{"push_id":1396449059,"size":13,"distinct_size":13,"ref":"refs/heads/hardened_atomic_next","head":"6960bbbd6caa564cfec1220dd95185079838363d","before":"64b9392c3a0137fc4c445819dff05b86c5213e59","commits":[{"sha":"d4d3a7ed91f05d0dce32c63971eebb80e64d26c8","author":{"name":"Elena Reshetova","email":"ca7615e45606e9fb8cfe3ab86d8005547b5535f5@intel.com"},"message":"Add architecture independent hardened atomic base\n\nThis series brings the PaX/Grsecurity PAX_REFCOUNT [1]\nfeature support to the upstream kernel. All credit for the\nfeature goes to the feature authors.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nThe name of the upstream feature is HARDENED_ATOMIC\nand it is configured using CONFIG_HARDENED_ATOMIC and\nHAVE_ARCH_HARDENED_ATOMIC.\n\nThis series only adds x86 support; other architectures are expected\nto add similar support gradually.\n\nFeature Summary\n---------------\nThe primary goal of KSPP is to provide protection against classes\nof vulnerabilities.  One such class of vulnerabilities, known as\nuse-after-free bugs, frequently results when reference counters\nguarding shared kernel objects are overflowed.  The existence of\na kernel path in which a reference counter is incremented more\nthan it is decremented can lead to wrapping. This buggy path can be\nexecuted until INT_MAX/LONG_MAX is reached, at which point further\nincrements will cause the counter to wrap to 0.  At this point, the\nkernel will erroneously mark the object as not in use, resulting in\na multitude of undesirable cases: releasing the object to other users,\nfreeing the object while it still has legitimate users, or other\nundefined conditions.  The above scenario is known as a use-after-free\nbug.\n\nHARDENED_ATOMIC provides mandatory protection against kernel\nreference counter overflows.  In Linux, reference counters\nare implemented using the atomic_t and atomic_long_t types.\nHARDENED_ATOMIC modifies the functions dealing with these types\nsuch that when INT_MAX/LONG_MAX is reached, the atomic variables\nremain saturated at these maximum values, rather than wrapping.\n\nThere are several non-reference counter users of atomic_t and\natomic_long_t (the fact that these types are being so widely\nmisused is not addressed by this series).  These users, typically\nstatistical counters, are not concerned with whether the values of\nthese types wrap, and therefore can dispense with the added performance\npenalty incurred from protecting against overflows. New types have\nbeen introduced for these users: atomic_wrap_t and atomic_long_wrap_t.\nFunctions for manipulating these types have been added as well.\n\nNote that the protection provided by HARDENED_ATOMIC is not \"opt-in\":\nsince atomic_t is so widely misused, it must be protected as-is.\nHARDENED_ATOMIC protects all users of atomic_t and atomic_long_t\nagainst overflow.  New users wishing to use atomic types, but not\nneeding protection against overflows, should use the new types\nintroduced by this series: atomic_wrap_t and atomic_long_wrap_t.\n\nBugs Prevented\n--------------\nHARDENED_ATOMIC would directly mitigate these Linux kernel bugs:\n\nCVE-2014-2851 - Group_info refcount overflow.\nExploit: https://www.exploit-db.com/exploits/32926/\n\nCVE-2016-0728 - Keyring refcount overflow.\nExploit: https://www.exploit-db.com/exploits/39277/\n\nCVE-2016-4558 - BPF reference count mishandling.\nExplot: https://www.exploit-db.com/exploits/39773/\n\n[1] https://forums.grsecurity.net/viewtopic.php?f=7&t=4173\n\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/d4d3a7ed91f05d0dce32c63971eebb80e64d26c8"},{"sha":"c3d2a270e6b16659b9b7c5634f884c5841c6156f","author":{"name":"Hans Liljestrand","email":"053f77a44023ee1acafc5543ae3028bf2cf45826@gmail.com"},"message":"percpu-refcount: leave atomic counter unprotected\n\nThis is a temporary solution, and a deviation from the PaX/Grsecurity\nimplementation where the counter in question is protected against\noverflows. That however necessitates decreasing the PERCPU_COUNT_BIAS\nwhich is used in lib/percpu-refcount.c. Such a change effectively cuts\nthe safe counter range down by half, and still allows the counter to,\nwithout warning, prematurely reach zero (which is what the bias aims to\nprevent).\n\nA slightly expanded summary follows. Please see percpu-refcount source\nfor more details, particularly lib/percup-refcount.c where the\naforementioned bias is set and documented.\n\nThe atomic counter (defined in include/linux/percpu-refcount.h) needs to\nbe updated in a non-atomic way.  This means that before all the percpu\nrefs are added the value could be off in either direction, but no more\nthan the actual \"true\" value of the counter. In order to prevent the\ncounter prematurely reaching zero, a bias is used to offset the range\nfrom [MIN,MAX] to [1,MAX]+[MIN,-1] (with \"zero\" in the middle, as far\nfrom 0 as possible).\n\nThe problem is then that if the atomic is protected it cannot wrap (and\nzero is already offset next to the \"wrap-barrier\", so it is practically\nguaranteed to do just that). One solution would be to decrease this\nbias, effectively cutting the safe range in half (now [1,MAX]). And\nwhile overflows at MAX would be caught, the counter could still\nprematurely reach zero. (Although since the counter can be off at most\nby it's true value, presumably an overflow would still trigger at some\npoint during the percpu ref additions, but not necessarily before zero\nhad been reached one or more times.)\n\nThe immediate solution would be to go with the bias decrease (and\ndocument the repercussions), but we have already seen some objections to\nthat due to the reasons above. Other solutions would seem to require\nmore comprehensive changes into how percpu-ref works, which we felt were\nnot suited for this patch series. We therefore decided to switch the\ncounter to an atomic_long_wrap_t and just document the issue for now.\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/c3d2a270e6b16659b9b7c5634f884c5841c6156f"},{"sha":"f388e8888f096bacd39b9944c848edb71a278418","author":{"name":"David Windsor","email":"21f63af8cd81206c42850ffb8da507a36a4c1586@gmail.com"},"message":"kernel: identify wrapping atomic usage\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/f388e8888f096bacd39b9944c848edb71a278418"},{"sha":"96ba23ca20f370266092b5123007c92e241a92e8","author":{"name":"David Windsor","email":"21f63af8cd81206c42850ffb8da507a36a4c1586@gmail.com"},"message":"mm: identify wrapping atomic usage\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/96ba23ca20f370266092b5123007c92e241a92e8"},{"sha":"476c82861544ea29a7da0e74cd46f8fc2f056d4a","author":{"name":"David Windsor","email":"21f63af8cd81206c42850ffb8da507a36a4c1586@gmail.com"},"message":"fs: identify wrapping atomic usage\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/476c82861544ea29a7da0e74cd46f8fc2f056d4a"},{"sha":"35749e447c539c48a98c86f3e8acd5c0b005f907","author":{"name":"David Windsor","email":"21f63af8cd81206c42850ffb8da507a36a4c1586@gmail.com"},"message":"net: identify wrapping atomic usage\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/35749e447c539c48a98c86f3e8acd5c0b005f907"},{"sha":"6662879568226f0a1cbfb5bbbcdff49f2bff9824","author":{"name":"Hans Liljestrand","email":"053f77a44023ee1acafc5543ae3028bf2cf45826@gmail.com"},"message":"net: atm: identify wrapping atomic usage\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version.\n\nChanges in net/atm/* required various corresponding\nchanges in drivers/atm/*, so altogether this is separated\nin patch of its own.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/6662879568226f0a1cbfb5bbbcdff49f2bff9824"},{"sha":"56a3a705740128be22f5cb1e38127be932028dad","author":{"name":"David Windsor","email":"21f63af8cd81206c42850ffb8da507a36a4c1586@gmail.com"},"message":"security: identify wrapping atomic usage\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/56a3a705740128be22f5cb1e38127be932028dad"},{"sha":"13cd3efed47cc83d239d4e96c3d51fed106d2b41","author":{"name":"David Windsor","email":"21f63af8cd81206c42850ffb8da507a36a4c1586@gmail.com"},"message":"drivers: identify wrapping atomic usage (part 1/2)\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version.\n\nThis might need more fine-grained split between\ndifferent drivers.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/13cd3efed47cc83d239d4e96c3d51fed106d2b41"},{"sha":"f2b9db6228f87bf933da83d4874bbee76496659e","author":{"name":"David Windsor","email":"21f63af8cd81206c42850ffb8da507a36a4c1586@gmail.com"},"message":"drivers: identify wrapping atomic usage (part 2/2)\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version.\n\nThis might need more fine-grained split between\ndifferent drivers.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/f2b9db6228f87bf933da83d4874bbee76496659e"},{"sha":"47112bdf3e281371ae7587341a9ca55238c8b3dd","author":{"name":"Hans Liljestrand","email":"053f77a44023ee1acafc5543ae3028bf2cf45826@gmail.com"},"message":"x86: identify wrapping atomic usage\n\nIn some cases atomic is not used for reference\ncounting and therefore should be allowed to overflow.\nIdentify such cases and make a switch to non-hardened\natomic version\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/47112bdf3e281371ae7587341a9ca55238c8b3dd"},{"sha":"4993884586d490a24a8133dd4a1eb46f3bdd5be7","author":{"name":"Elena Reshetova","email":"ca7615e45606e9fb8cfe3ab86d8005547b5535f5@intel.com"},"message":"x86: implementation for HARDENED_ATOMIC\n\nThis adds x86-specific code in order to support\nHARDENED_ATOMIC feature. When overflow is detected\nin atomic_t or atomic_long_t types, the counter is\ndecremented back by one (to keep it at INT_MAX or\nLONG_MAX) and issue is reported using BUG().\nThe side effect is that in both legitimate and\nnon-legitimate cases a counter cannot wrap.\n\nThe copyright for the original PAX_REFCOUNT code:\n  - all REFCOUNT code in general: PaX Team <pageexec@freemail.hu>\n  - various false positive fixes: Mathias Krause <minipli@googlemail.com>\n\nSigned-off-by: Elena Reshetova <elena.reshetova@intel.com>\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>\nSigned-off-by: David Windsor <dwindsor@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/4993884586d490a24a8133dd4a1eb46f3bdd5be7"},{"sha":"6960bbbd6caa564cfec1220dd95185079838363d","author":{"name":"Elena Reshetova","email":"ca7615e45606e9fb8cfe3ab86d8005547b5535f5@intel.com"},"message":"lkdtm: add tests for atomic over-/underflow\n\nThis adds additional tests for the remaining atomic functions.\nSince the bulk of the logic is identical, the\nfunctions are generated with macros.\nAlso adds debugfs entries for the manipulated atomic values,\nso that the saturation values can be validated after a test is executed.\n\nBased on work by Hans Liljestrand and AKASHI Takahiro.\n\nSigned-off-by: Kees Cook <keescook@chromium.org>\nSigned-off-by: Hans Liljestrand <ishkamiel@gmail.com>","distinct":true,"url":"https://api.github.com/repos/ereshetova/linux-stable/commits/6960bbbd6caa564cfec1220dd95185079838363d"}]}
{"actor":{"display_login":"ereshetova"}}