linux-kernel - Re: [PATCH] arm64/sve: Lower the maximum allocation for the SVE ptrace regset

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Wed, 7 Feb 2024 12:23:56 +0000
From: Dave Martin <Dave.Martin@....com>
To: Mark Brown <broonie@...nel.org>
Cc: Will Deacon <will@...nel.org>,
	Catalin Marinas <catalin.marinas@....com>,
	Oleg Nesterov <oleg@...hat.com>, Al Viro <viro@...iv.linux.org.uk>,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
	Doug Anderson <dianders@...omium.org>
Subject: Re: [PATCH] arm64/sve: Lower the maximum allocation for the SVE
 ptrace regset

On Mon, Feb 05, 2024 at 05:41:47PM +0000, Mark Brown wrote:
> On Mon, Feb 05, 2024 at 05:11:59PM +0000, Dave Martin wrote:
> > On Sat, Feb 03, 2024 at 12:16:49PM +0000, Mark Brown wrote:
> 
> > > We could also teach the ptrace core about runtime discoverable regset sizes
> > > but that would be a more invasive change and this is being observed in
> > > practical systems.
> 
> > This is not hard at all: see
> > 27e64b4be4b8 ("regset: Add support for dynamically sized regsets") 
> 
> > But since this is precisely what was ripped out, I guess adding it back
> > may be controversial (?)
> 
> Also just that people might want to backport and while it's not super
> *hard* I tend to prefer to do something as minimal as possible as a fix,
> the less we do the less the chances that we mess up.

Totally agree with that: the core code has now gone in another direction,
so we should consider that a done deal.  I'm just using the old patch as
an illustration of the (low) level of complexity.

> > > We should probably also use the actual architectural limit for the
> > > bitmasks we use in the VL enumeration code, though that's both a little
> > > bit more involved and less immediately a problem.
> 
> > Since these masks are 64 bytes each and rarely accessed, it seemed
> > pointless complexity to make them resizeable...
> 
> I was suggesting making them use the architectural maximum rather than
> making them dynamic.
> 
> > > +#define ARCH_SVE_VQ_MAX 16
> > >  #define SME_VQ_MAX	16
> 
> > Ack, though part of the reason for not doing this was to discourage
> > people from allocating statically sized buffers in general.
> 
> I was going to do a patch adding a comment to the header noting that
> this is not actually the architectural maximum since at present it's
> a bit of a landmine, people who have some idea of the architecture
> likely have a rough idea what sort of allocation size is needed for the
> maximum SVE state and are likely to not double check the value provided
> (I think that's what happened with the refactoring to remove the dynamic
> sizing).  A comment in the header is still very missable but it'd be
> something.
> 
> > If the kernel is now juggling two #defines for the maximum vector size,
> > this feels like it may seed bitrot...
> 
> Ideally we'd just not have the existing define externally but it's there
> and it's been used.

To clarify, is this intended as a temporary band-aid against silly
behaviour while a cleaner solution is found, or a permanent limitation?

We'd need to change various things if the architectural max VL actually
grew, so no forward-portability is lost immediately if the kernel
adopts 16 internally, but I'm still a little concerned that people may
poke about in the kernel code as a reference and this will muddy the
waters regarding how to do the right thing in userspace (I know people
shouldn't, but...)

[...]

Cheers
---Dave