linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Rick Edgecombe <rick.p.edgecombe@intel.com>
To: Andy Lutomirski <luto@kernel.org>, Ingo Molnar <mingo@redhat.com>
Cc: linux-kernel@vger.kernel.org, x86@kernel.org, hpa@zytor.com,
	Thomas Gleixner <tglx@linutronix.de>,
	Borislav Petkov <bp@alien8.de>, Nadav Amit <nadav.amit@gmail.com>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Peter Zijlstra <peterz@infradead.org>,
	linux_dti@icloud.com, linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org, akpm@linux-foundation.org,
	kernel-hardening@lists.openwall.com, linux-mm@kvack.org,
	will.deacon@arm.com, ard.biesheuvel@linaro.org,
	kristen@linux.intel.com, deneen.t.dock@intel.com,
	Rick Edgecombe <rick.p.edgecombe@intel.com>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Alexei Starovoitov <ast@kernel.org>
Subject: [PATCH v3 17/20] bpf: Use vmalloc special flag
Date: Thu, 21 Feb 2019 15:44:48 -0800	[thread overview]
Message-ID: <20190221234451.17632-18-rick.p.edgecombe@intel.com> (raw)
In-Reply-To: <20190221234451.17632-1-rick.p.edgecombe@intel.com>

Use new flag VM_FLUSH_RESET_PERMS for handling freeing of special
permissioned memory in vmalloc and remove places where memory was set RW
before freeing which is no longer needed. Don't track if the memory is RO
anymore because it is now tracked in vmalloc.

Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
---
 include/linux/filter.h | 17 +++--------------
 kernel/bpf/core.c      |  1 -
 2 files changed, 3 insertions(+), 15 deletions(-)

diff --git a/include/linux/filter.h b/include/linux/filter.h
index b9f93e62db96..f7b6c8a2e591 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -20,6 +20,7 @@
 #include <linux/set_memory.h>
 #include <linux/kallsyms.h>
 #include <linux/if_vlan.h>
+#include <linux/vmalloc.h>
 
 #include <net/sch_generic.h>
 
@@ -483,7 +484,6 @@ struct bpf_prog {
 	u16			pages;		/* Number of allocated pages */
 	u16			jited:1,	/* Is our filter JIT'ed? */
 				jit_requested:1,/* archs need to JIT the prog */
-				undo_set_mem:1,	/* Passed set_memory_ro() checkpoint */
 				gpl_compatible:1, /* Is filter GPL compatible? */
 				cb_access:1,	/* Is control block accessed? */
 				dst_needed:1,	/* Do we need dst entry? */
@@ -681,27 +681,17 @@ bpf_ctx_narrow_access_ok(u32 off, u32 size, u32 size_default)
 
 static inline void bpf_prog_lock_ro(struct bpf_prog *fp)
 {
-	fp->undo_set_mem = 1;
+	set_vm_flush_reset_perms(fp);
 	set_memory_ro((unsigned long)fp, fp->pages);
 }
 
-static inline void bpf_prog_unlock_ro(struct bpf_prog *fp)
-{
-	if (fp->undo_set_mem)
-		set_memory_rw((unsigned long)fp, fp->pages);
-}
-
 static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
 {
+	set_vm_flush_reset_perms(hdr);
 	set_memory_ro((unsigned long)hdr, hdr->pages);
 	set_memory_x((unsigned long)hdr, hdr->pages);
 }
 
-static inline void bpf_jit_binary_unlock_ro(struct bpf_binary_header *hdr)
-{
-	set_memory_rw((unsigned long)hdr, hdr->pages);
-}
-
 static inline struct bpf_binary_header *
 bpf_jit_binary_hdr(const struct bpf_prog *fp)
 {
@@ -736,7 +726,6 @@ void __bpf_prog_free(struct bpf_prog *fp);
 
 static inline void bpf_prog_unlock_free(struct bpf_prog *fp)
 {
-	bpf_prog_unlock_ro(fp);
 	__bpf_prog_free(fp);
 }
 
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 19c49313c709..465c1c3623e8 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -804,7 +804,6 @@ void __weak bpf_jit_free(struct bpf_prog *fp)
 	if (fp->jited) {
 		struct bpf_binary_header *hdr = bpf_jit_binary_hdr(fp);
 
-		bpf_jit_binary_unlock_ro(hdr);
 		bpf_jit_binary_free(hdr);
 
 		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(fp));
-- 
2.17.1


  parent reply	other threads:[~2019-02-21 23:51 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-02-21 23:44 [PATCH v3 00/20] Merge text_poke fixes and executable lockdowns Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 01/20] x86/jump_label: Use text_poke_early() during early init Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 02/20] x86/mm: Introduce temporary mm structs Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 03/20] x86/mm: Save DRs when loading a temporary mm Rick Edgecombe
2019-02-22  0:07   ` Sean Christopherson
2019-02-22  0:17     ` Nadav Amit
2019-02-21 23:44 ` [PATCH v3 04/20] fork: Provide a function for copying init_mm Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 05/20] x86/alternative: Initialize temporary mm for patching Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 06/20] x86/alternative: Use temporary mm for text poking Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 07/20] x86/kgdb: Avoid redundant comparison of patched code Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 08/20] x86/ftrace: Set trampoline pages as executable Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 09/20] x86/kprobes: Set instruction page " Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 10/20] x86/module: Avoid breaking W^X while loading modules Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 11/20] x86/jump-label: Remove support for custom poker Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 12/20] x86/alternative: Remove the return value of text_poke_*() Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 13/20] x86/mm/cpa: Add set_direct_map_ functions Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 14/20] mm: Make hibernate handle unmapped pages Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 15/20] vmalloc: Add flag for free of special permsissions Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 16/20] modules: Use vmalloc special flag Rick Edgecombe
2019-02-21 23:44 ` Rick Edgecombe [this message]
2019-02-21 23:44 ` [PATCH v3 18/20] x86/ftrace: " Rick Edgecombe
2019-02-22  0:22   ` Steven Rostedt
2019-02-22  0:55     ` Edgecombe, Rick P
2019-02-21 23:44 ` [PATCH v3 19/20] x86/kprobes: " Rick Edgecombe
2019-02-21 23:44 ` [PATCH v3 20/20] x86/alternative: Comment about module removal races Rick Edgecombe
2019-02-22 16:14 ` [PATCH v3 00/20] Merge text_poke fixes and executable lockdowns Borislav Petkov
2019-02-22 18:32   ` Edgecombe, Rick P

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190221234451.17632-18-rick.p.edgecombe@intel.com \
    --to=rick.p.edgecombe@intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=ard.biesheuvel@linaro.org \
    --cc=ast@kernel.org \
    --cc=bp@alien8.de \
    --cc=daniel@iogearbox.net \
    --cc=dave.hansen@linux.intel.com \
    --cc=deneen.t.dock@intel.com \
    --cc=hpa@zytor.com \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=kristen@linux.intel.com \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=linux_dti@icloud.com \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=nadav.amit@gmail.com \
    --cc=peterz@infradead.org \
    --cc=tglx@linutronix.de \
    --cc=will.deacon@arm.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).