LKML Archive on lore.kernel.org help / color / mirror / Atom feed
From: Andy Lutomirski <email@example.com> To: "Edgecombe, Rick P" <firstname.lastname@example.org> Cc: "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org>, "email@example.com" <firstname.lastname@example.org> Subject: Re: [PATCH bpf-next] bpf: Make trampolines W^X Date: Mon, 6 Jan 2020 15:36:49 -1000 [thread overview] Message-ID: <DB882EE8-20B2-4631-A808-E5C968B24CEB@amacapital.net> (raw) In-Reply-To: <email@example.com> > On Jan 6, 2020, at 12:25 PM, Edgecombe, Rick P <firstname.lastname@example.org> wrote: > > On Sat, 2020-01-04 at 09:49 +0900, Andy Lutomirski wrote: >>>> On Jan 4, 2020, at 8:47 AM, KP Singh <email@example.com> wrote: >>> >>> From: KP Singh <firstname.lastname@example.org> >>> >>> The image for the BPF trampolines is allocated with >>> bpf_jit_alloc_exe_page which marks this allocated page executable. This >>> means that the allocated memory is W and X at the same time making it >>> susceptible to WX based attacks. >>> >>> Since the allocated memory is shared between two trampolines (the >>> current and the next), 2 pages must be allocated to adhere to W^X and >>> the following sequence is obeyed where trampolines are modified: >> >> Can we please do better rather than piling garbage on top of garbage? >> >>> >>> - Mark memory as non executable (set_memory_nx). While module_alloc for >>> x86 allocates the memory as PAGE_KERNEL and not PAGE_KERNEL_EXEC, not >>> all implementations of module_alloc do so >> >> How about fixing this instead? >> >>> - Mark the memory as read/write (set_memory_rw) >> >> Probably harmless, but see above about fixing it. >> >>> - Modify the trampoline >> >> Seems reasonable. It’s worth noting that this whole approach is suboptimal: >> the “module” allocator should really be returning a list of pages to be >> written (not at the final address!) with the actual executable mapping to be >> materialized later, but that’s a bigger project that you’re welcome to ignore >> for now. (Concretely, it should produce a vmap address with backing pages but >> with the vmap alias either entirely unmapped or read-only. A subsequent healer >> would, all at once, make the direct map pages RO or not-present and make the >> vmap alias RX.) >>> - Mark the memory as read-only (set_memory_ro) >>> - Mark the memory as executable (set_memory_x) >> >> No, thanks. There’s very little excuse for doing two IPI flushes when one >> would suffice. >> >> As far as I know, all architectures can do this with a single flush without >> races x86 certainly can. The module freeing code gets this sequence right. >> Please reuse its mechanism or, if needed, export the relevant interfaces. > > So if I understand this right, some trampolines have been added that are > currently set as RWX at modification time AND left that way during runtime? The > discussion on the order of set_memory_() calls in the commit message made me > think that this was just a modification time thing at first. I’m not sure what the status quo is. We really ought to have a genuinely good API for allocation and initialization of text. We can do so much better than set_memory_blahblah. FWIW, I have some ideas about making kernel flushes cheaper. It’s currently blocked on finding some time and on tglx’s irqtrace work. > > Also, is there a reason you couldn't use text_poke() to modify the trampoline > with a single flush? > Does text_poke to an IPI these days?
next prev parent reply other threads:[~2020-01-07 1:36 UTC|newest] Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-01-03 23:47 [PATCH bpf-next] bpf: Make trampolines W^X KP Singh 2020-01-04 0:49 ` Andy Lutomirski 2020-01-05 1:19 ` Justin Capella 2020-01-06 8:23 ` Peter Zijlstra 2020-01-06 22:25 ` Edgecombe, Rick P 2020-01-07 1:36 ` Andy Lutomirski [this message] 2020-01-07 19:01 ` Edgecombe, Rick P 2020-01-08 8:41 ` Andy Lutomirski 2020-01-08 20:52 ` Edgecombe, Rick P 2020-01-09 6:48 ` Andy Lutomirski 2020-01-10 1:00 ` Edgecombe, Rick P 2020-01-10 18:35 ` Andy Lutomirski [not found] <CAMrEMU8Vsn8rfULqf1gfuYL_-ybqzit29CLYReskaZ8XUroZww@mail.gmail.com> [not found] ` <768BAF04-BEBF-489A-8737-B645816B262A@amacapital.net> 2020-01-06 22:13 ` Alexei Starovoitov 2020-01-07 9:11 ` Peter Zijlstra 2020-01-07 18:55 ` Alexei Starovoitov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=DB882EE8-20B2-4631-A808-E5C968B24CEB@amacapital.net \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ --firstname.lastname@example.org \ --email@example.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).