mm: remove HARDENED_USERCOPY_FALLBACK

This has served its purpose and is no longer used.  All usercopy
violations appear to have been handled by now, any remaining instances
(or new bugs) will cause copies to be rejected.

This isn't a direct revert of commit 2d891fbc3bb6 ("usercopy: Allow
strict enforcement of whitelists"); since usercopy_fallback is
effectively 0, the fallback handling is removed too.

This also removes the usercopy_fallback module parameter on slab_common.

Link: https://github.com/KSPP/linux/issues/153
Link: https://lkml.kernel.org/r/20210921061149.1091163-1-steve@sk2.org
Signed-off-by: Stephen Kitt <steve@sk2.org>
Suggested-by: Kees Cook <keescook@chromium.org>
Acked-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>	[defconfig change]
Acked-by: David Rientjes <rientjes@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E . Hallyn" <serge@hallyn.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/arch/powerpc/configs/skiroot_defconfig b/arch/powerpc/configs/skiroot_defconfig
index b806a5d3a695d70a4619db61e943d44db4fb1b79..c3ba614c973d672319fd952bb0abea86e700d299 100644 (file)
--- a/arch/powerpc/configs/skiroot_defconfig
+++ b/arch/powerpc/configs/skiroot_defconfig
@@ -275,7 +275,6 @@ CONFIG_NLS_UTF8=y
 CONFIG_ENCRYPTED_KEYS=y
 CONFIG_SECURITY=y
 CONFIG_HARDENED_USERCOPY=y
-# CONFIG_HARDENED_USERCOPY_FALLBACK is not set
 CONFIG_HARDENED_USERCOPY_PAGESPAN=y
 CONFIG_FORTIFY_SOURCE=y
 CONFIG_SECURITY_LOCKDOWN_LSM=y

diff --git a/include/linux/slab.h b/include/linux/slab.h
index 837cb16232ef4dfb6d2b863266106f9566cd4fc4..181045148b0654eae388e9c747c53a60ec4abc8a 100644 (file)
--- a/include/linux/slab.h
+++ b/include/linux/slab.h
@@ -142,8 +142,6 @@ struct mem_cgroup;
 void __init kmem_cache_init(void);
 bool slab_is_available(void);
 
-extern bool usercopy_fallback;
-
 struct kmem_cache *kmem_cache_create(const char *name, unsigned int size,
                        unsigned int align, slab_flags_t flags,
                        void (*ctor)(void *));

diff --git a/mm/slab.c b/mm/slab.c
index 64ec17a3bc2ba23468e9aed80ea20ff90f545475..da132a9ae6f8be6fd9744b0f9f464ad14fcb04ad 100644 (file)
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4204,19 +4204,6 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
            n <= cachep->useroffset - offset + cachep->usersize)
                return;
 
-       /*
-        * If the copy is still within the allocated object, produce
-        * a warning instead of rejecting the copy. This is intended
-        * to be a temporary method to find any missing usercopy
-        * whitelists.
-        */
-       if (usercopy_fallback &&
-           offset <= cachep->object_size &&
-           n <= cachep->object_size - offset) {
-               usercopy_warn("SLAB object", cachep->name, to_user, offset, n);
-               return;
-       }
-
        usercopy_abort("SLAB object", cachep->name, to_user, offset, n);
 }
 #endif /* CONFIG_HARDENED_USERCOPY */

diff --git a/mm/slab_common.c b/mm/slab_common.c
index ec2bb0beed757cf2b143920b07b43fafeb9169f5..e5d080a9300933cdde0eddb679ab34596825cd54 100644 (file)
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -37,14 +37,6 @@ LIST_HEAD(slab_caches);
 DEFINE_MUTEX(slab_mutex);
 struct kmem_cache *kmem_cache;
 
-#ifdef CONFIG_HARDENED_USERCOPY
-bool usercopy_fallback __ro_after_init =
-               IS_ENABLED(CONFIG_HARDENED_USERCOPY_FALLBACK);
-module_param(usercopy_fallback, bool, 0400);
-MODULE_PARM_DESC(usercopy_fallback,
-               "WARN instead of reject usercopy whitelist violations");
-#endif
-
 static LIST_HEAD(slab_caches_to_rcu_destroy);
 static void slab_caches_to_rcu_destroy_workfn(struct work_struct *work);
 static DECLARE_WORK(slab_caches_to_rcu_destroy_work,

diff --git a/mm/slub.c b/mm/slub.c
index e9a51dcf8bf9a0fd1138ed1057fa8508dcfc6ada..432145d7b4ec50c24872a71e4da3fbfc97612265 100644 (file)
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -4489,7 +4489,6 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
 {
        struct kmem_cache *s;
        unsigned int offset;
-       size_t object_size;
        bool is_kfence = is_kfence_address(ptr);
 
        ptr = kasan_reset_tag(ptr);
@@ -4522,19 +4521,6 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
            n <= s->useroffset - offset + s->usersize)
                return;
 
-       /*
-        * If the copy is still within the allocated object, produce
-        * a warning instead of rejecting the copy. This is intended
-        * to be a temporary method to find any missing usercopy
-        * whitelists.
-        */
-       object_size = slab_ksize(s);
-       if (usercopy_fallback &&
-           offset <= object_size && n <= object_size - offset) {
-               usercopy_warn("SLUB object", s->name, to_user, offset, n);
-               return;
-       }
-
        usercopy_abort("SLUB object", s->name, to_user, offset, n);
 }
 #endif /* CONFIG_HARDENED_USERCOPY */

diff --git a/security/Kconfig b/security/Kconfig
index 0ced7fd33e4d0d4bc5acf2570f95ff88c3562d17..d9698900c9b730d01ac99abe0327197f439c2660 100644 (file)
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -163,20 +163,6 @@ config HARDENED_USERCOPY
          or are part of the kernel text. This kills entire classes
          of heap overflow exploits and similar kernel memory exposures.
 
-config HARDENED_USERCOPY_FALLBACK
-       bool "Allow usercopy whitelist violations to fallback to object size"
-       depends on HARDENED_USERCOPY
-       default y
-       help
-         This is a temporary option that allows missing usercopy whitelists
-         to be discovered via a WARN() to the kernel log, instead of
-         rejecting the copy, falling back to non-whitelisted hardened
-         usercopy that checks the slab allocation size instead of the
-         whitelist size. This option will be removed once it seems like
-         all missing usercopy whitelists have been identified and fixed.
-         Booting with "slab_common.usercopy_fallback=Y/N" can change
-         this setting.
-
 config HARDENED_USERCOPY_PAGESPAN
        bool "Refuse to copy allocations that span multiple pages"
        depends on HARDENED_USERCOPY