Re: [PATCH v3 3/5] treewide: use get_random_u32() when possible

From: "Jason A. Donenfeld" <Jason@zx2c4.com>
To: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"patches@lists.linux.dev" <patches@lists.linux.dev>,
	"Andreas Noever" <andreas.noever@gmail.com>,
	"Andrew Morton" <akpm@linux-foundation.org>,
	"Andy Shevchenko" <andriy.shevchenko@linux.intel.com>,
	"Borislav Petkov" <bp@alien8.de>,
	"Catalin Marinas" <catalin.marinas@arm.com>,
	"Christoph Böhmwalder" <christoph.boehmwalder@linbit.com>,
	"Christoph Hellwig" <hch@lst.de>,
	"Daniel Borkmann" <daniel@iogearbox.net>,
	"Dave Airlie" <airlied@redhat.com>,
	"Dave Hansen" <dave.hansen@linux.intel.com>,
	"David S . Miller" <davem@davemloft.net>,
	"Eric Dumazet" <edumazet@google.com>,
	"Florian Westphal" <fw@strlen.de>,
	"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
	"H . Peter Anvin" <hpa@zytor.com>,
	"Heiko Carstens" <hca@linux.ibm.com>,
	"Helge Deller" <deller@gmx.de>,
	"Herbert Xu" <herbert@gondor.apana.org.au>,
	"Huacai Chen" <chenhuacai@kernel.org>,
	"Hugh Dickins" <hughd@google.com>,
	"Jakub Kicinski" <kuba@kernel.org>,
	"James E . J . Bottomley" <jejb@linux.ibm.com>,
	"Jan Kara" <jack@suse.com>, "Jason Gunthorpe" <jgg@ziepe.ca>,
	"Jens Axboe" <axboe@kernel.dk>,
	"Johannes Berg" <johannes@sipsolutions.net>,
	"Jonathan Corbet" <corbet@lwn.net>,
	"Jozsef Kadlecsik" <kadlec@netfilter.org>,
	"KP Singh" <kpsingh@kernel.org>,
	"Kees Cook" <keescook@chromium.org>,
	"Marco Elver" <elver@google.com>,
	"Mauro Carvalho Chehab" <mchehab@kernel.org>,
	"Michael Ellerman" <mpe@ellerman.id.au>,
	"Pablo Neira Ayuso" <pablo@netfilter.org>,
	"Paolo Abeni" <pabeni@redhat.com>,
	"Peter Zijlstra" <peterz@infradead.org>,
	"Richard Weinberger" <richard@nod.at>,
	"Russell King" <linux@armlinux.org.uk>,
	"Theodore Ts'o" <tytso@mit.edu>,
	"Thomas Bogendoerfer" <tsbogend@alpha.franken.de>,
	"Thomas Gleixner" <tglx@linutronix.de>,
	"Thomas Graf" <tgraf@suug.ch>,
	"Ulf Hansson" <ulf.hansson@linaro.org>,
	"Vignesh Raghavendra" <vigneshr@ti.com>,
	"WANG Xuerui" <kernel@xen0n.name>,
	"Will Deacon" <will@kernel.org>,
	"Yury Norov" <yury.norov@gmail.com>,
	"dri-devel@lists.freedesktop.org"
	<dri-devel@lists.freedesktop.org>,
	"kasan-dev@googlegroups.com" <kasan-dev@googlegroups.com>,
	"kernel-janitors@vger.kernel.org"
	<kernel-janitors@vger.kernel.org>,
	"linux-arm-kernel@lists.infradead.org"
	<linux-arm-kernel@lists.infradead.org>,
	"linux-block@vger.kernel.org" <linux-block@vger.kernel.org>,
	"linux-crypto@vger.kernel.org" <linux-crypto@vger.kernel.org>,
	"linux-doc@vger.kernel.org" <linux-doc@vger.kernel.org>,
	"linux-fsdevel@vger.kernel.org" <linux-fsdevel@vger.kernel.org>,
	"linux-media@vger.kernel.org" <linux-media@vger.kernel.org>,
	"linux-mips@vger.kernel.org" <linux-mips@vger.kernel.org>,
	"linux-mm@kvack.org" <linux-mm@kvack.org>,
	"linux-mmc@vger.kernel.org" <linux-mmc@vger.kernel.org>,
	"linux-mtd@lists.infradead.org" <linux-mtd@lists.infradead.org>,
	"linux-nvme@lists.infradead.org" <linux-nvme@lists.infradead.org>,
	"linux-parisc@vger.kernel.org" <linux-parisc@vger.kernel.org>,
	"linux-rdma@vger.kernel.org" <linux-rdma@vger.kernel.org>,
	"linux-s390@vger.kernel.org" <linux-s390@vger.kernel.org>,
	"linux-um@lists.infradead.org" <linux-um@lists.infradead.org>,
	"linux-usb@vger.kernel.org" <linux-usb@vger.kernel.org>,
	"linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>,
	"linuxppc-dev@lists.ozlabs.org" <linuxppc-dev@lists.ozlabs.org>,
	"loongarch@lists.linux.dev" <loongarch@lists.linux.dev>,
	"netdev@vger.kernel.org" <netdev@vger.kernel.org>,
	"sparclinux@vger.kernel.org" <sparclinux@vger.kernel.org>,
	"x86@kernel.org" <x86@kernel.org>,
	"Toke Høiland-Jørgensen" <toke@toke.dk>,
	"Chuck Lever" <chuck.lever@oracle.com>, "Jan Kara" <jack@suse.cz>
Subject: Re: [PATCH v3 3/5] treewide: use get_random_u32() when possible
Date: Fri, 7 Oct 2022 08:07:58 -0600	[thread overview]
Message-ID: <Y0Ayvov/KQmrIwTS@zx2c4.com> (raw)
In-Reply-To: <501b0fc3-6c67-657f-781e-25ee0283bc2e@csgroup.eu>

On Fri, Oct 07, 2022 at 04:57:24AM +0000, Christophe Leroy wrote:
> 
> 
> Le 07/10/2022 à 01:36, Jason A. Donenfeld a écrit :
> > On 10/6/22, Christophe Leroy <christophe.leroy@csgroup.eu> wrote:
> >>
> >>
> >> Le 06/10/2022 à 19:31, Christophe Leroy a écrit :
> >>>
> >>>
> >>> Le 06/10/2022 à 19:24, Jason A. Donenfeld a écrit :
> >>>> Hi Christophe,
> >>>>
> >>>> On Thu, Oct 6, 2022 at 11:21 AM Christophe Leroy
> >>>> <christophe.leroy@csgroup.eu> wrote:
> >>>>> Le 06/10/2022 à 18:53, Jason A. Donenfeld a écrit :
> >>>>>> The prandom_u32() function has been a deprecated inline wrapper around
> >>>>>> get_random_u32() for several releases now, and compiles down to the
> >>>>>> exact same code. Replace the deprecated wrapper with a direct call to
> >>>>>> the real function. The same also applies to get_random_int(), which is
> >>>>>> just a wrapper around get_random_u32().
> >>>>>>
> >>>>>> Reviewed-by: Kees Cook <keescook@chromium.org>
> >>>>>> Acked-by: Toke Høiland-Jørgensen <toke@toke.dk> # for sch_cake
> >>>>>> Acked-by: Chuck Lever <chuck.lever@oracle.com> # for nfsd
> >>>>>> Reviewed-by: Jan Kara <jack@suse.cz> # for ext4
> >>>>>> Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
> >>>>>> ---
> >>>>>
> >>>>>> diff --git a/arch/powerpc/kernel/process.c
> >>>>>> b/arch/powerpc/kernel/process.c
> >>>>>> index 0fbda89cd1bb..9c4c15afbbe8 100644
> >>>>>> --- a/arch/powerpc/kernel/process.c
> >>>>>> +++ b/arch/powerpc/kernel/process.c
> >>>>>> @@ -2308,6 +2308,6 @@ void notrace __ppc64_runlatch_off(void)
> >>>>>>     unsigned long arch_align_stack(unsigned long sp)
> >>>>>>     {
> >>>>>>         if (!(current->personality & ADDR_NO_RANDOMIZE) &&
> >>>>>> randomize_va_space)
> >>>>>> -             sp -= get_random_int() & ~PAGE_MASK;
> >>>>>> +             sp -= get_random_u32() & ~PAGE_MASK;
> >>>>>>         return sp & ~0xf;
> >>>>>
> >>>>> Isn't that a candidate for prandom_u32_max() ?
> >>>>>
> >>>>> Note that sp is deemed to be 16 bytes aligned at all time.
> >>>>
> >>>> Yes, probably. It seemed non-trivial to think about, so I didn't. But
> >>>> let's see here... maybe it's not too bad:
> >>>>
> >>>> If PAGE_MASK is always ~(PAGE_SIZE-1), then ~PAGE_MASK is
> >>>> (PAGE_SIZE-1), so prandom_u32_max(PAGE_SIZE) should yield the same
> >>>> thing? Is that accurate? And holds across platforms (this comes up a
> >>>> few places)? If so, I'll do that for a v4.
> >>>>
> >>>
> >>> On powerpc it is always (from arch/powerpc/include/asm/page.h) :
> >>>
> >>> /*
> >>>    * Subtle: (1 << PAGE_SHIFT) is an int, not an unsigned long. So if we
> >>>    * assign PAGE_MASK to a larger type it gets extended the way we want
> >>>    * (i.e. with 1s in the high bits)
> >>>    */
> >>> #define PAGE_MASK      (~((1 << PAGE_SHIFT) - 1))
> >>>
> >>> #define PAGE_SIZE        (1UL << PAGE_SHIFT)
> >>>
> >>>
> >>> So it would work I guess.
> >>
> >> But taking into account that sp must remain 16 bytes aligned, would it
> >> be better to do something like ?
> >>
> >> 	sp -= prandom_u32_max(PAGE_SIZE >> 4) << 4;
> >>
> >> 	return sp;
> > 
> > Does this assume that sp is already aligned at the beginning of the
> > function? I'd assume from the function's name that this isn't the
> > case?
> 
> Ah you are right, I overlooked it.

So I think to stay on the safe side, I'm going to go with
`prandom_u32_max(PAGE_SIZE)`. Sound good?

Jason