linux-kernel - Re: [rfc 3/3] prctl: Add PR_SET_MM codes to tune up mm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20111130210622.GM14515@moon>
Date:	Thu, 1 Dec 2011 01:06:22 +0400
From:	Cyrill Gorcunov <gorcunov@...il.com>
To:	Kees Cook <keescook@...omium.org>, linux-kernel@...r.kernel.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	Tejun Heo <tj@...nel.org>, Andrew Vagin <avagin@...nvz.org>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	Pavel Emelyanov <xemul@...allels.com>,
	Vasiliy Kulikov <segoon@...nwall.com>
Subject: Re: [rfc 3/3] prctl: Add PR_SET_MM codes to tune up mm_struct entires

On Wed, Nov 30, 2011 at 10:23:10PM +0400, Cyrill Gorcunov wrote:
...
> 
> > > +       switch (opt) {
> > > +       case PR_SET_MM_START_CODE:
> > > +       case PR_SET_MM_END_CODE:
> > > +
> > > +               vm_req_flags = VM_READ | VM_EXEC;
> > > +               vm_bad_flags = VM_WRITE | VM_MAYSHARE;
> > > +
> > > +               if ((vma->vm_flags & vm_req_flags) != vm_req_flags ||
> > > +                   (vma->vm_flags & vm_bad_flags))
> > > +                       goto out;
> > 
> > Another random thought: given this very regular set of checks you're
> > doing, perhaps the flags should be part of a data structure instead,
> > just to reduce the size of this routine?
> > 
> > struct mm_flags {
> >   int req_flags;
> >   int bad_flags;
> > };
> > 
> > struct mm_flags opt_flags[] = {
> > ...
> >  { VM_READ | VM_EXEC, VM_WRITE | VM_MAYSHARE }, /* PR_SET_MM_START_CODE */
> >  { VM_READ | VM_EXEC, VM_WRITE | VM_MAYSHARE }, /* PR_SET_MM_END_CODE */
> > ...
> > 
> > then do validation before the switch statement all in one place, and
> > leave the switch for more programmatic checks?
> > 
> > -Kees
> > 
> 
> Nod! I'll update, thanks!
> 

You know Kees, I tried it, and finally I think it's overheaded, so I prefer
to stick with original version (no need to duplicate same data in two differen
memory places as it'll be in case of arrays, and since the VM_ flags are
constant the former code bloats kernel lesser. Thanks anyway!

	Cyrill
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/