linux-kernel - Re: [PATCH v3 00/10] livepatch,module: Remove .klp.arch and module_disable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 27 Apr 2020 08:22:03 -0400
From:   Joe Lawrence <joe.lawrence@...hat.com>
To:     Josh Poimboeuf <jpoimboe@...hat.com>, live-patching@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Jessica Yu <jeyu@...nel.org>
Subject: Re: [PATCH v3 00/10] livepatch,module: Remove .klp.arch and
 module_disable_ro()

On 4/25/20 7:07 AM, Josh Poimboeuf wrote:
> v3:
> - klp: split klp_write_relocations() into object/section specific
>    functions [joe]
> - s390: fix plt/got writes [joe]
> - s390: remove text_mutex usage [mbenes]
> - x86: do text_poke_sync() before releasing text_mutex [peterz]
> - split x86 text_mutex changes into separate patch [mbenes]
> 
> v2:
> - add vmlinux.ko check [peterz]
> - remove 'klp_object' forward declaration [mbenes]
> - use text_mutex [jeyu]
> - fix documentation TOC [jeyu]
> - fix s390 issues [mbenes]
> - upstream kpatch-build now supports this
>    (though it's only enabled for Linux >= 5.8)
> 
> These patches add simplifications and improvements for some issues Peter
> found six months ago, as part of his non-writable text code (W^X)
> cleanups.
> 
> Highlights:
> 
> - Remove the livepatch arch-specific .klp.arch sections, which were used
>    to do paravirt patching and alternatives patching for livepatch
>    replacement code.
> 
> - Add support for jump labels in patched code.
> 
> - Remove the last module_disable_ro() usage.
> 
> For more background, see this thread:
> 
>    https://lkml.kernel.org/r/20191021135312.jbbxsuipxldocdjk@treble
> 
> This has been tested with kpatch-build integration tests and klp-convert
> selftests.
> 

Hi Josh,

I've added some late module patching tests for klp-convert as well as 
extended the existing ones.  I'll put them on-top of v3 and give it some 
test runs today (x86, ppc64le, s390x) and report back.

BTW, this may be out of scope for this patchset, but is it a large 
amount of work to support clearing klp-relocations on target module 
unload?  ie, this test case:

   - (target module and livepatch loaded)
   - rmmod target_mod
   - modprobe target_mod       << fails as reloc target is non-zero

IIRC, Miroslav had taken a stab at this last year, but I don't remember 
what the technical problems were then.

-- Joe