linux-toradex.git/mm/usercopy.c, branch v6.0-rc7

usercopy: use unsigned long instead of uintptr_t

2022-07-02T00:03:38+00:00

A recent commit factored out a series of annoying (unsigned long) casts
into a single variable declaration, but made the pointer type a
`uintptr_t` rather than the usual `unsigned long`. This patch changes it
to be the integer type more typically used by the kernel to represent
addresses.

Fixes: 35fb9ae4aa2e ("usercopy: Cast pointer to an integer once")
Cc: Matthew Wilcox 
Cc: Uladzislau Rezki 
Cc: Greg Kroah-Hartman 
Cc: Linus Torvalds 
Cc: Joe Perches 
Signed-off-by: Jason A. Donenfeld 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220616143617.449094-1-Jason@zx2c4.com

usercopy: Make usercopy resilient against ridiculously large copies

2022-06-13T16:54:52+00:00

If 'n' is so large that it's negative, we might wrap around and mistakenly
think that the copy is OK when it's not.  Such a copy would probably
crash, but just doing the arithmetic in a more simple way lets us detect
and refuse this case.

Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-4-willy@infradead.org

usercopy: Cast pointer to an integer once

2022-06-13T16:54:52+00:00

Get rid of a lot of annoying casts by setting 'addr' once at the top
of the function.

Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-3-willy@infradead.org

usercopy: Handle vm_map_ram() areas

2022-06-13T16:54:52+00:00

vmalloc does not allocate a vm_struct for vm_map_ram() areas.  That causes
us to deny usercopies from those areas.  This affects XFS which uses
vm_map_ram() for its directories.

Fix this by calling find_vmap_area() instead of find_vm_area().

Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
Signed-off-by: Matthew Wilcox (Oracle) 
Reviewed-by: Uladzislau Rezki (Sony) 
Tested-by: Zorro Lang 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220612213227.3881769-2-willy@infradead.org

mm: usercopy: move the virt_addr_valid() below the is_vmalloc_addr()

2022-05-16T23:02:21+00:00

The is_kmap_addr() and the is_vmalloc_addr() in the check_heap_object()
will not work, because the virt_addr_valid() will exclude the kmap and
vmalloc regions. So let's move the virt_addr_valid() below
the is_vmalloc_addr().

Signed-off-by: Yuanzheng Song 
Fixes: 4e140f59d285 ("mm/usercopy: Check kmap addresses properly")
Fixes: 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
Cc: Matthew Wilcox (Oracle) 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220505071037.4121100-1-songyuanzheng@huawei.com

usercopy: Remove HARDENED_USERCOPY_PAGESPAN

2022-04-13T19:15:52+00:00

There isn't enough information to make this a useful check any more;
the useful parts of it were moved in earlier patches, so remove this
set of checks now.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Reviewed-by: David Hildenbrand 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-5-willy@infradead.org

mm/usercopy: Detect large folio overruns

2022-04-13T19:15:51+00:00

Move the compound page overrun detection out of
CONFIG_HARDENED_USERCOPY_PAGESPAN and convert it to use folios so it's
enabled for more people.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Reviewed-by: David Hildenbrand 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-4-willy@infradead.org

mm/usercopy: Detect vmalloc overruns

2022-04-13T19:15:51+00:00

If you have a vmalloc() allocation, or an address from calling vmap(),
you cannot overrun the vm_area which describes it, regardless of the
size of the underlying allocation.  This probably doesn't do much for
security because vmalloc comes with guard pages these days, but it
prevents usercopy aborts when copying to a vmap() of smaller pages.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-3-willy@infradead.org

mm/usercopy: Check kmap addresses properly

2022-04-13T19:15:50+00:00

If you are copying to an address in the kmap region, you may not copy
across a page boundary, no matter what the size of the underlying
allocation.  You can't kmap() a slab page because slab pages always
come from low memory.

Signed-off-by: Matthew Wilcox (Oracle) 
Acked-by: Kees Cook 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220110231530.665970-2-willy@infradead.org

Merge branch 'akpm' (patches from Andrew)

2022-03-22T23:11:53+00:00

Merge updates from Andrew Morton:

 - A few misc subsystems: kthread, scripts, ntfs, ocfs2, block, and vfs

 - Most the MM patches which precede the patches in Willy's tree: kasan,
   pagecache, gup, swap, shmem, memcg, selftests, pagemap, mremap,
   sparsemem, vmalloc, pagealloc, memory-failure, mlock, hugetlb,
   userfaultfd, vmscan, compaction, mempolicy, oom-kill, migration, thp,
   cma, autonuma, psi, ksm, page-poison, madvise, memory-hotplug, rmap,
   zswap, uaccess, ioremap, highmem, cleanups, kfence, hmm, and damon.

* emailed patches from Andrew Morton : (227 commits)
  mm/damon/sysfs: remove repeat container_of() in damon_sysfs_kdamond_release()
  Docs/ABI/testing: add DAMON sysfs interface ABI document
  Docs/admin-guide/mm/damon/usage: document DAMON sysfs interface
  selftests/damon: add a test for DAMON sysfs interface
  mm/damon/sysfs: support DAMOS stats
  mm/damon/sysfs: support DAMOS watermarks
  mm/damon/sysfs: support schemes prioritization
  mm/damon/sysfs: support DAMOS quotas
  mm/damon/sysfs: support DAMON-based Operation Schemes
  mm/damon/sysfs: support the physical address space monitoring
  mm/damon/sysfs: link DAMON for virtual address spaces monitoring
  mm/damon: implement a minimal stub for sysfs-based DAMON interface
  mm/damon/core: add number of each enum type values
  mm/damon/core: allow non-exclusive DAMON start/stop
  Docs/damon: update outdated term 'regions update interval'
  Docs/vm/damon/design: update DAMON-Idle Page Tracking interference handling
  Docs/vm/damon: call low level monitoring primitives the operations
  mm/damon: remove unnecessary CONFIG_DAMON option
  mm/damon/paddr,vaddr: remove damon_{p,v}a_{target_valid,set_operations}()
  mm/damon/dbgfs-test: fix is_target_id() change
  ...