From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F104C4151A for ; Mon, 11 Feb 2019 00:39:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id F3648214DA for ; Mon, 11 Feb 2019 00:39:26 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="UQvVKtfi" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726027AbfBKAj0 (ORCPT ); Sun, 10 Feb 2019 19:39:26 -0500 Received: from mail-pf1-f194.google.com ([209.85.210.194]:33188 "EHLO mail-pf1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726005AbfBKAjZ (ORCPT ); Sun, 10 Feb 2019 19:39:25 -0500 Received: by mail-pf1-f194.google.com with SMTP id c123so4453104pfb.0; Sun, 10 Feb 2019 16:39:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=vlsxxAOCWdf1tlqbQayeYqdEQq3U0CPDi/Q8SjZG81o=; b=UQvVKtfiCr2EL7+vDHwobTr3K/ATiEL/6IaQ02QiiMOUdtOTSwVzMksz6CS8ZV0yRJ +ba/xxOchi8VyXAnM7fVo60oRNFj2udtb1MmjepZeHgrxDVhybrDVbj5WnMxeBHOoSbd 0Z4ougOyd3gTbL/2dtgAdkuVZoPi7UgLUoLhCdvNzCWYP7JyWQGoErFnT2bIT8jpwJmW nl39hGFURBJeHi1zjBdzVmWXygssw8dBEZN8YX3pDj+23Sy5XTbd9Z4jeitLC9T6yCR+ E1iLowwEvYjOZ49Ev4OpC1K+CVW6/aZvC6taNcnStgVkXC3RxCvWyjQ73aHhhLIXT7n4 svbw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=vlsxxAOCWdf1tlqbQayeYqdEQq3U0CPDi/Q8SjZG81o=; b=WFmylVds/qwlFy7kn9NP/xhxD8x8/bQXNsJGdwsPJcxY/cXTssYcfC3JHGoVmCMSWS +5Z2YY6kKFJUDgXi/SZ7vIJtR6USqcUP3X9ROzZ9jyWVg0LLL0gBe4nJWDnpeJeKOiIm SvVghhN/WghUPkS/5G1Kl8c2hZ6/+nVOPtGxdUPX0VNwEaNvDOrM69EMyKPWRSqLPHOh TAh7zDC20b4St3abwL0RpiS4mBcYijS+/ha4bYQCJhZjBEl20PyOnUKEF8rfs4EorXeY ngXgys6XSkgZL7P6CV//bM56RQquIWhvxOlO5wDIfF0ZVzPyk0NAoW069X/h65zwPZqB TwGA== X-Gm-Message-State: AHQUAuYmyPEhADTKFF60l7j+f7QYPR1Uh8MncpwJKHBf0A0xD9AqbsAv L9NP499sd4+2qU/VxBpQHFU= X-Google-Smtp-Source: AHgI3Ia6ifDLiDziehHa+LGRKtMr/aFcCrLoukw/oRH9ekCRaSYyb/4JRm26BQzyIcR0N6IRbjlQYw== X-Received: by 2002:a63:5d20:: with SMTP id r32mr15872762pgb.329.1549845563697; Sun, 10 Feb 2019 16:39:23 -0800 (PST) Received: from [10.50.121.96] (c-73-202-78-81.hsd1.ca.comcast.net. [73.202.78.81]) by smtp.gmail.com with ESMTPSA id x2sm13973798pfx.78.2019.02.10.16.39.20 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 10 Feb 2019 16:39:22 -0800 (PST) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 12.2 \(3445.102.3\)) Subject: Re: [PATCH v2 05/20] x86/alternative: initializing temporary mm for patching From: Nadav Amit In-Reply-To: <20190129003422.9328-6-rick.p.edgecombe@intel.com> Date: Sun, 10 Feb 2019 16:39:19 -0800 Cc: Ingo Molnar , LKML , X86 ML , "H. Peter Anvin" , Thomas Gleixner , Borislav Petkov , Dave Hansen , Peter Zijlstra , Damian Tometzki , linux-integrity , LSM List , Andrew Morton , Kernel Hardening , Linux-MM , Will Deacon , Ard Biesheuvel , Kristen Carlson Accardi , "Dock, Deneen T" , Kees Cook , Dave Hansen Content-Transfer-Encoding: quoted-printable Message-Id: <162C6C29-CD81-46FE-9A54-6ED05A93A9CB@gmail.com> References: <20190129003422.9328-1-rick.p.edgecombe@intel.com> <20190129003422.9328-6-rick.p.edgecombe@intel.com> To: Rick Edgecombe , Andy Lutomirski X-Mailer: Apple Mail (2.3445.102.3) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: > On Jan 28, 2019, at 4:34 PM, Rick Edgecombe = wrote: >=20 > From: Nadav Amit >=20 > To prevent improper use of the PTEs that are used for text patching, = we > want to use a temporary mm struct. We initailize it by copying the = init > mm. >=20 > The address that will be used for patching is taken from the lower = area > that is usually used for the task memory. Doing so prevents the need = to > frequently synchronize the temporary-mm (e.g., when BPF programs are > installed), since different PGDs are used for the task memory. >=20 > Finally, we randomize the address of the PTEs to harden against = exploits > that use these PTEs. >=20 > Cc: Kees Cook > Cc: Dave Hansen > Acked-by: Peter Zijlstra (Intel) > Reviewed-by: Masami Hiramatsu > Tested-by: Masami Hiramatsu > Suggested-by: Andy Lutomirski > Signed-off-by: Nadav Amit > Signed-off-by: Rick Edgecombe > --- > arch/x86/include/asm/pgtable.h | 3 +++ > arch/x86/include/asm/text-patching.h | 2 ++ > arch/x86/kernel/alternative.c | 3 +++ > arch/x86/mm/init_64.c | 36 ++++++++++++++++++++++++++++ > init/main.c | 3 +++ > 5 files changed, 47 insertions(+) >=20 > diff --git a/arch/x86/include/asm/pgtable.h = b/arch/x86/include/asm/pgtable.h > index 40616e805292..e8f630d9a2ed 100644 > --- a/arch/x86/include/asm/pgtable.h > +++ b/arch/x86/include/asm/pgtable.h > @@ -1021,6 +1021,9 @@ static inline void __meminit = init_trampoline_default(void) > /* Default trampoline pgd value */ > trampoline_pgd_entry =3D init_top_pgt[pgd_index(__PAGE_OFFSET)]; > } > + > +void __init poking_init(void); > + > # ifdef CONFIG_RANDOMIZE_MEMORY > void __meminit init_trampoline(void); > # else > diff --git a/arch/x86/include/asm/text-patching.h = b/arch/x86/include/asm/text-patching.h > index f8fc8e86cf01..a75eed841eed 100644 > --- a/arch/x86/include/asm/text-patching.h > +++ b/arch/x86/include/asm/text-patching.h > @@ -39,5 +39,7 @@ extern void *text_poke_kgdb(void *addr, const void = *opcode, size_t len); > extern int poke_int3_handler(struct pt_regs *regs); > extern void *text_poke_bp(void *addr, const void *opcode, size_t len, = void *handler); > extern int after_bootmem; > +extern __ro_after_init struct mm_struct *poking_mm; > +extern __ro_after_init unsigned long poking_addr; >=20 > #endif /* _ASM_X86_TEXT_PATCHING_H */ > diff --git a/arch/x86/kernel/alternative.c = b/arch/x86/kernel/alternative.c > index 12fddbc8c55b..ae05fbb50171 100644 > --- a/arch/x86/kernel/alternative.c > +++ b/arch/x86/kernel/alternative.c > @@ -678,6 +678,9 @@ void *__init_or_module text_poke_early(void *addr, = const void *opcode, > return addr; > } >=20 > +__ro_after_init struct mm_struct *poking_mm; > +__ro_after_init unsigned long poking_addr; > + > static void *__text_poke(void *addr, const void *opcode, size_t len) > { > unsigned long flags; > diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c > index bccff68e3267..125c8c48aa24 100644 > --- a/arch/x86/mm/init_64.c > +++ b/arch/x86/mm/init_64.c > @@ -53,6 +53,7 @@ > #include > #include > #include > +#include >=20 > #include "mm_internal.h" >=20 > @@ -1383,6 +1384,41 @@ unsigned long memory_block_size_bytes(void) > return memory_block_size_probed; > } >=20 > +/* > + * Initialize an mm_struct to be used during poking and a pointer to = be used > + * during patching. > + */ > +void __init poking_init(void) > +{ > + spinlock_t *ptl; > + pte_t *ptep; > + > + poking_mm =3D copy_init_mm(); > + BUG_ON(!poking_mm); > + > + /* > + * Randomize the poking address, but make sure that the = following page > + * will be mapped at the same PMD. We need 2 pages, so find = space for 3, > + * and adjust the address if the PMD ends after the first one. > + */ > + poking_addr =3D TASK_UNMAPPED_BASE; > + if (IS_ENABLED(CONFIG_RANDOMIZE_BASE)) > + poking_addr +=3D (kaslr_get_random_long("Poking") & = PAGE_MASK) % > + (TASK_SIZE - TASK_UNMAPPED_BASE - 3 * = PAGE_SIZE); > + > + if (((poking_addr + PAGE_SIZE) & ~PMD_MASK) =3D=3D 0) > + poking_addr +=3D PAGE_SIZE; Further thinking about it, I think that allocating the virtual address = for poking from user address-range is problematic. The user can set = watchpoints on different addresses, cause some static-keys to be enabled/disabled, = and monitor the signals to derandomize the poking address. Andy, I think you were pushing this change. Can I go back to use a = vmalloc=E2=80=99d address instead, or do you have a better solution? I prefer not to save/restore DR7, of course.