ip: Define usercopy region in IP proto slab cache

The ICMP filters for IPv4 and IPv6 raw sockets need to be copied to/from
userspace. In support of usercopy hardening, this patch defines a region
in the struct proto slab cache in which userspace copy operations are
allowed.

example usage trace:

    net/ipv4/raw.c:
        raw_seticmpfilter(...):
            ...
            copy_from_user(&raw_sk(sk)->filter, ..., optlen)

        raw_geticmpfilter(...):
            ...
            copy_to_user(..., &raw_sk(sk)->filter, len)

    net/ipv6/raw.c:
        rawv6_seticmpfilter(...):
            ...
            copy_from_user(&raw6_sk(sk)->filter, ..., optlen)

        rawv6_geticmpfilter(...):
            ...
            copy_to_user(..., &raw6_sk(sk)->filter, len)

This region is known as the slab cache's usercopy region. Slab caches
can now check that each dynamically sized copy operation involving
cache-managed memory falls entirely within the slab's usercopy region.

This patch is modified from Brad Spengler/PaX Team's PAX_USERCOPY
whitelisting code in the last public patch of grsecurity/PaX based on my
understanding of the code. Changes or omissions from the original code are
mine and don't reflect the original grsecurity/PaX code.

Signed-off-by: David Windsor <dave@nullcore.net>
[kees: split from network patch, provide usage trace]
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Cc: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 33b70bfd1122f08f4897ea6a68eb51e3a74bb1e5..1b6fa4195ac952c8040f80d417cb26773fa6fe32 100644 (file)
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -970,6 +970,8 @@ struct proto raw_prot = {
        .hash              = raw_hash_sk,
        .unhash            = raw_unhash_sk,
        .obj_size          = sizeof(struct raw_sock),
+       .useroffset        = offsetof(struct raw_sock, filter),
+       .usersize          = sizeof_field(struct raw_sock, filter),
        .h.raw_hash        = &raw_v4_hashinfo,
 #ifdef CONFIG_COMPAT
        .compat_setsockopt = compat_raw_setsockopt,

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 761a473a07c526b0185770b2efec3e6fb9200a24..08a85fabdfd1dd2d4173f41fa0e3dc7c823ad2bf 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1272,6 +1272,8 @@ struct proto rawv6_prot = {
        .hash              = raw_hash_sk,
        .unhash            = raw_unhash_sk,
        .obj_size          = sizeof(struct raw6_sock),
+       .useroffset        = offsetof(struct raw6_sock, filter),
+       .usersize          = sizeof_field(struct raw6_sock, filter),
        .h.raw_hash        = &raw_v6_hashinfo,
 #ifdef CONFIG_COMPAT
        .compat_setsockopt = compat_rawv6_setsockopt,