linux-kernel - Re: [PATCH v2 1/2] livepatch: introduce shadow variable API

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 Jul 2017 11:48:41 -0400
From:   Joe Lawrence <joe.lawrence@...hat.com>
To:     Miroslav Benes <mbenes@...e.cz>
Cc:     live-patching@...r.kernel.org, linux-kernel@...r.kernel.org,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Jessica Yu <jeyu@...hat.com>, Jiri Kosina <jikos@...nel.org>,
        Petr Mladek <pmladek@...e.com>
Subject: Re: [PATCH v2 1/2] livepatch: introduce shadow variable API

On 07/20/2017 10:45 AM, Miroslav Benes wrote:
> 
>>>>> + *
>>>>> + * Note: allocates @new_size space for shadow variable data and copies
>>>>> + * @new_size bytes from @new_data into the shadow varaible's own @new_data
>>>>> + * space.  If @new_data is NULL, @new_size is still allocated, but no
>>>>> + * copy is performed.
>>>>
>>>> I must say I'm not entirely happy with this. I don't know if this is what 
>>>> Petr had in mind (I'm sure he'll get to the patch set soon). Calling 
>>>> memcpy instead of a simple assignment in v1 seems worse. 
>>>
>>> This change was a bit of a experiment on my part in reaction to
>>> adding klp_shadow_get_or_attach().
>>>
>>> I like the simplicity of v1's pointer assignment -- in fact, moving all
>>> allocation responsiblity (klp_shadow meta-data and data[] area) out to
>>> the caller is doable, though implementing klp_shadow_get_or_attach() and
>>> and klp_shadow_detach_all() complicates matters, for example, adding an
>>> alloc/release callback.  I originally attempted this for v2, but turned
>>> back when the API and implementation grew complicated.  If the memcpy
>>> and gfp_flag restrictions are too ugly, I can try revisting that
>>> approach.  Ideas welcome :)
>>
>> Well, I didn't like callbacks either :). And no, I do not have a better 
>> idea. I still need to think about it.
> 
> Done and I agree that memcpy approach is not so bad after all :). So I'm 
> fine with it.

I looked at it again this morning and a "pass-your-own" allocation API
always comes back to adding callbacks and other complications :(  In the
end, most callers will be shadowing pointers and not entire structures,
so I think the copy isn't too bad.

On a related note, if we keep the allocations and memcpy, how about I
shift around the attach/get calls like so:

  __klp_shadow_attach
    set shadow variable member values
    memcpy
    add to hash

  klp_shadow_attach
    alloc new shadow var
    lock
    call __klp_shadow_attach with new alloc
    unlock

  klp_shadow_get_or_attach
    be optimistic, call klp_shadow_get (if found, return it)
    be pessimistic, alloc new shadow var
    lock
      call klp_shadow_get again
      if unlikely found
        kfree unneeded alloc
      else
        call __klp_shadow_attach with new alloc
    unlock
    return whichever shadow var we used

This way both calls can accept gfp_flags that may sleep, with the only
downside that klp_shadow_get_or_attach may allocate an unnecessary
shadow variable in the unlikely case that it's found on the second
klp_shadow_get attempt (under the lock).  No more clunky "bool lock"
flag either. :)

-- Joe