From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A11AC7EE24 for ; Tue, 16 May 2023 21:57:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229807AbjEPV5m (ORCPT ); Tue, 16 May 2023 17:57:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229529AbjEPV5l (ORCPT ); Tue, 16 May 2023 17:57:41 -0400 Received: from out-38.mta1.migadu.com (out-38.mta1.migadu.com [IPv6:2001:41d0:203:375::26]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ED40D170E for ; Tue, 16 May 2023 14:57:39 -0700 (PDT) Date: Tue, 16 May 2023 17:57:33 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1684274258; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=rg+4VYgNan6dQhp4G+ztNtHxMTIHL0gkWBPXAeaTX8c=; b=jJSE6AXlg0mKNpZ3QsGHLfN984zv1y3ihtZM67UQucdGqvaeKISoBqjvubCygEtZOjn63P CgtKcnIJRmvE8tN4JU0oQdw66873QmANJIugqZktPXHNnkHuR8oAA0U6N1F3eeJ2Y1sGo5 envgWXp+n4uKqfyotbMjEdRM/d9ymyg= X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Kent Overstreet To: Matthew Wilcox Cc: Kees Cook , Johannes Thumshirn , "linux-kernel@vger.kernel.org" , "linux-fsdevel@vger.kernel.org" , "linux-bcachefs@vger.kernel.org" , Kent Overstreet , Andrew Morton , Uladzislau Rezki , "hch@infradead.org" , "linux-mm@kvack.org" , "linux-hardening@vger.kernel.org" Subject: Re: [PATCH 07/32] mm: Bring back vmalloc_exec Message-ID: References: <20230509165657.1735798-1-kent.overstreet@linux.dev> <20230509165657.1735798-8-kent.overstreet@linux.dev> <3508afc0-6f03-a971-e716-999a7373951f@wdc.com> <202305111525.67001E5C4@keescook> <202305161401.F1E3ACFAC@keescook> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Migadu-Flow: FLOW_OUT Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, May 16, 2023 at 10:47:13PM +0100, Matthew Wilcox wrote: > On Tue, May 16, 2023 at 05:20:33PM -0400, Kent Overstreet wrote: > > On Tue, May 16, 2023 at 02:02:11PM -0700, Kees Cook wrote: > > > For something that small, why not use the text_poke API? > > > > This looks like it's meant for patching existing kernel text, which > > isn't what I want - I'm generating new functions on the fly, one per > > btree node. > > > > I'm working up a new allocator - a (very simple) slab allocator where > > you pass a buffer, and it gives you a copy of that buffer mapped > > executable, but not writeable. > > > > It looks like we'll be able to convert bpf, kprobes, and ftrace > > trampolines to it; it'll consolidate a fair amount of code (particularly > > in bpf), and they won't have to burn a full page per allocation anymore. > > > > bpf has a neat trick where it maps the same page in two different > > locations, one is the executable location and the other is the writeable > > location - I'm stealing that. > > How does that avoid the problem of being able to construct an arbitrary > gadget that somebody else will then execute? IOW, what bpf has done > seems like it's working around & undoing the security improvements. > > I suppose it's an improvement that only the executable address is > passed back to the caller, and not the writable address. That's my thinking; grepping around finds several uses of module_alloc() that are all doing different variations on the page permissions dance. Let's just do it once and do it right...