Re: [PATCH] add param that allows bootline control of hardened usercopy

[Christoph von Recklinghausen]

Add correct address for linux-mm

On 06/25/2018 11:08 AM, Chris von Recklinghausen wrote:
> Enabling HARDENED_USER_COPY causes measurable regressions in the
> networking performances, up to 8% under UDP flood.
>
> A generic distro may want to enable HARDENED_USER_COPY in their default
> kernel config, but at the same time, such distro may want to be able to
> avoid the performance penalties in with the default configuration and
> enable the stricter check on a per-boot basis.
>
> This change adds a config variable and a boot parameter to conditionally
> enable HARDENED_USER_COPY at boot time, and switch HUC to off if
> HUC_DEFAULT_OFF is set.
>
> Signed-off-by: Chris von Recklinghausen <creck...@redhat.com>
> ---
>  .../admin-guide/kernel-parameters.rst         |  2 ++
>  .../admin-guide/kernel-parameters.txt         |  3 ++
>  include/linux/thread_info.h                   |  7 +++++
>  mm/usercopy.c                                 | 28 +++++++++++++++++++
>  security/Kconfig                              | 10 +++++++
>  5 files changed, 50 insertions(+)
>
> diff --git a/Documentation/admin-guide/kernel-parameters.rst 
> b/Documentation/admin-guide/kernel-parameters.rst
> index b8d0bc07ed0a..c3035038e3ae 100644
> --- a/Documentation/admin-guide/kernel-parameters.rst
> +++ b/Documentation/admin-guide/kernel-parameters.rst
> @@ -100,6 +100,8 @@ parameter is applicable::
>       FB      The frame buffer device is enabled.
>       FTRACE  Function tracing enabled.
>       GCOV    GCOV profiling is enabled.
> +     HUC     Hardened usercopy is enabled
> +     HUCF    Hardened usercopy disabled at boot
>       HW      Appropriate hardware is enabled.
>       IA-64   IA-64 architecture is enabled.
>       IMA     Integrity measurement architecture is enabled.
> diff --git a/Documentation/admin-guide/kernel-parameters.txt 
> b/Documentation/admin-guide/kernel-parameters.txt
> index efc7aa7a0670..cd3354bc14d3 100644
> --- a/Documentation/admin-guide/kernel-parameters.txt
> +++ b/Documentation/admin-guide/kernel-parameters.txt
> @@ -816,6 +816,9 @@
>       disable=        [IPV6]
>                       See Documentation/networking/ipv6.txt.
>  
> +     enable_hardened_usercopy [HUC,HUCF]
> +                     Enable hardened usercopy checks
> +
>       disable_radix   [PPC]
>                       Disable RADIX MMU mode on POWER9
>  
> diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
> index 8d8821b3689a..140a36cc1c2c 100644
> --- a/include/linux/thread_info.h
> +++ b/include/linux/thread_info.h
> @@ -109,12 +109,19 @@ static inline int arch_within_stack_frames(const void * 
> const stack,
>  #endif
>  
>  #ifdef CONFIG_HARDENED_USERCOPY
> +#include <linux/jump_label.h>
> +
> +DECLARE_STATIC_KEY_FALSE(bypass_usercopy_checks);
> +
>  extern void __check_object_size(const void *ptr, unsigned long n,
>                                       bool to_user);
>  
>  static __always_inline void check_object_size(const void *ptr, unsigned long 
> n,
>                                             bool to_user)
>  {
> +     if (static_branch_likely(&bypass_usercopy_checks))
> +             return;
> +
>       if (!__builtin_constant_p(n))
>               __check_object_size(ptr, n, to_user);
>  }
> diff --git a/mm/usercopy.c b/mm/usercopy.c
> index e9e9325f7638..ce3996da1b2e 100644
> --- a/mm/usercopy.c
> +++ b/mm/usercopy.c
> @@ -279,3 +279,31 @@ void __check_object_size(const void *ptr, unsigned long 
> n, bool to_user)
>       check_kernel_text_object((const unsigned long)ptr, n, to_user);
>  }
>  EXPORT_SYMBOL(__check_object_size);
> +
> +DEFINE_STATIC_KEY_FALSE(bypass_usercopy_checks);
> +EXPORT_SYMBOL(bypass_usercopy_checks);
> +
> +#ifdef CONFIG_HUC_DEFAULT_OFF
> +#define HUC_DEFAULT false
> +#else
> +#define HUC_DEFAULT true
> +#endif
> +
> +static bool enable_huc_atboot = HUC_DEFAULT;
> +
> +static int __init parse_enable_usercopy(char *str)
> +{
> +     enable_huc_atboot = true;
> +     return 1;
> +}
> +
> +static int __init set_enable_usercopy(void)
> +{
> +     if (enable_huc_atboot == false)
> +             static_branch_enable(&bypass_usercopy_checks);
> +     return 1;
> +}
> +
> +__setup("enable_hardened_usercopy", parse_enable_usercopy);
> +
> +late_initcall(set_enable_usercopy);
> diff --git a/security/Kconfig b/security/Kconfig
> index c4302067a3ad..a6173897b85c 100644
> --- a/security/Kconfig
> +++ b/security/Kconfig
> @@ -189,6 +189,16 @@ config HARDENED_USERCOPY_PAGESPAN
>         been removed. This config is intended to be used only while
>         trying to find such users.
>  
> +config HUC_DEFAULT_OFF
> +     bool "allow CONFIG_HARDENED_USERCOPY to be configured but disabled"
> +     depends on HARDENED_USERCOPY
> +     help
> +       When CONFIG_HARDENED_USERCOPY is enabled, disable its
> +       functionality unless it is enabled via at boot time
> +       via the "enable_hardened_usercopy" boot parameter. This allows
> +       the functionality of hardened usercopy to be present but not
> +       impact performance unless it is needed.
> +
>  config FORTIFY_SOURCE
>       bool "Harden common str/mem functions against buffer overflows"
>       depends on ARCH_HAS_FORTIFY_SOURCE