From: Kees Cook <keescook@chromium.org>
To: Laura Abbott <labbott@fedoraproject.org>
Cc: Russell King <linux@arm.linux.org.uk>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>,
"linux-arm-kernel@lists.infradead.org"
<linux-arm-kernel@lists.infradead.org>,
LKML <linux-kernel@vger.kernel.org>,
Linux-MM <linux-mm@kvack.org>
Subject: Re: [PATCH] arm: Use kernel mm when updating section permissions
Date: Wed, 4 Nov 2015 17:13:59 -0800 [thread overview]
Message-ID: <CAGXu5jK69kytOxp1xaojsGO2JXcZ+u0iHuKWD9sis_LFaCUC9Q@mail.gmail.com> (raw)
In-Reply-To: <CAGXu5jLdZ_xFyokoXW5ZhUdTXf-O1MBLk83cG_AM_51PxXbH5A@mail.gmail.com>
On Wed, Nov 4, 2015 at 5:06 PM, Kees Cook <keescook@chromium.org> wrote:
> On Wed, Nov 4, 2015 at 5:00 PM, Laura Abbott <labbott@fedoraproject.org> wrote:
>> Currently, read only permissions are not being applied even
>> when CONFIG_DEBUG_RODATA is set. This is because section_update
>> uses current->mm for adjusting the page tables. current->mm
>> need not be equivalent to the kernel version. Use pgd_offset_k
>> to get the proper page directory for updating.
>>
>> Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
>> ---
>> I found this while trying to convince myself of something.
>> Dumping the page table via debugfs and writing to kernel text were both
>> showing the lack of mappings. This was observed on QEMU. Maybe it's just a
>> QEMUism but if not it probably should go to stable.
>
> Well that's weird! debugfs showed the actual permissions that lacked
> RO? I wonder what changed. I tested this both with debugfs and lkdtm's
> KERN_WRITE test when the patches originally landed.
The comment will need adjusting too. I have a memory of needing to use
current->mm to deal with some crazy errata and handling TLB flushes...
-Kees
--
Kees Cook
Chrome OS Security
WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <keescook@chromium.org>
To: Laura Abbott <labbott@fedoraproject.org>
Cc: Russell King <linux@arm.linux.org.uk>,
Catalin Marinas <catalin.marinas@arm.com>,
Will Deacon <will.deacon@arm.com>,
"linux-arm-kernel@lists.infradead.org"
<linux-arm-kernel@lists.infradead.org>,
LKML <linux-kernel@vger.kernel.org>,
Linux-MM <linux-mm@kvack.org>
Subject: Re: [PATCH] arm: Use kernel mm when updating section permissions
Date: Wed, 4 Nov 2015 17:13:59 -0800 [thread overview]
Message-ID: <CAGXu5jK69kytOxp1xaojsGO2JXcZ+u0iHuKWD9sis_LFaCUC9Q@mail.gmail.com> (raw)
In-Reply-To: <CAGXu5jLdZ_xFyokoXW5ZhUdTXf-O1MBLk83cG_AM_51PxXbH5A@mail.gmail.com>
On Wed, Nov 4, 2015 at 5:06 PM, Kees Cook <keescook@chromium.org> wrote:
> On Wed, Nov 4, 2015 at 5:00 PM, Laura Abbott <labbott@fedoraproject.org> wrote:
>> Currently, read only permissions are not being applied even
>> when CONFIG_DEBUG_RODATA is set. This is because section_update
>> uses current->mm for adjusting the page tables. current->mm
>> need not be equivalent to the kernel version. Use pgd_offset_k
>> to get the proper page directory for updating.
>>
>> Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
>> ---
>> I found this while trying to convince myself of something.
>> Dumping the page table via debugfs and writing to kernel text were both
>> showing the lack of mappings. This was observed on QEMU. Maybe it's just a
>> QEMUism but if not it probably should go to stable.
>
> Well that's weird! debugfs showed the actual permissions that lacked
> RO? I wonder what changed. I tested this both with debugfs and lkdtm's
> KERN_WRITE test when the patches originally landed.
The comment will need adjusting too. I have a memory of needing to use
current->mm to deal with some crazy errata and handling TLB flushes...
-Kees
--
Kees Cook
Chrome OS Security
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
WARNING: multiple messages have this Message-ID (diff)
From: keescook@chromium.org (Kees Cook)
To: linux-arm-kernel@lists.infradead.org
Subject: [PATCH] arm: Use kernel mm when updating section permissions
Date: Wed, 4 Nov 2015 17:13:59 -0800 [thread overview]
Message-ID: <CAGXu5jK69kytOxp1xaojsGO2JXcZ+u0iHuKWD9sis_LFaCUC9Q@mail.gmail.com> (raw)
In-Reply-To: <CAGXu5jLdZ_xFyokoXW5ZhUdTXf-O1MBLk83cG_AM_51PxXbH5A@mail.gmail.com>
On Wed, Nov 4, 2015 at 5:06 PM, Kees Cook <keescook@chromium.org> wrote:
> On Wed, Nov 4, 2015 at 5:00 PM, Laura Abbott <labbott@fedoraproject.org> wrote:
>> Currently, read only permissions are not being applied even
>> when CONFIG_DEBUG_RODATA is set. This is because section_update
>> uses current->mm for adjusting the page tables. current->mm
>> need not be equivalent to the kernel version. Use pgd_offset_k
>> to get the proper page directory for updating.
>>
>> Signed-off-by: Laura Abbott <labbott@fedoraproject.org>
>> ---
>> I found this while trying to convince myself of something.
>> Dumping the page table via debugfs and writing to kernel text were both
>> showing the lack of mappings. This was observed on QEMU. Maybe it's just a
>> QEMUism but if not it probably should go to stable.
>
> Well that's weird! debugfs showed the actual permissions that lacked
> RO? I wonder what changed. I tested this both with debugfs and lkdtm's
> KERN_WRITE test when the patches originally landed.
The comment will need adjusting too. I have a memory of needing to use
current->mm to deal with some crazy errata and handling TLB flushes...
-Kees
--
Kees Cook
Chrome OS Security
next prev parent reply other threads:[~2015-11-05 1:14 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-11-05 1:00 [PATCH] arm: Use kernel mm when updating section permissions Laura Abbott
2015-11-05 1:00 ` Laura Abbott
2015-11-05 1:00 ` Laura Abbott
2015-11-05 1:06 ` Kees Cook
2015-11-05 1:06 ` Kees Cook
2015-11-05 1:06 ` Kees Cook
2015-11-05 1:13 ` Kees Cook [this message]
2015-11-05 1:13 ` Kees Cook
2015-11-05 1:13 ` Kees Cook
2015-11-05 9:46 ` Russell King - ARM Linux
2015-11-05 9:46 ` Russell King - ARM Linux
2015-11-05 9:46 ` Russell King - ARM Linux
2015-11-05 16:20 ` Laura Abbott
2015-11-05 16:20 ` Laura Abbott
2015-11-05 16:20 ` Laura Abbott
2015-11-05 16:27 ` Russell King - ARM Linux
2015-11-05 16:27 ` Russell King - ARM Linux
2015-11-05 16:27 ` Russell King - ARM Linux
2015-11-06 1:05 ` Laura Abbott
2015-11-06 1:05 ` Laura Abbott
2015-11-06 1:05 ` Laura Abbott
2015-11-06 1:15 ` Kees Cook
2015-11-06 1:15 ` Kees Cook
2015-11-06 1:15 ` Kees Cook
2015-11-06 18:44 ` Laura Abbott
2015-11-06 18:44 ` Laura Abbott
2015-11-06 18:44 ` Laura Abbott
2015-11-06 19:08 ` Kees Cook
2015-11-06 19:08 ` Kees Cook
2015-11-06 19:08 ` Kees Cook
2015-11-06 19:12 ` Kees Cook
2015-11-06 19:12 ` Kees Cook
2015-11-06 19:12 ` Kees Cook
2015-11-06 20:11 ` Kevin Hilman
2015-11-06 20:11 ` Kevin Hilman
2015-11-06 20:11 ` Kevin Hilman
2015-11-06 20:28 ` Kees Cook
2015-11-06 20:28 ` Kees Cook
2015-11-06 20:28 ` Kees Cook
2015-11-06 21:06 ` Kevin Hilman
2015-11-06 21:06 ` Kevin Hilman
2015-11-06 21:06 ` Kevin Hilman
2015-11-06 21:19 ` Kees Cook
2015-11-06 21:19 ` Kees Cook
2015-11-06 21:19 ` Kees Cook
2015-11-06 22:37 ` Kevin Hilman
2015-11-06 22:37 ` Kevin Hilman
2015-11-06 22:37 ` Kevin Hilman
2015-11-06 23:05 ` Kevin Hilman
2015-11-06 23:05 ` Kevin Hilman
2015-11-06 23:05 ` Kevin Hilman
2015-11-06 23:47 ` Kees Cook
2015-11-06 23:47 ` Kees Cook
2015-11-06 23:47 ` Kees Cook
2015-11-06 20:46 ` Russell King - ARM Linux
2015-11-06 20:46 ` Russell King - ARM Linux
2015-11-06 20:46 ` Russell King - ARM Linux
2015-11-06 23:41 ` Laura Abbott
2015-11-06 23:41 ` Laura Abbott
2015-11-06 23:41 ` Laura Abbott
2015-11-06 23:49 ` Kees Cook
2015-11-06 23:49 ` Kees Cook
2015-11-06 23:49 ` Kees Cook
2015-11-07 0:20 ` Laura Abbott
2015-11-07 0:20 ` Laura Abbott
2015-11-07 0:20 ` Laura Abbott
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAGXu5jK69kytOxp1xaojsGO2JXcZ+u0iHuKWD9sis_LFaCUC9Q@mail.gmail.com \
--to=keescook@chromium.org \
--cc=catalin.marinas@arm.com \
--cc=labbott@fedoraproject.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=linux@arm.linux.org.uk \
--cc=will.deacon@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.