• Matt Redfearn's avatar
    signals: Move put_compat_sigset to compat.h to silence hardened usercopy · fde9fc76
    Matt Redfearn authored
    Since commit afcc90f8 ("usercopy: WARN() on slab cache usercopy
    region violations"), MIPS systems booting with a compat root filesystem
    emit a warning when copying compat siginfo to userspace:
    
    WARNING: CPU: 0 PID: 953 at mm/usercopy.c:81 usercopy_warn+0x98/0xe8
    Bad or missing usercopy whitelist? Kernel memory exposure attempt
    detected from SLAB object 'task_struct' (offset 1432, size 16)!
    Modules linked in:
    CPU: 0 PID: 953 Comm: S01logging Not tainted 4.16.0-rc2 #10
    Stack : ffffffff808c0000 0000000000000000 0000000000000001 65ac85163f3bdc4a
    	65ac85163f3bdc4a 0000000000000000 90000000ff667ab8 ffffffff808c0000
    	00000000000003f8 ffffffff808d0000 00000000000000d1 0000000000000000
    	000000000000003c 0000000000000000 ffffffff808c8ca8 ffffffff808d0000
    	ffffffff808d0000 ffffffff80810000 fffffc0000000000 ffffffff80785c30
    	0000000000000009 0000000000000051 90000000ff667eb0 90000000ff667db0
    	000000007fe0d938 0000000000000018 ffffffff80449958 0000000020052798
    	ffffffff808c0000 90000000ff664000 90000000ff667ab0 00000000100c0000
    	ffffffff80698810 0000000000000000 0000000000000000 0000000000000000
    	0000000000000000 0000000000000000 ffffffff8010d02c 65ac85163f3bdc4a
    	...
    Call Trace:
    [<ffffffff8010d02c>] show_stack+0x9c/0x130
    [<ffffffff80698810>] dump_stack+0x90/0xd0
    [<ffffffff80137b78>] __warn+0x100/0x118
    [<ffffffff80137bdc>] warn_slowpath_fmt+0x4c/0x70
    [<ffffffff8021e4a8>] usercopy_warn+0x98/0xe8
    [<ffffffff8021e68c>] __check_object_size+0xfc/0x250
    [<ffffffff801bbfb8>] put_compat_sigset+0x30/0x88
    [<ffffffff8011af24>] setup_rt_frame_n32+0xc4/0x160
    [<ffffffff8010b8b4>] do_signal+0x19c/0x230
    [<ffffffff8010c408>] do_notify_resume+0x60/0x78
    [<ffffffff80106f50>] work_notifysig+0x10/0x18
    ---[ end trace 88fffbf69147f48a ]---
    
    Commit 5905429a ("fork: Provide usercopy whitelisting for
    task_struct") noted that:
    
    "While the blocked and saved_sigmask fields of task_struct are copied to
    userspace (via sigmask_to_save() and setup_rt_frame()), it is always
    copied with a static length (i.e. sizeof(sigset_t))."
    
    However, this is not true in the case of compat signals, whose sigset
    is copied by put_compat_sigset and receives size as an argument.
    
    At most call sites, put_compat_sigset is copying a sigset from the
    current task_struct. This triggers a warning when
    CONFIG_HARDENED_USERCOPY is active. However, by marking this function as
    static inline, the warning can be avoided because in all of these cases
    the size is constant at compile time, which is allowed. The only site
    where this is not the case is handling the rt_sigpending syscall, but
    there the copy is being made from a stack local variable so does not
    trigger the warning.
    
    Move put_compat_sigset to compat.h, and mark it static inline. This
    fixes the WARN on MIPS.
    
    Fixes: afcc90f8 ("usercopy: WARN() on slab cache usercopy region violations")
    Signed-off-by: default avatarMatt Redfearn <matt.redfearn@mips.com>
    Acked-by: default avatarKees Cook <keescook@chromium.org>
    Cc: "Dmitry V . Levin" <ldv@altlinux.org>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: kernel-hardening@lists.openwall.com
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/18639/Signed-off-by: default avatarJames Hogan <jhogan@kernel.org>
    fde9fc76
compat.c 15.1 KB