[PATCH v3 02/11] mm: Hardened usercopy
From: mpe@ellerman.id.au (Michael Ellerman)
Date: 2016-07-21 06:52:09
Also in:
linuxppc-dev
Kees Cook [off-list ref] writes:
quoted hunk ↗ jump to hunk
diff --git a/mm/usercopy.c b/mm/usercopy.c new file mode 100644 index 000000000000..e4bf4e7ccdf6 --- /dev/null +++ b/mm/usercopy.c@@ -0,0 +1,234 @@
...
+
+/*
+ * Checks if a given pointer and length is contained by the current
+ * stack frame (if possible).
+ *
+ * 0: not at all on the stack
+ * 1: fully within a valid stack frame
+ * 2: fully on the stack (when can't do frame-checking)
+ * -1: error condition (invalid stack position or bad stack frame)
+ */
+static noinline int check_stack_object(const void *obj, unsigned long len)
+{
+ const void * const stack = task_stack_page(current);
+ const void * const stackend = stack + THREAD_SIZE;That allows access to the entire stack, including the struct thread_info, is that what we want - it seems dangerous? Or did I miss a check somewhere else? We have end_of_stack() which computes the end of the stack taking thread_info into account (end being the opposite of your end above). cheers