linux-kernel - Re: [PATCH 2/2] x86/mm/KASLR: Adjust the vmemmap size according to paging mode

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180905123708.GO1740@192.168.1.3>
Date:   Wed, 5 Sep 2018 20:37:08 +0800
From:   Baoquan He <bhe@...hat.com>
To:     "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
Cc:     "Kirill A. Shutemov" <kirill@...temov.name>, tglx@...utronix.de,
        mingo@...nel.org, hpa@...or.com, thgarnie@...gle.com,
        x86@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 2/2] x86/mm/KASLR: Adjust the vmemmap size according to
 paging mode

On 09/05/18 at 03:09pm, Kirill A. Shutemov wrote:
> On Wed, Sep 05, 2018 at 08:15:31AM +0000, Baoquan He wrote:
> > On 09/04/18 at 11:13am, Kirill A. Shutemov wrote:
> > > On Mon, Sep 03, 2018 at 10:52:13PM +0800, Baoquan He wrote:
> > > > On 09/03/18 at 01:26pm, Kirill A. Shutemov wrote:
> > > > > > > But there's corner case when struct page is unreasonably large and
> > > > > > > vmemmap_size will be way to large. We probably have to report an error if
> > > > > > > we cannot fit vmemmap properly into virtual memory layout.
> > > > > > 
> > > > > > Hmm, sizeof(struct page) can't exceed one whole page surely, otherwise
> > > > > > system bootup can't go over vmemmap initlization. Except of this, we may
> > > > > > need think about the virtual memory layout which vmemmap can be allowed
> > > > > > to occupy.
> > > > > > 
> > > > > > If KASAN enabled, KASLR disabled,
> > > > > > 4-level 1TB + 1TB hole (2TB)
> > > > > > 5-level 512TB + 2034TB hole (2.5PB)
> > > > > > 
> > > > > > If KASAN disabled, KASLR enabled,
> > > > > > 4-level 1TB + 1TB hole + 16TB  (18TB)
> > > > > > 5-level 512TB + 2034TB hole + 8PB (10.5PB)
> > > > > > 
> > > > > > So, as you can see, if add check in memory KASLR code, we should only
> > > > > > consider KASLR enabled case. We possibly don't need to worry about
> > > > > > 5-level case since the size 10.5PB is even bigger than the maximum
> > > > > > physical RAM mapping size. For 4-level, 18TB align to multiples of 2, it
> > > > > > will be 32 times of the current 1TB, then we usually assume 64 as the
> > > > > > default value of sizeof(struct page), then 64*32 == 1024. So we can add
> > 						~~~64*32 = 2048
> > 				Sorry, I made mistake here.
> > > > > > check like this, what do you think? Or any other idea?
> > > > > 
> > > > > Looks reasonable to me.
> > > > > 
> > > > > But I would have the BUILD_BUG_ON() in generic code. If you struct page is
> > > > > more than 1/4 of PAGE_SIZE something is horribly broken.
> > > > 
> > > > Just the 1/4 of PAGE_SIZE is based on analysis of KASLR case. If
> > > > non-KASLR case, it may not be that value.
> > > 
> > > Even if it technically possible to have struct page larger than
> > > PAGE_SIZE/4, it's just insane.
> > > 
> > > > Not sure if it's OK to put it in generic code, and haven't thought of a
> > > > good place, maybe in setup_arch(), just at the beginning?
> > > 
> > > I don't see an obvious place too. Maybe free_area_init_nodes()?
> > 
> > OK, you mean a more generic place, I only considered generic place in
> > x86. The thing is not all ARCH-es set PAGE_SIZE as 4KB, e.g power and
> > arm64 can have PAGE_SIZE of 64KB. For them, PAGE_SIZE/4, namely 16KB,
> > is hardly reached. So my thought is either taking PAGE_SIZE/4 in x86
> > arch only, or using SZ_1K in free_area_init_nodes() as you suggested.
> > What do you think?
> 
> BUILD_BUG_ON() on min(SZ_1K, PAGE_SIZE/4)?

I am fine. Just SZ_1K will always win,  4K is the smallest granularity
of known size :-).