From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03DCCC433F5 for ; Sun, 2 Sep 2018 17:34:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id BB18020843 for ; Sun, 2 Sep 2018 17:34:08 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BB18020843 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=vmware.com Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727145AbeIBVuQ (ORCPT ); Sun, 2 Sep 2018 17:50:16 -0400 Received: from ex13-edg-ou-001.vmware.com ([208.91.0.189]:48413 "EHLO EX13-EDG-OU-001.vmware.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726592AbeIBVuO (ORCPT ); Sun, 2 Sep 2018 17:50:14 -0400 Received: from sc9-mailhost3.vmware.com (10.113.161.73) by EX13-EDG-OU-001.vmware.com (10.113.208.155) with Microsoft SMTP Server id 15.0.1156.6; Sun, 2 Sep 2018 10:33:40 -0700 Received: from sc2-haas01-esx0118.eng.vmware.com (sc2-haas01-esx0118.eng.vmware.com [10.172.44.118]) by sc9-mailhost3.vmware.com (Postfix) with ESMTP id ADE924070E; Sun, 2 Sep 2018 10:33:42 -0700 (PDT) From: Nadav Amit To: Thomas Gleixner CC: , Ingo Molnar , , Arnd Bergmann , , Dave Hansen , Nadav Amit , Nadav Amit , Jiri Kosina , Andy Lutomirski , Masami Hiramatsu , Kees Cook , Peter Zijlstra Subject: [PATCH v2 0/6] x86/alternatives: text_poke() fixes Date: Sun, 2 Sep 2018 10:32:18 -0700 Message-ID: <20180902173224.30606-1-namit@vmware.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 Content-Type: text/plain Received-SPF: None (EX13-EDG-OU-001.vmware.com: namit@vmware.com does not designate permitted sender hosts) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch-set addresses some issues that were raised in a recent correspondence and might affect the security and the correctness of code patching. (Note that patching performance is not addressed by this patch-set). The main issue that the patches deal with is the fact that the fixmap PTEs that are used for patching are available for access from other cores and might be exploited. They are not even flushed from the TLB in remote cores, so the risk is even higher. Address this issue by introducing a temporary mm that is only used during patching. Unfortunately, due to init ordering, fixmap is still used during boot-time patching. Future patches can eliminate the need for it. The second issue is the missing lockdep assertion to ensure text_mutex is taken. It is actually not always taken, so fix the instances that were found not to take the lock (although they should be safe even without taking the lock). Finally, try to be more conservative and to map a single page, instead of two, when possible. This helps both security and performance. In addition, there is some cleanup of the patching code to make it more readable. v1->v2: - Partial revert of 9222f606506c added to 1/6 [masami] - Added Masami's reviewed-by tag RFC->v1: - Added handling of error in get_locked_pte() - Remove lockdep assertion, clarify text_mutex use instead [masami] - Comment fix [peterz] - Removed remainders of text_poke return value [masami] - Use __weak for poking_init instead of macros [masami] - Simplify error handling in poking_init [masami] Cc: Jiri Kosina Cc: Andy Lutomirski Cc: Masami Hiramatsu Cc: Kees Cook Cc: Peter Zijlstra Link: https://lkml.org/lkml/2018/8/24/586 Andy Lutomirski (1): x86/mm: temporary mm struct Nadav Amit (5): Fix "x86/alternatives: Lockdep-enforce text_mutex in text_poke*()" fork: provide a function for copying init_mm x86/alternatives: initializing temporary mm for patching x86/alternatives: use temporary mm for text poking x86/alternatives: remove text_poke() return value arch/x86/include/asm/mmu_context.h | 20 +++ arch/x86/include/asm/pgtable.h | 3 + arch/x86/include/asm/text-patching.h | 4 +- arch/x86/kernel/alternative.c | 175 +++++++++++++++++++++++---- arch/x86/mm/init_64.c | 29 +++++ include/linux/sched/task.h | 1 + init/main.c | 3 + kernel/fork.c | 24 +++- 8 files changed, 227 insertions(+), 32 deletions(-) -- 2.17.1 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Nadav Amit Subject: [PATCH v2 0/6] x86/alternatives: text_poke() fixes Date: Sun, 2 Sep 2018 10:32:18 -0700 Message-ID: <20180902173224.30606-1-namit@vmware.com> Mime-Version: 1.0 Content-Type: text/plain Return-path: Sender: linux-kernel-owner@vger.kernel.org To: Thomas Gleixner Cc: linux-kernel@vger.kernel.org, Ingo Molnar , x86@kernel.org, Arnd Bergmann , linux-arch@vger.kernel.org, Dave Hansen , Nadav Amit , Nadav Amit , Jiri Kosina , Andy Lutomirski , Masami Hiramatsu , Kees Cook , Peter Zijlstra List-Id: linux-arch.vger.kernel.org This patch-set addresses some issues that were raised in a recent correspondence and might affect the security and the correctness of code patching. (Note that patching performance is not addressed by this patch-set). The main issue that the patches deal with is the fact that the fixmap PTEs that are used for patching are available for access from other cores and might be exploited. They are not even flushed from the TLB in remote cores, so the risk is even higher. Address this issue by introducing a temporary mm that is only used during patching. Unfortunately, due to init ordering, fixmap is still used during boot-time patching. Future patches can eliminate the need for it. The second issue is the missing lockdep assertion to ensure text_mutex is taken. It is actually not always taken, so fix the instances that were found not to take the lock (although they should be safe even without taking the lock). Finally, try to be more conservative and to map a single page, instead of two, when possible. This helps both security and performance. In addition, there is some cleanup of the patching code to make it more readable. v1->v2: - Partial revert of 9222f606506c added to 1/6 [masami] - Added Masami's reviewed-by tag RFC->v1: - Added handling of error in get_locked_pte() - Remove lockdep assertion, clarify text_mutex use instead [masami] - Comment fix [peterz] - Removed remainders of text_poke return value [masami] - Use __weak for poking_init instead of macros [masami] - Simplify error handling in poking_init [masami] Cc: Jiri Kosina Cc: Andy Lutomirski Cc: Masami Hiramatsu Cc: Kees Cook Cc: Peter Zijlstra Link: https://lkml.org/lkml/2018/8/24/586 Andy Lutomirski (1): x86/mm: temporary mm struct Nadav Amit (5): Fix "x86/alternatives: Lockdep-enforce text_mutex in text_poke*()" fork: provide a function for copying init_mm x86/alternatives: initializing temporary mm for patching x86/alternatives: use temporary mm for text poking x86/alternatives: remove text_poke() return value arch/x86/include/asm/mmu_context.h | 20 +++ arch/x86/include/asm/pgtable.h | 3 + arch/x86/include/asm/text-patching.h | 4 +- arch/x86/kernel/alternative.c | 175 +++++++++++++++++++++++---- arch/x86/mm/init_64.c | 29 +++++ include/linux/sched/task.h | 1 + init/main.c | 3 + kernel/fork.c | 24 +++- 8 files changed, 227 insertions(+), 32 deletions(-) -- 2.17.1