDxDJLvUubXUix/NOod3Y=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737632837; c=relaxed/simple;
	bh=p7p+70gODuygFBbNmQZM4P2MMtWXHP4Vxhk4b1xW3/U=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=NkdjvbCEthcEV3kO4mC5Gtq1wEz9nVEpB0j9TgQsL0yOWfCXaf1o3mTrSV+onPHdwmOdfLiftnFGhOv4W+qF7XymvEtGOYqr8IFjeYAYWHy4zZOrQVQOaZccXfvKyK3/j1EZ8Vq1SEMQgfiV9TSl39a6wqer/QlLwjihlQGDQy0=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=ZwuWedC/; arc=none smtp.client-ip=3.64.226.212
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="ZwuWedC/"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id A6E31A014F;
	Thu, 23 Jan 2025 11:47:12 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=PDlnjIOGLC9huanq0PXLwl0a0rA6MLFYobde6kIUick=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=subject:message-id:mime-version:in-reply-to:date:from:to:cc:references:from:to:cc:subject:date:message-id:in-reply-to:references:reply-to;
	q=dns/txt; s=titan1; t=1737632827; v=1;
	b=ZwuWedC/o31nI5LaamdZ2Dt4mJk0VqyhHHOgIPvGEPcRG8gYIEckOFKRT2Gg//P8nsQKr8wO
	pHb2tXg5nM3rGoUEX8o4SUcm9+yDdcmQQpt3wkXjbccmB2kbYH8pkOEFYy6hAO0Axetl43xpihc
	CaUmYEMgcP9stGP4uFP2oDk4=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id A9F8FA016B;
	Thu, 23 Jan 2025 11:47:06 +0000 (UTC)
Date: Thu, 23 Jan 2025 11:47:05 +0000
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>, Paul Moore <paul@paul-moore.com>, 
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 3/4] mm: security: Check early if HARDENED_USERCOPY is
 enabled
Message-ID: <vtpg3zz4vv6drtkdqvqlcquajiw2lgj5h5d5xlhhptopl5r5r7@g5hwiqcrq7xr>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
 <20250122171925.25472-4-mgorman@techsingularity.net>
 <202501221657.E657471E6B@keescook>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Disposition: inline
In-Reply-To: <202501221657.E657471E6B@keescook>
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737632827098904498.9138.8096332741043118874@prod-euc1-smtp-out1002.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=TIZDSUla c=1 sm=1 tr=0 ts=67922c3b
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=Q9fys5e9bTEA:10 a=CEWIc4RMnpUA:10 a=VwQbUJbxAAAA:8 a=R_Myd5XaAAAA:8
	a=LboAmBLv0ONKXr6YTZkA:9 a=PUjeQqilurYA:10 a=L2g4Dz8VuBQ37YGmWQah:22
X-Virus-Scanned: ClamAV using ClamSMTP

On Wed, Jan 22, 2025 at 05:01:21PM -0800, Kees Cook wrote:
> On Wed, Jan 22, 2025 at 05:19:24PM +0000, Mel Gorman wrote:
> > HARDENED_USERCOPY is checked within a function so even if disabled, the
> > function overhead still exists. Move the static check inline.
> > 
> > This is at best a micro-optimisation and any difference in performance
> > was within noise but it is relatively consistent with the init_on_*
> > implementations.
> > 
> > Suggested-by: Kees Cook <kees@kernel.org>
> > Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
> > ---
> >  include/linux/thread_info.h |  8 ++++++++
> >  mm/usercopy.c               | 11 ++++++-----
> >  2 files changed, 14 insertions(+), 5 deletions(-)
> > 
> > diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
> > index cf2446c9c30d..832f6a97e64c 100644
> > --- a/include/linux/thread_info.h
> > +++ b/include/linux/thread_info.h
> > @@ -221,9 +221,17 @@ static inline int arch_within_stack_frames(const void * const stack,
> >  extern void __check_object_size(const void *ptr, unsigned long n,
> >  					bool to_user);
> >  
> > +DECLARE_STATIC_KEY_MAYBE(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
> > +			   validate_usercopy_range);
> 
> This should be DECLARE_STATIC_KEY_MAYBE_RO()
> 

Doesn't exist. Are you mixing it up with the DEFINE_STATIC_KEY_MAYBE_RO?


> >  static __always_inline void check_object_size(const void *ptr, unsigned long n,
> >  					      bool to_user)
> >  {
> > +	if (static_branch_maybe(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
> > +				&validate_usercopy_range)) {
> > +		return;
> > +	}
> > +
> >  	if (!__builtin_constant_p(n))
> >  		__check_object_size(ptr, n, to_user);
> >  }
> 
> This is accidentally correct ("if validate, skip" matches "if not
> enabled, disable validation" below, but is very confusing. Also, yes,
> this is good to be moved into the inline, but let's wrap it in the
> compile-time __builtin_constant_p() check:
> 
> static __always_inline void check_object_size(const void *ptr, unsigned long n,
> 					      bool to_user)
> {
> 	if (!__builtin_constant_p(n) &&
> 	    static_branch_maybe(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
> 				&validate_usercopy_range))
> 		__check_object_size(ptr, n, to_user);
> }
> 

Ok, should be fine given that it's a compile-time check anyway.

> > diff --git a/mm/usercopy.c b/mm/usercopy.c
> > index 4cf33305347a..2e86413ed244 100644
> > --- a/mm/usercopy.c
> > +++ b/mm/usercopy.c
> > @@ -201,7 +201,9 @@ static inline void check_heap_object(const void *ptr, unsigned long n,
> >  	}
> >  }
> >  
> > -static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
> > +DEFINE_STATIC_KEY_MAYBE_RO(CONFIG_HARDENED_USERCOPY_DEFAULT_ON,
> > +			   validate_usercopy_range);
> > +EXPORT_SYMBOL(validate_usercopy_range);
> >  
> >  /*
> >   * Validates that the given object is:
> > @@ -212,9 +214,6 @@ static DEFINE_STATIC_KEY_FALSE_RO(bypass_usercopy_checks);
> >   */
> >  void __check_object_size(const void *ptr, unsigned long n, bool to_user)
> >  {
> > -	if (static_branch_unlikely(&bypass_usercopy_checks))
> > -		return;
> > -
> >  	/* Skip all tests if size is zero. */
> >  	if (!n)
> >  		return;
> > @@ -271,7 +270,9 @@ __setup("hardened_usercopy=", parse_hardened_usercopy);
> >  static int __init set_hardened_usercopy(void)
> >  {
> >  	if (enable_checks == false)
> > -		static_branch_enable(&bypass_usercopy_checks);
> > +		static_branch_enable(&validate_usercopy_range);
> > +	else
> > +		static_branch_disable(&validate_usercopy_range);
> 
> This should be:
> 
> 	if (enable_checks)
> 		static_branch_enable(&validate_usercopy_range);
> 	else
> 		static_branch_disable(&validate_usercopy_range);
> 

Bah, fixed.

-- 
Mel Gorman
SUSE Labs

From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail18.out.titan.email (mail18.out.titan.email [3.64.226.212])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id F14AE381AF
	for <linux-hardening@vger.kernel.org>; Thu, 23 Jan 2025 11:49:06 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=3.64.226.212
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737632948; cv=none; b=Vp8GrkAxLXomObOi+r1NaB/ILUk0GumEZVMZ2GChztodqy/caDDtqPK4ayBONfq92JEafUVTOmomPhjbYgjNzPIrdnLdWYoeKs/OQJaAK6pQB4szkxsdFXCDdqoexB3/5IEW7qmGelRg+EtAG8fa6y1/LroM+y9itQSSY4LVTI8=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737632948; c=relaxed/simple;
	bh=q6Ce8a8ia9M08AhZl4src3xmI/3FgOzW9RTWMSokC4Y=;
	h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version:
	 Content-Type:Content-Disposition:In-Reply-To; b=qP6x7gCzVmQWBlJTn9GYWs2Gy1ktlBChQIX9+96xrk45yFy1ChXDyUHf8Ma1FAZ3On//68LGJ+MH9Z5EabOsvdK/rWqtFvP+VeZ7a7qcDjLI8qH6XTJiXOSnQLZEzbSDQ9l+NRWaXLkhnXr3o8tF3Kn4GN4AmYLlviHGfhQdazw=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=Fc2Fd8EV; arc=none smtp.client-ip=3.64.226.212
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="Fc2Fd8EV"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id 74D23A009B;
	Thu, 23 Jan 2025 11:49:05 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=ca3oy/MkgvP9nayGTQfoqVybrGtRIU8AWKZ9G4JDDNk=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=from:subject:mime-version:date:cc:message-id:in-reply-to:references:to:from:to:cc:subject:date:message-id:in-reply-to:references:reply-to;
	q=dns/txt; s=titan1; t=1737632945; v=1;
	b=Fc2Fd8EVVLUyGIxG4zcGYUeUT7INXNhnDCA+AvneGXRj5Z1xXWu1/Slx2kMJ2y2p5BhonEv+
	MO4xW9Qhqlc0iypnpwldr9C5I8FtDRC5LvYVKG5SzcJ1MiOowhcw8QH/zqV3ttOHI1M5hpGwEuI
	R8gu9uHJMwiXVKnZPxCawb/k=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id 06995A004B;
	Thu, 23 Jan 2025 11:49:04 +0000 (UTC)
Date: Thu, 23 Jan 2025 11:49:04 +0000
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>, Paul Moore <paul@paul-moore.com>, 
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 0/4] Allow default HARDENED_USERCOPY to be set at
 compile time
Message-ID: <ztewg4ohtq7iojoilwcuq2ozczfxv5gi2r3svh3l5n6fv6kvfl@etevudcdw7un>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
 <202501221701.61D4E17@keescook>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-15
Content-Disposition: inline
In-Reply-To: <202501221701.61D4E17@keescook>
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737632945357488593.9138.4954938538875649607@prod-euc1-smtp-out1002.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=UdNXSrSN c=1 sm=1 tr=0 ts=67922cb1
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=Q9fys5e9bTEA:10 a=CEWIc4RMnpUA:10 a=vcvqyVX0pnVXJpUJokUA:9
	a=PUjeQqilurYA:10
X-Virus-Scanned: ClamAV using ClamSMTP

On Wed, Jan 22, 2025 at 05:02:29PM -0800, Kees Cook wrote:
> On Wed, Jan 22, 2025 at 05:19:21PM +0000, Mel Gorman wrote:
> > on the exact CPU. While the benchmarks are somewhat synthetic, the overhead
> > IO-intensive and network-intensive is easily detectable but the root cause
> > may not be obvious (e.g. 2-14% overhead for netperf TCP_STREAM running
> > over localhost with different ranges depending on the CPU).
> 
> I would be curious to see where this overhead is coming from. That seems
> extraordinarily high, and makes me think there is something more we
> should be fixing. :)
> 

Almost certainly yes, it could be anything really but the results are
consistent. It'll be somewhat tricky to narrow down given that it's
somewhat specific to the CPU. It was outside the scope of the series to
investigate. The primary aim was to provide the option to have hardened
usercopy available, but not surprising from a performance perspective,
via a single kernel binary.

-- 
Mel Gorman
SUSE Labs

From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail-wm1-f49.google.com (mail-wm1-f49.google.com [209.85.128.49])
	(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04DB18BF8;
	Thu, 23 Jan 2025 21:10:13 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.49
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737666615; cv=none; b=VZak9x46x6hqdL85vXva49ZcZmPjR65pVVa6nzH7wQdkDHe6ApDxKsNlnDkKb65AnifkaHAKXgGvUXwAF127K8+q+N5TYJVzMPKEH9SFB09xbuJBhnmB42sOAe52qw6hI8JeMG/sZObtjZA1yTsQY3vSck3tJtPCXLouVFXwlKY=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737666615; c=relaxed/simple;
	bh=65JytxFvSWLAVcI5ORQpUmFvVR6gFZ7eOagOp6Lt+t8=;
	h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References:
	 MIME-Version:Content-Type; b=rvT1ZW4PpH9OIzEjbPlbE2syWYAc7tUTfY6mWGcd2dQnyaGTS7d3iKChACyi+q0kxm+hzuzzktjcL7GFZUmTDrskwwSf7pjPSJvm/YTBUBm6V7urd8/ioz0kTzkaxMW7iFuAkGbq2CYCcKDtQu4EWqPXdZPaJzyeseItOFNqU3o=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=UBviw0gK; arc=none smtp.client-ip=209.85.128.49
Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UBviw0gK"
Received: by mail-wm1-f49.google.com with SMTP id 5b1f17b1804b1-436341f575fso15150005e9.1;
        Thu, 23 Jan 2025 13:10:13 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=gmail.com; s=20230601; t=1737666612; x=1738271412; darn=vger.kernel.org;
        h=content-transfer-encoding:mime-version:references:in-reply-to
         :message-id:subject:cc:to:from:date:from:to:cc:subject:date
         :message-id:reply-to;
        bh=ELoXjbHMZaAjCLs6QPUpHBoArnQcIRTRV8IDYpOYDSk=;
        b=UBviw0gKjUdkSt4yAeURxSR7wVJMUGgeUSt/lEtD9L16lszu6U34YvMfjCMzVcZLop
         5WX9OAiXqNMqI+iYW1IbMRoSWNAbzQoLlNYzOw7ld56BDR0sJ2T9SaIilav1nMv8G92J
         tjChowbvidWLrSzyGjK98jP+H6F8U79qNh0x/0RuFZvsMmnrl+KvpCE3czdaH8vGx7uy
         6jaXgWpDPKqIoARvFjeN7tG8Ev8yreZzd77o6GLboxnc5pSGyumeVrCy2b6uVn/u1dth
         pGoL0m9kHH5kbEDJ5gnV2lZeySpH8c9JxHAYba/5vA4sCKMLKky7jyw0XqyBslNknh+A
         fvjA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1737666612; x=1738271412;
        h=content-transfer-encoding:mime-version:references:in-reply-to
         :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc
         :subject:date:message-id:reply-to;
        bh=ELoXjbHMZaAjCLs6QPUpHBoArnQcIRTRV8IDYpOYDSk=;
        b=QHUC5+iGhS4wo2942UrAiimxE8dohy8LBYrIn9jLkTfdEP+hP4XFFrBJYAjq/iSanf
         hSlFeTlnZ0B8in8PglgjhVOGLVKTFy7Wr1lNf6T2JCDfDzKsSIusYVFkeAh/cyCwWlyq
         TUgU9wQeuTzMU+5XAq0eqKOdyDUqizbVbQbS3Zsva61g/tcdZjMNZpJX9ej/1C4aO3DC
         tclvBriAUNFEOtxflSb+m/f0pTSk8KzV7zd5B1kWDeBaRKLixAbMToMKpbmoo7ARUGuf
         lXnaO0OJJVkRbfB9iFSQ2owp3bzImERmJzWOyl8gSNGvIWtlSGvgrIK/kHc/5x2FBoTf
         8iww==
X-Forwarded-Encrypted: i=1; AJvYcCU7W5OFzm6Yi4o0F21v5ir+IVs+hgeJ9iV571cdAaRCwggr6xXKZqt2qNR5ZOrFFunEH3ctOxHvsOk0+hKLy7U=@vger.kernel.org, AJvYcCUXpzcpiWgyZI7JWYwfitHysB3wukwXgE2/+zCne/ZveZY6HABE5P5CJ4aVB8uDfArcp0MfzQtTx/ZTfg3p@vger.kernel.org
X-Gm-Message-State: AOJu0Ywt6+Ph8MALNW44kPrRAJIkE5l1dc5XF9jx1JHYc6ycFhQKWibK
	0W/PK1sly+uoWkZbCU5rcS/Ji4pYGIfqk9HFiHqzucG9WKQzDTzB
X-Gm-Gg: ASbGncuc8CPnd+v/2+JN4mkuI+c1TNe4f7Q6HjS7w5Lywl8+598+/zaLLqLZyx5NLxP
	m1tEsoTAV/Jvcdaso/Gog3J1PgYAIAloNwp7T1PrYrbQj5+Up0bs9KQPg0IVlFQUiLwHoWsI4m6
	vGqkEVoDAENuRxar4FKk5I067NU4cDhlvvpzMBqvC4K86c0RABYrRQTeKSFkXbUXSmLKgkqq/d1
	bW5WOKf7Lm7uz8X21XlYSPpY6wwtzaFX+tvn/er0UNDWfEFMjygeLAGmJXtOzOY4BZKtYTuaxZd
	A9qkbbK4HeowgIeT/WjSjIxiOUMo48AEMgG7xRMb3Ug=
X-Google-Smtp-Source: AGHT+IHONke18rRnIkOTfp3jmTN6U3hXsf1EJcv0H5TdYIrzUApS6hiUKgStERhvikWZUTNlM28Mhw==
X-Received: by 2002:a05:600c:3c82:b0:434:f5c0:329f with SMTP id 5b1f17b1804b1-438913f08a2mr296700415e9.14.1737666611949;
        Thu, 23 Jan 2025 13:10:11 -0800 (PST)
Received: from pumpkin (82-69-66-36.dsl.in-addr.zen.co.uk. [82.69.66.36])
        by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-438bd47f355sm4019755e9.4.2025.01.23.13.10.11
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Thu, 23 Jan 2025 13:10:11 -0800 (PST)
Date: Thu, 23 Jan 2025 21:10:10 +0000
From: David Laight <david.laight.linux@gmail.com>
To: Kees Cook <kees@kernel.org>
Cc: Mel Gorman <mgorman@techsingularity.net>, Daniel Micay
 <danielmicay@gmail.com>, Paul Moore <paul@paul-moore.com>,
 linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/4] mm: security: Allow default HARDENED_USERCOPY to be
 set at compile time
Message-ID: <20250123211010.4ec97055@pumpkin>
In-Reply-To: <202501221651.3F5A6ACD@keescook>
References: <20250122171925.25472-1-mgorman@techsingularity.net>
	<20250122171925.25472-3-mgorman@techsingularity.net>
	<202501221651.3F5A6ACD@keescook>
X-Mailer: Claws Mail 4.1.1 (GTK 3.24.38; arm-unknown-linux-gnueabihf)
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

...  
> > +config HARDENED_USERCOPY_DEFAULT_ON
> > +	bool "Harden memory copies by default"
> > +	depends on HARDENED_USERCOPY
> > +	default n  
> 
> This must be "default HARDENED_USERCOPY" or existing distro builds will
> break. All major distros enable this by default, and I don't want to
> risk HARDENED_USERCOPY_DEFAULT_ON getting missed and getting globally
> disabled.

It'll also cause grief for anyone trying to bisect.
Although that is always going to go wrong if it has been disabled.

I had 'fun' trying to locate a massive slowdown of a single threaded
program that was caused by a side effect of one of the speculative
execution mitigations getting enabled because the config parameter
got renamed.

	David

From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from mail17.out.titan.email (mail17.out.titan.email [3.64.226.211])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(No client certificate requested)
	by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F8691CD1FD
	for <linux-hardening@vger.kernel.org>; Thu, 23 Jan 2025 22:11:56 +0000 (UTC)
Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=3.64.226.211
ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;
	t=1737670318; cv=none; b=r94oSmMUPFf5PpKW0AJkdel8YM5ND68eG4ZertpP9hPtajMEzcGk9dNJq9hSVwQdLeQcgXRr6NzKR52xp58gNonVrENXMkwX75JeotbktbPwdaNaU0mKdv3fvRRp18IMGLh6RadpchwwW00Gd75w3d209JKLpBPsmCaRQtcWFVE=
ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org;
	s=arc-20240116; t=1737670318; c=relaxed/simple;
	bh=7F+5jvc+5P/sz5xc4yVqe1Jr3GI4/itvnxM8dwxDcPA=;
	h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:
	 MIME-Version; b=bz4ljIAr9PUh16KLPX3Xxr0UWUCxVKThMFRCdij0IJk9VfB+tiOOC8mMnL1RoPqz2GptTFLiFcQmKcGRJvFLbVfxeI5e2jOmOY6D8sAP2PFquHS+ZC8PEqjpwz1vxMOzuYXsSYR6KuikfNVuahciGOAgeNaVTGFbI0gmxy35HhE=
ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net; spf=pass smtp.mailfrom=techsingularity.net; dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b=CRUij8AZ; arc=none smtp.client-ip=3.64.226.211
Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=techsingularity.net
Authentication-Results: smtp.subspace.kernel.org;
	dkim=pass (1024-bit key) header.d=techsingularity.net header.i=@techsingularity.net header.b="CRUij8AZ"
Received: from smtp-out0101.titan.email (localhost [127.0.0.1])
	by smtp-out0101.titan.email (Postfix) with ESMTP id B641DA0015;
	Thu, 23 Jan 2025 22:11:48 +0000 (UTC)
DKIM-Signature: a=rsa-sha256; bh=LDgPNBesSofxnnV2IL91tTTGVUzCXnETfSmwHDCUeSU=;
	c=relaxed/relaxed; d=techsingularity.net;
	h=in-reply-to:references:to:subject:message-id:from:cc:date:mime-version:from:to:cc:subject:date:message-id:in-reply-to:references:reply-to;
	q=dns/txt; s=titan1; t=1737670308; v=1;
	b=CRUij8AZFPt0Exj3zpOfp3z8RqOCTxBGGzAHQlm722e38XuRDcnIEhEO8yoCho8zwEUQ6BmY
	mZFdCVp6Axzrsya4tUZFsaRw3nJqqwUzGcLx4ATZvAa52xgUwyr4E/PLxiV4soIAR/ieAwJVx6D
	Q6eUtXl7g/YuKhLdAyxH0N34=
Received: from mail.blacknight.com (ip-84-203-196-66.broadband.digiweb.ie [84.203.196.66])
	by smtp-out0101.titan.email (Postfix) with ESMTPA id 3FAE2A0010;
	Thu, 23 Jan 2025 22:11:48 +0000 (UTC)
Feedback-ID: :mgorman@techsingularity.net:techsingularity.net:flockmailId
From: Mel Gorman <mgorman@techsingularity.net>
To: Kees Cook <kees@kernel.org>
Cc: Daniel Micay <danielmicay@gmail.com>,
	Paul Moore <paul@paul-moore.com>,
	linux-hardening@vger.kernel.org,
	linux-kernel@vger.kernel.org,
	Mel Gorman <mgorman@techsingularity.net>
Subject: [PATCH 2/4] mm: security: Allow default HARDENED_USERCOPY to be set at compile time
Date: Thu, 23 Jan 2025 22:11:13 +0000
Message-ID: <20250123221115.19722-3-mgorman@techsingularity.net>
X-Mailer: git-send-email 2.43.0
In-Reply-To: <20250123221115.19722-1-mgorman@techsingularity.net>
References: <20250123221115.19722-1-mgorman@techsingularity.net>
Precedence: bulk
X-Mailing-List: linux-hardening@vger.kernel.org
List-Id: <linux-hardening.vger.kernel.org>
List-Subscribe: <mailto:linux-hardening+subscribe@vger.kernel.org>
List-Unsubscribe: <mailto:linux-hardening+unsubscribe@vger.kernel.org>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
X-F-Verdict: SPFVALID
X-Titan-Src-Out: 1737670308635311287.9138.9018554698350676250@prod-euc1-smtp-out1002.
X-CMAE-Score: 0
X-CMAE-Analysis: v=2.4 cv=UdNXSrSN c=1 sm=1 tr=0 ts=6792bea4
	a=jU4EnjUUC1PH4wSjvv7Pww==:117 a=jU4EnjUUC1PH4wSjvv7Pww==:17
	a=CEWIc4RMnpUA:10 a=R_Myd5XaAAAA:8 a=0z80O7jHjOjBg2F2ajAA:9
	a=L2g4Dz8VuBQ37YGmWQah:22
X-Virus-Scanned: ClamAV using ClamSMTP

HARDENED_USERCOPY defaults to on if enabled at compile time. Allow
hardened_usercopy= default to be set at compile time similar to
init_on_alloc= and init_on_free=. The intent is that hardening
options that can be disabled at runtime can set their default at
build time.

Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
---
 Documentation/admin-guide/kernel-parameters.txt | 4 +++-
 mm/usercopy.c                                   | 3 ++-
 security/Kconfig.hardening                      | 8 ++++++++
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index 3872bc6ec49d..5d759b20540a 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -1773,7 +1773,9 @@
 			allocation boundaries as a proactive defense
 			against bounds-checking flaws in the kernel's
 			copy_to_user()/copy_from_user() interface.
-		on	Perform hardened usercopy checks (default).
+			The default is determined by
+			CONFIG_HARDENED_USERCOPY_DEFAULT_ON.
+		on	Perform hardened usercopy checks.
 		off	Disable hardened usercopy checks.
 
 	hardlockup_all_cpu_backtrace=
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 83c164aba6e0..4cf33305347a 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -255,7 +255,8 @@ void __check_object_size(const void *ptr, unsigned long n, bool to_user)
 }
 EXPORT_SYMBOL(__check_object_size);
 
-static bool enable_checks __initdata = true;
+static bool enable_checks __initdata =
+		IS_ENABLED(CONFIG_HARDENED_USERCOPY_DEFAULT_ON);
 
 static int __init parse_hardened_usercopy(char *str)
 {
diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
index 9088d613d519..3a941cc45396 100644
--- a/security/Kconfig.hardening
+++ b/security/Kconfig.hardening
@@ -293,6 +293,14 @@ config HARDENED_USERCOPY
 	  or are part of the kernel text. This prevents entire classes
 	  of heap overflow exploits and similar kernel memory exposures.
 
+config HARDENED_USERCOPY_DEFAULT_ON
+	bool "Harden memory copies by default"
+	depends on HARDENED_USERCOPY
+	default HARDENED_USERCOPY
+	help
+	  This has the effect of setting "hardened_usercopy=on" on the kernel
+	  command line. This can be disabled with "hardened_usercopy=off".
+
 endmenu
 
 menu "Hardening of kernel data structures"
-- 
2.43.0


