From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x226ELmC5ZQdxbLgTuoovDsoHMI3lXTcjQDIA2GSDFlrB/1eiyGTohwVSlgM+WJHCgQQ2p/fs ARC-Seal: i=1; a=rsa-sha256; t=1516944974; cv=none; d=google.com; s=arc-20160816; b=BwfiuH73gjYP2Y57MUW0uRMp+PEvhWu6zS1/+abQmYoOrXqKQAi/gK34+C2kDrYaaH HyZxCmMGJ6jBeH0xQLZ0ghd0zPOCt7LKBdUp02TnpDRMT/CG+5qOJRBR9a9RRmmyMoEN CCoZi4Pq7TX5yg0CeWIW4wlNzWphwtcX7qO/ngtV/W0nCV6jYdG3FJeRJwPfp/aOSOM8 I+nk3Tb/SoWLNU4YoD8d9wLQJG2iuC8UEFCpfnG5JLVppN3d5sDk4YMBI7ingOlXNEkr qUqNAxFUz9bNtG2IOpZuGjxJa5XVLp0IeTv6N1FY6fD3Dr6LAPJsv4wARU6KC8mduGlF Js2g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=subject:user-agent:in-reply-to:content-disposition:mime-version :references:message-id:cc:to:from:date:dkim-signature:delivered-to :list-id:list-subscribe:list-unsubscribe:list-help:list-post :precedence:mailing-list:arc-authentication-results; bh=4xuT1xRKP3RosdTcl97hOjMTc4QbU9DmrmORu8jJ4/g=; b=lEM4m6wpDDuNwV3bnKv/EhIie26YTpQ+2LXykx12V1+cOdtoesUIkunUipBBzRFwTV j7HtVZR0ry6KkE7H+o55rlq+xTlNLYCjIWuCFAHEv4Z99+DQLUl+2U+YAT77TwFV0hog pKCI8jYJsKpWTACxZCp5W+KRXbnT9i5t8JudGB4VRt+C5N+KRlhdYBQRizHRGIu43Vrz Y9tEnSXdkp3NeuSGlWEJwhgDLLCQm7celrXhIf4F8UdUtb1dO6NcLLxRg/YsxjfTaxrI zUMB4E88iNqrlOWAF4nzVB2WPuU6A+m2PBdELVRWmfr41x9RvRe+pL4hmg3K5G5UJpDD YUsA== ARC-Authentication-Results: i=1; mx.google.com; dkim=fail header.i=@infradead.org header.s=bombadil.20170209 header.b=TJFWMYuB; spf=pass (google.com: domain of kernel-hardening-return-11437-gregkh=linuxfoundation.org@lists.openwall.com designates 195.42.179.200 as permitted sender) smtp.mailfrom=kernel-hardening-return-11437-gregkh=linuxfoundation.org@lists.openwall.com Authentication-Results: mx.google.com; dkim=fail header.i=@infradead.org header.s=bombadil.20170209 header.b=TJFWMYuB; spf=pass (google.com: domain of kernel-hardening-return-11437-gregkh=linuxfoundation.org@lists.openwall.com designates 195.42.179.200 as permitted sender) smtp.mailfrom=kernel-hardening-return-11437-gregkh=linuxfoundation.org@lists.openwall.com Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm List-Post: List-Help: List-Unsubscribe: List-Subscribe: Date: Thu, 25 Jan 2018 21:35:42 -0800 From: Matthew Wilcox To: Jann Horn Cc: Igor Stoppa , jglisse@redhat.com, Kees Cook , Michal Hocko , Laura Abbott , Christoph Hellwig , Christoph Lameter , linux-security-module@vger.kernel.org, linux-mm@kvack.org, kernel list , Kernel Hardening Message-ID: <20180126053542.GA30189@bombadil.infradead.org> References: <20180124175631.22925-1-igor.stoppa@huawei.com> <20180124175631.22925-5-igor.stoppa@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.9.1 (2017-09-22) Subject: Re: [kernel-hardening] [PATCH 4/6] Protectable Memory X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1590497635371449856?= X-GMAIL-MSGID: =?utf-8?q?1590632093496148927?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Wed, Jan 24, 2018 at 08:10:53PM +0100, Jann Horn wrote: > I'm not entirely convinced by the approach of marking small parts of > kernel memory as readonly for hardening. It depends how significant the data stored in there are. For example, storing function pointers in read-only memory provides significant hardening. > You're allocating with vmalloc(), which, as far as I know, establishes > a second mapping in the vmalloc area for pages that are already mapped > as RW through the physmap. AFAICS, later, when you're trying to make > pages readonly, you're only changing the protections on the second > mapping in the vmalloc area, therefore leaving the memory writable > through the physmap. Is that correct? If so, please either document > the reasoning why this is okay or change it. Yes, this is still vulnerable to attacks through the physmap. That's also true for marking structs as const. We should probably fix that at some point, but at least they're not vulnerable to heap overruns by small amounts ... you have to be able to overrun some other array by terabytes. It's worth having a discussion about whether we want the pmalloc API or whether we want a slab-based API. We can have a separate discussion about an API to remove pages from the physmap.