linux-kernel - [RFC PATCH 1/1] mm/vmalloc: Modify permission reset procedure to avoid invalid access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240611131301.2988047-1-ycliang@andestech.com>
Date: Tue, 11 Jun 2024 21:13:01 +0800
From: Leo Yu-Chi Liang <ycliang@...estech.com>
To: <akpm@...ux-foundation.org>, <urezki@...il.com>, <hch@...radead.org>,
	<lstoakes@...il.com>, <linux-mm@...ck.org>, <linux-kernel@...r.kernel.org>,
	<bpf@...r.kernel.org>, <rick.p.edgecombe@...el.com>
CC: <patrick@...estech.com>, Leo Yu-Chi Liang <ycliang@...estech.com>
Subject: [RFC PATCH 1/1] mm/vmalloc: Modify permission reset procedure to avoid invalid access

The previous reset procedure is
1. Set direct map attribute to invalid
2. Flush TLB
3. Reset direct map attribute to default

It is possible that kernel forks another process
on another core that access the invalid mappings after
sync_kernel_mappings.

We could reproduce this scenario by running LTP/bpf_prog
multiple times on RV32 kernel on QEMU.

Therefore, the following procedure is proposed
to avoid mappings being invalid.
1. Reset direct map attribute to default
2. Flush TLB

Signed-off-by: Leo Yu-Chi Liang <ycliang@...estech.com>
---
 mm/vmalloc.c | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 45e1506d58c3..58ef2fc51e43 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -3248,14 +3248,9 @@ static void vm_reset_perms(struct vm_struct *area)
 		}
 	}
 
-	/*
-	 * Set direct map to something invalid so that it won't be cached if
-	 * there are any accesses after the TLB flush, then flush the TLB and
-	 * reset the direct map permissions to the default.
-	 */
-	set_area_direct_map(area, set_direct_map_invalid_noflush);
-	_vm_unmap_aliases(start, end, flush_dmap);
+	/* Reset direct map permissions to default, then flush the TLB */
 	set_area_direct_map(area, set_direct_map_default_noflush);
+	_vm_unmap_aliases(start, end, flush_dmap);
 }
 
 static void delayed_vfree_work(struct work_struct *w)
-- 
2.34.1