Skip to content

Commit 04385fc

Browse files
committed
mm: SLAB hardened usercopy support
Under CONFIG_HARDENED_USERCOPY, this adds object size checking to the SLAB allocator to catch any copies that may span objects. Based on code from PaX and grsecurity. Signed-off-by: Kees Cook <[email protected]> Tested-by: Valdis Kletnieks <[email protected]>
1 parent 97433ea commit 04385fc

File tree

2 files changed

+31
-0
lines changed

2 files changed

+31
-0
lines changed

init/Kconfig

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1758,6 +1758,7 @@ choice
17581758

17591759
config SLAB
17601760
bool "SLAB"
1761+
select HAVE_HARDENED_USERCOPY_ALLOCATOR
17611762
help
17621763
The regular slab allocator that is established and known to work
17631764
well in all environments. It organizes cache hot objects in

mm/slab.c

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4477,6 +4477,36 @@ static int __init slab_proc_init(void)
44774477
module_init(slab_proc_init);
44784478
#endif
44794479

4480+
#ifdef CONFIG_HARDENED_USERCOPY
4481+
/*
4482+
* Rejects objects that are incorrectly sized.
4483+
*
4484+
* Returns NULL if check passes, otherwise const char * to name of cache
4485+
* to indicate an error.
4486+
*/
4487+
const char *__check_heap_object(const void *ptr, unsigned long n,
4488+
struct page *page)
4489+
{
4490+
struct kmem_cache *cachep;
4491+
unsigned int objnr;
4492+
unsigned long offset;
4493+
4494+
/* Find and validate object. */
4495+
cachep = page->slab_cache;
4496+
objnr = obj_to_index(cachep, page, (void *)ptr);
4497+
BUG_ON(objnr >= cachep->num);
4498+
4499+
/* Find offset within object. */
4500+
offset = ptr - index_to_obj(cachep, page, objnr) - obj_offset(cachep);
4501+
4502+
/* Allow address range falling entirely within object size. */
4503+
if (offset <= cachep->object_size && n <= cachep->object_size - offset)
4504+
return NULL;
4505+
4506+
return cachep->name;
4507+
}
4508+
#endif /* CONFIG_HARDENED_USERCOPY */
4509+
44804510
/**
44814511
* ksize - get the actual amount of memory allocated for a given object
44824512
* @objp: Pointer to the object

0 commit comments

Comments
 (0)