Message-ID: <501b0fc3-6c67-657f-781e-25ee0283bc2e@csgroup.eu>
Date:   Fri, 7 Oct 2022 04:57:24 +0000
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     "Jason A. Donenfeld" <Jason@...c4.com>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "patches@...ts.linux.dev" <patches@...ts.linux.dev>,
        Andreas Noever <andreas.noever@...il.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Borislav Petkov <bp@...en8.de>,
        Catalin Marinas <catalin.marinas@....com>,
        Christoph Böhmwalder 
        <christoph.boehmwalder@...bit.com>, Christoph Hellwig <hch@....de>,
        Daniel Borkmann <daniel@...earbox.net>,
        Dave Airlie <airlied@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        "David S . Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Florian Westphal <fw@...len.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        "H . Peter Anvin" <hpa@...or.com>,
        Heiko Carstens <hca@...ux.ibm.com>,
        Helge Deller <deller@....de>,
        Herbert Xu <herbert@...dor.apana.org.au>,
        Huacai Chen <chenhuacai@...nel.org>,
        Hugh Dickins <hughd@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        "James E . J . Bottomley" <jejb@...ux.ibm.com>,
        Jan Kara <jack@...e.com>, Jason Gunthorpe <jgg@...pe.ca>,
        Jens Axboe <axboe@...nel.dk>,
        Johannes Berg <johannes@...solutions.net>,
        Jonathan Corbet <corbet@....net>,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        KP Singh <kpsingh@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Marco Elver <elver@...gle.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Michael Ellerman <mpe@...erman.id.au>,
        Pablo Neira Ayuso <pablo@...filter.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Richard Weinberger <richard@....at>,
        Russell King <linux@...linux.org.uk>,
        Theodore Ts'o <tytso@....edu>,
        Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
        Thomas Gleixner <tglx@...utronix.de>,
        Thomas Graf <tgraf@...g.ch>,
        Ulf Hansson <ulf.hansson@...aro.org>,
        Vignesh Raghavendra <vigneshr@...com>,
        WANG Xuerui <kernel@...0n.name>, Will Deacon <will@...nel.org>,
        Yury Norov <yury.norov@...il.com>,
        "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>,
        "kasan-dev@...glegroups.com" <kasan-dev@...glegroups.com>,
        "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "linux-block@...r.kernel.org" <linux-block@...r.kernel.org>,
        "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>,
        "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
        "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>,
        "linux-media@...r.kernel.org" <linux-media@...r.kernel.org>,
        "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        "linux-mmc@...r.kernel.org" <linux-mmc@...r.kernel.org>,
        "linux-mtd@...ts.infradead.org" <linux-mtd@...ts.infradead.org>,
        "linux-nvme@...ts.infradead.org" <linux-nvme@...ts.infradead.org>,
        "linux-parisc@...r.kernel.org" <linux-parisc@...r.kernel.org>,
        "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>,
        "linux-s390@...r.kernel.org" <linux-s390@...r.kernel.org>,
        "linux-um@...ts.infradead.org" <linux-um@...ts.infradead.org>,
        "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>,
        "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>,
        "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
        "loongarch@...ts.linux.dev" <loongarch@...ts.linux.dev>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "sparclinux@...r.kernel.org" <sparclinux@...r.kernel.org>,
        "x86@...nel.org" <x86@...nel.org>,
        Toke Høiland-Jørgensen <toke@...e.dk>,
        Chuck Lever <chuck.lever@...cle.com>, Jan Kara <jack@...e.cz>
Subject: Re: [PATCH v3 3/5] treewide: use get_random_u32() when possible



Le 07/10/2022 à 01:36, Jason A. Donenfeld a écrit :
> On 10/6/22, Christophe Leroy <christophe.leroy@...roup.eu> wrote:
>>
>>
>> Le 06/10/2022 à 19:31, Christophe Leroy a écrit :
>>>
>>>
>>> Le 06/10/2022 à 19:24, Jason A. Donenfeld a écrit :
>>>> Hi Christophe,
>>>>
>>>> On Thu, Oct 6, 2022 at 11:21 AM Christophe Leroy
>>>> <christophe.leroy@...roup.eu> wrote:
>>>>> Le 06/10/2022 à 18:53, Jason A. Donenfeld a écrit :
>>>>>> The prandom_u32() function has been a deprecated inline wrapper around
>>>>>> get_random_u32() for several releases now, and compiles down to the
>>>>>> exact same code. Replace the deprecated wrapper with a direct call to
>>>>>> the real function. The same also applies to get_random_int(), which is
>>>>>> just a wrapper around get_random_u32().
>>>>>>
>>>>>> Reviewed-by: Kees Cook <keescook@...omium.org>
>>>>>> Acked-by: Toke Høiland-Jørgensen <toke@...e.dk> # for sch_cake
>>>>>> Acked-by: Chuck Lever <chuck.lever@...cle.com> # for nfsd
>>>>>> Reviewed-by: Jan Kara <jack@...e.cz> # for ext4
>>>>>> Signed-off-by: Jason A. Donenfeld <Jason@...c4.com>
>>>>>> ---
>>>>>
>>>>>> diff --git a/arch/powerpc/kernel/process.c
>>>>>> b/arch/powerpc/kernel/process.c
>>>>>> index 0fbda89cd1bb..9c4c15afbbe8 100644
>>>>>> --- a/arch/powerpc/kernel/process.c
>>>>>> +++ b/arch/powerpc/kernel/process.c
>>>>>> @@ -2308,6 +2308,6 @@ void notrace __ppc64_runlatch_off(void)
>>>>>>     unsigned long arch_align_stack(unsigned long sp)
>>>>>>     {
>>>>>>         if (!(current->personality & ADDR_NO_RANDOMIZE) &&
>>>>>> randomize_va_space)
>>>>>> -             sp -= get_random_int() & ~PAGE_MASK;
>>>>>> +             sp -= get_random_u32() & ~PAGE_MASK;
>>>>>>         return sp & ~0xf;
>>>>>
>>>>> Isn't that a candidate for prandom_u32_max() ?
>>>>>
>>>>> Note that sp is deemed to be 16 bytes aligned at all time.
>>>>
>>>> Yes, probably. It seemed non-trivial to think about, so I didn't. But
>>>> let's see here... maybe it's not too bad:
>>>>
>>>> If PAGE_MASK is always ~(PAGE_SIZE-1), then ~PAGE_MASK is
>>>> (PAGE_SIZE-1), so prandom_u32_max(PAGE_SIZE) should yield the same
>>>> thing? Is that accurate? And holds across platforms (this comes up a
>>>> few places)? If so, I'll do that for a v4.
>>>>
>>>
>>> On powerpc it is always (from arch/powerpc/include/asm/page.h) :
>>>
>>> /*
>>>    * Subtle: (1 << PAGE_SHIFT) is an int, not an unsigned long. So if we
>>>    * assign PAGE_MASK to a larger type it gets extended the way we want
>>>    * (i.e. with 1s in the high bits)
>>>    */
>>> #define PAGE_MASK      (~((1 << PAGE_SHIFT) - 1))
>>>
>>> #define PAGE_SIZE        (1UL << PAGE_SHIFT)
>>>
>>>
>>> So it would work I guess.
>>
>> But taking into account that sp must remain 16 bytes aligned, would it
>> be better to do something like ?
>>
>> 	sp -= prandom_u32_max(PAGE_SIZE >> 4) << 4;
>>
>> 	return sp;
> 
> Does this assume that sp is already aligned at the beginning of the
> function? I'd assume from the function's name that this isn't the
> case?

Ah you are right, I overlooked it.

Looking in more details, I see that all architectures that implement it 
implement it almost the same way.

By the way, the comment in arch/um/kernel/process.c is overdated.

Most architectures AND the random value with ~PAGE_MASK, x86 and um use 
%8192. Seems like at the time 2.6.12 was introduced into git, only i386 
x86_64 and um had that function.

Maybe it is time for a cleanup and a refactoring ? Architectures would 
just have to provide STACK_ALIGN just like loongarch does today, and we 
could get a generic arch_align_stack() ?

Christophe

Powered by blists - more mailing lists