linux-kernel - Re: [PATCH] PM: core: Do not randomize struct dev_pm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 04 Aug 2022 19:12:40 -0700
From:   Kees Cook <keescook@...omium.org>
To:     "Rafael J. Wysocki" <rjw@...ysocki.net>,
        Linux PM <linux-pm@...r.kernel.org>
CC:     LKML <linux-kernel@...r.kernel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: [PATCH] PM: core: Do not randomize struct dev_pm_ops layout



On August 4, 2022 10:15:08 AM PDT, "Rafael J. Wysocki" <rjw@...ysocki.net> wrote:
>From: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
>
>Because __rpm_get_callback() uses offsetof() to compute the address of
>the callback in question in struct dev_pm_ops, randomizing the layout
>of the latter leads to interesting, but unfortunately also undesirable
>results in some cases.

How does this manifest? This is a compile-time randomization, so offsetof() will find the correct location. Is struct dev_pm_ops created or consumed externally from the kernel at any point?

-Kees

>
>Prevent that from happening by using the __no_randomize_layout
>annotation on struct dev_pm_ops.
>
>Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
>---
> include/linux/pm.h |    2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
>Index: linux-pm/include/linux/pm.h
>===================================================================
>--- linux-pm.orig/include/linux/pm.h
>+++ linux-pm/include/linux/pm.h
>@@ -307,7 +307,7 @@ struct dev_pm_ops {
> 	int (*runtime_suspend)(struct device *dev);
> 	int (*runtime_resume)(struct device *dev);
> 	int (*runtime_idle)(struct device *dev);
>-};
>+} __no_randomize_layout;
> 
> #define SYSTEM_SLEEP_PM_OPS(suspend_fn, resume_fn) \
> 	.suspend = pm_sleep_ptr(suspend_fn), \
>
>
>

-- 
Kees Cook