| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAE9FiQXcXn0xr_ACt4fS_=xWtXR8zGoYfpSzFKG4nEvKF=sGdQ@mail.gmail.com> Date: Fri, 21 Dec 2012 09:28:08 -0800 From: Yinghai Lu <yinghai@...nel.org> To: "H. Peter Anvin" <hpa@...or.com> Cc: Kees Cook <keescook@...omium.org>, linux-kernel@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, x86@...nel.org, Jim Kukunas <james.t.kukunas@...ux.intel.com>, Arjan van de Ven <arjan@...radead.org> Subject: Re: [RFC] stack and heap are executable on x86_64 On Fri, Dec 21, 2012 at 9:01 AM, H. Peter Anvin <hpa@...or.com> wrote: > On 12/20/2012 10:27 PM, Yinghai Lu wrote: >> >> >> after for-x86-boot we will have >> ---[ Low Kernel Mapping ]--- >> 0xffff880000000000-0xffff880000099000 612K RW GLB >> NX pte >> 0xffff880000099000-0xffff88000009a000 4K ro GLB >> NX pte >> 0xffff88000009a000-0xffff88000009b000 4K ro GLB >> x pte >> 0xffff88000009b000-0xffff880000200000 1428K RW GLB >> NX pte >> 0xffff880000200000-0xffff8800dfe00000 3580M RW PSE GLB >> NX pmd >> 0xffff8800dfe00000-0xffff8800dfffe000 2040K RW GLB >> NX pte >> 0xffff8800dfffe000-0xffff8800e0000000 8K >> pte >> 0xffff8800e0000000-0xffff880100000000 512M >> pmd >> 0xffff880100000000-0xffff8801a0000000 2560M RW PSE GLB >> NX pmd >> ---[ High Kernel Mapping ]--- >> 0xffffffff80000000-0xffffffff81000000 16M >> pmd >> 0xffffffff81000000-0xffffffff82a00000 26M RW PSE GLB >> x pmd >> 0xffffffff82a00000-0xffffffff82b21000 1156K RW GLB >> x pte >> 0xffffffff82b21000-0xffffffff82c00000 892K RW GLB >> NX pte >> 0xffffffff82c00000-0xffffffff82e00000 2M RW PSE GLB >> NX pmd >> 0xffffffff82e00000-0xffffffff82e92000 584K RW GLB >> NX pte >> 0xffffffff82e92000-0xffffffff83000000 1464K RW GLB >> x pte >> 0xffffffff83000000-0xffffffff83c00000 12M RW PSE GLB >> x pmd >> 0xffffffff83c00000-0xffffffffa0000000 452M >> pmd >> >> so low mapping will only have trampoline get x set. >> is that expected ? >> > > Yes. > > >> Do we need to set low mapping corresponding to kernel range to x? > > > No; we probably should never have the low mappings set to X, which comes > down to what I said earlier... we should mark the low mapping NX at the > PGD/PML4 level. > > However, this isn't good enough. You still have a large number of pages > which are RWX, and we should *never* have RWX pages, period, full stop, and > your map above sill have megabytes of them. which line? 0xffffffff83000000-0xffffffff83c00000 12M RW PSE GLB x pmd my kernel INIT_SIZE is 27M, and it includes everything that i needed in the kernel. > > Furthermore, just saying "we applied this patchset and it seems to go away" > isn't good enough... we need an understanding of *why* it makes things go > away and how that makes it safe. i know the reason: current kernel set x from trampoline to be x too late. So it set EXEC in head_64.c for all 1G range. so patch http://git.kernel.org/?p=linux/kernel/git/yinghai/linux-yinghai.git;a=commitdiff;h=b927466d72df250fa9b79fce3624cd5efd1317b7 set that x early. and in #PF handler version: http://git.kernel.org/?p=linux/kernel/git/yinghai/linux-yinghai.git;a=commitdiff;h=3c06147be8e6db30dba4cafb170ad66f7baffbfc init_mapping_kernel will set mapping for kernel and first 2M to LARGEPAGE only without EXEC. that is the reason why #PF handler version does not work with SMP. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists