From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753534AbdLMPrt (ORCPT ); Wed, 13 Dec 2017 10:47:49 -0500 Received: from mga01.intel.com ([192.55.52.88]:19931 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753136AbdLMPrs (ORCPT ); Wed, 13 Dec 2017 10:47:48 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.45,397,1508828400"; d="scan'208";a="2232020" Subject: Re: [patch 05/16] mm: Allow special mappings with user access cleared To: Peter Zijlstra References: <20171212173221.496222173@linutronix.de> <20171212173333.669577588@linutronix.de> <20171213122211.bxcb7xjdwla2bqol@hirez.programming.kicks-ass.net> <20171213125739.fllckbl3o4nonmpx@node.shutemov.name> <20171213153202.qtxnloxoc66lhsbf@hirez.programming.kicks-ass.net> Cc: "Kirill A. Shutemov" , Andy Lutomirski , Thomas Gleixner , LKML , X86 ML , Linus Torvalds , Borislav Petkov , Greg KH , Kees Cook , Hugh Dickins , Brian Gerst , Josh Poimboeuf , Denys Vlasenko , Boris Ostrovsky , Juergen Gross , David Laight , Eduardo Valentin , aliguori@amazon.com, Will Deacon , "linux-mm@kvack.org" , kirill.shutemov@linux.intel.com, aneesh.kumar@linux.vnet.ibm.com From: Dave Hansen Message-ID: Date: Wed, 13 Dec 2017 07:47:46 -0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <20171213153202.qtxnloxoc66lhsbf@hirez.programming.kicks-ass.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 12/13/2017 07:32 AM, Peter Zijlstra wrote: >> This will fault writing a byte to 'addr': >> >> char *addr = malloc(PAGE_SIZE); >> pkey_mprotect(addr, PAGE_SIZE, 13); >> pkey_deny_access(13); >> *addr[0] = 'f'; >> >> But this will write one byte to addr successfully (if it uses the kernel >> mapping of the physical page backing 'addr'): >> >> char *addr = malloc(PAGE_SIZE); >> pkey_mprotect(addr, PAGE_SIZE, 13); >> pkey_deny_access(13); >> read(fd, addr, 1); >> > This seems confused to me; why are these two cases different? Protection keys doesn't work in the kernel direct map, so if the read() was implemented by writing to the direct map alias of 'addr' then this would bypass protection keys. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pg0-f69.google.com (mail-pg0-f69.google.com [74.125.83.69]) by kanga.kvack.org (Postfix) with ESMTP id 0AFC06B0253 for ; Wed, 13 Dec 2017 10:47:50 -0500 (EST) Received: by mail-pg0-f69.google.com with SMTP id i14so1714200pgf.13 for ; Wed, 13 Dec 2017 07:47:50 -0800 (PST) Received: from mga01.intel.com (mga01.intel.com. [192.55.52.88]) by mx.google.com with ESMTPS id r7si1531145ple.403.2017.12.13.07.47.48 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 13 Dec 2017 07:47:48 -0800 (PST) Subject: Re: [patch 05/16] mm: Allow special mappings with user access cleared References: <20171212173221.496222173@linutronix.de> <20171212173333.669577588@linutronix.de> <20171213122211.bxcb7xjdwla2bqol@hirez.programming.kicks-ass.net> <20171213125739.fllckbl3o4nonmpx@node.shutemov.name> <20171213153202.qtxnloxoc66lhsbf@hirez.programming.kicks-ass.net> From: Dave Hansen Message-ID: Date: Wed, 13 Dec 2017 07:47:46 -0800 MIME-Version: 1.0 In-Reply-To: <20171213153202.qtxnloxoc66lhsbf@hirez.programming.kicks-ass.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org List-ID: To: Peter Zijlstra Cc: "Kirill A. Shutemov" , Andy Lutomirski , Thomas Gleixner , LKML , X86 ML , Linus Torvalds , Borislav Petkov , Greg KH , Kees Cook , Hugh Dickins , Brian Gerst , Josh Poimboeuf , Denys Vlasenko , Boris Ostrovsky , Juergen Gross , David Laight , Eduardo Valentin , aliguori@amazon.com, Will Deacon , "linux-mm@kvack.org" , kirill.shutemov@linux.intel.com, aneesh.kumar@linux.vnet.ibm.com On 12/13/2017 07:32 AM, Peter Zijlstra wrote: >> This will fault writing a byte to 'addr': >> >> char *addr = malloc(PAGE_SIZE); >> pkey_mprotect(addr, PAGE_SIZE, 13); >> pkey_deny_access(13); >> *addr[0] = 'f'; >> >> But this will write one byte to addr successfully (if it uses the kernel >> mapping of the physical page backing 'addr'): >> >> char *addr = malloc(PAGE_SIZE); >> pkey_mprotect(addr, PAGE_SIZE, 13); >> pkey_deny_access(13); >> read(fd, addr, 1); >> > This seems confused to me; why are these two cases different? Protection keys doesn't work in the kernel direct map, so if the read() was implemented by writing to the direct map alias of 'addr' then this would bypass protection keys. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org