path: root/security
diff options
authorKees Cook <>2016-09-07 09:54:34 -0700
committerKees Cook <>2016-09-07 11:33:26 -0700
commit8e1f74ea02cf4562404c48c6882214821552c13f (patch)
tree931135d5d5cf00255d596520bd59c4067d669c22 /security
parenta85d6b8242dc78ef3f4542a0f979aebcbe77fc4e (diff)
usercopy: remove page-spanning test for now
A custom allocator without __GFP_COMP that copies to userspace has been found in vmw_execbuf_process[1], so this disables the page-span checker by placing it behind a CONFIG for future work where such things can be tracked down later. [1] Reported-by: Vinson Lee <> Fixes: f5509cc18daa ("mm: Hardened usercopy") Signed-off-by: Kees Cook <>
Diffstat (limited to 'security')
1 files changed, 11 insertions, 0 deletions
diff --git a/security/Kconfig b/security/Kconfig
index da10d9b573a4..2dfc0ce4083e 100644
--- a/security/Kconfig
+++ b/security/Kconfig
@@ -147,6 +147,17 @@ config HARDENED_USERCOPY
or are part of the kernel text. This kills entire classes
of heap overflow exploits and similar kernel memory exposures.
+ bool "Refuse to copy allocations that span multiple pages"
+ depends on !COMPILE_TEST
+ help
+ When a multi-page allocation is done without __GFP_COMP,
+ hardened usercopy will reject attempts to copy it. There are,
+ however, several cases of this in the kernel that have not all
+ been removed. This config is intended to be used only while
+ trying to find such users.
source security/selinux/Kconfig
source security/smack/Kconfig
source security/tomoyo/Kconfig