linux-kernel - Re: [PATCH] Ensure kernel AI key is not changed on fork

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJoBWHyUkP4nkgxHJAZr+291GLy2UCOhC-cn=ez416N4xWSk=w@mail.gmail.com>
Date:   Thu, 20 May 2021 14:24:04 -0400
From:   Derrick McKee <derrick.mckee@...il.com>
To:     Mark Rutland <mark.rutland@....com>
Cc:     Nathan Harrison Burow <Nathan.Burow@...mit.edu>,
        Yianni Giannaris <yiannig@....edu>,
        Catalin Marinas <catalin.marinas@....com>,
        Will Deacon <will@...nel.org>,
        Linux ARM <linux-arm-kernel@...ts.infradead.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] Ensure kernel AI key is not changed on fork

On Thu, May 20, 2021 at 12:00 PM Mark Rutland <mark.rutland@....com> wrote:

> On the kernel side, we use a unique IA key per kernel thread, and while
> this must remain the same *for that kernel thread*, the kernel IA key
> should differ across kernel threads when a fork() occurs.

Thank you for the clarification.

> I think you're trying to use the keys in a different way than upstream
> intends to, and we do not need this change as-is.
>
> So NAK to this patch as it stands.

Given the above discussion, I agree with the NAK.

>
> > ---
> >  arch/arm64/include/asm/pointer_auth.h | 9 ++++++---
> >  1 file changed, 6 insertions(+), 3 deletions(-)
> >
> > diff --git a/arch/arm64/include/asm/pointer_auth.h b/arch/arm64/include/asm/pointer_auth.h
> > index d50416be99be..9748413e72fd 100644
> > --- a/arch/arm64/include/asm/pointer_auth.h
> > +++ b/arch/arm64/include/asm/pointer_auth.h
> > @@ -69,10 +69,13 @@ static inline void ptrauth_keys_init_user(struct ptrauth_keys_user *keys)
> >       ptrauth_keys_install_user(keys);
> >  }
> >
> > -static __always_inline void ptrauth_keys_init_kernel(struct ptrauth_keys_kernel *keys)
> > +static __always_inline void
> > +ptrauth_keys_init_kernel(struct ptrauth_keys_kernel *keys)
> >  {
> > -     if (system_supports_address_auth())
> > -             get_random_bytes(&keys->apia, sizeof(keys->apia));
> > +     if (keys->apia.lo == 0 && keys->apia.hi == 0) {
> > +             if (system_supports_address_auth())
> > +                     get_random_bytes(&keys->apia, sizeof(keys->apia));
> > +     }
> >  }
> >
> >  static __always_inline void ptrauth_keys_switch_kernel(struct ptrauth_keys_kernel *keys)
> > --
> > 2.31.1
> >



-- 
Derrick McKee
Phone: (703) 957-9362
Email: derrick.mckee@...il.com