[PATCH 33/38] arm64: Implement thread_struct whitelist for hardened usercopy
From: Kees Cook <hidden>
Date: 2018-01-11 02:03:05
Also in:
linux-arm-kernel, linux-fsdevel, linux-mm, lkml, netdev
Subsystem:
arm64 port (aarch64 architecture), the rest · Maintainers:
Catalin Marinas, Will Deacon, Linus Torvalds
This whitelists the FPU register state portion of the thread_struct for copying to userspace, instead of the default entire structure. Cc: Catalin Marinas <catalin.marinas@arm.com> Cc: Will Deacon <redacted> Cc: Christian Borntraeger <redacted> Cc: Ingo Molnar <mingo@kernel.org> Cc: James Morse <james.morse@arm.com> Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org> Cc: Dave Martin <Dave.Martin@arm.com> Cc: zijun_hu <redacted> Cc: linux-arm-kernel@lists.infradead.org Signed-off-by: Kees Cook <redacted> --- arch/arm64/Kconfig | 1 + arch/arm64/include/asm/processor.h | 8 ++++++++ 2 files changed, 9 insertions(+)
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index a93339f5178f..c84477e6a884 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig@@ -90,6 +90,7 @@ config ARM64 select HAVE_ARCH_MMAP_RND_BITS select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT select HAVE_ARCH_SECCOMP_FILTER + select HAVE_ARCH_THREAD_STRUCT_WHITELIST select HAVE_ARCH_TRACEHOOK select HAVE_ARCH_TRANSPARENT_HUGEPAGE select HAVE_ARCH_VMAP_STACK
diff --git a/arch/arm64/include/asm/processor.h b/arch/arm64/include/asm/processor.h
index 023cacb946c3..e58a5864ec89 100644
--- a/arch/arm64/include/asm/processor.h
+++ b/arch/arm64/include/asm/processor.h@@ -113,6 +113,14 @@ struct thread_struct { struct debug_info debug; /* debugging */ }; +/* Whitelist the fpsimd_state for copying to userspace. */ +static inline void arch_thread_struct_whitelist(unsigned long *offset, + unsigned long *size) +{ + *offset = offsetof(struct thread_struct, fpsimd_state); + *size = sizeof(struct fpsimd_state); +} + #ifdef CONFIG_COMPAT #define task_user_tls(t) \ ({ \
--
2.7.4
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>