linux-kernel - Re: [PATCH v2 2/3] devmem: Block mmap access when read/write access is restricted

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bf63b3e3-afdd-424c-87dc-f5488e770315@intel.com>
Date: Fri, 11 Apr 2025 08:38:26 -0700
From: Dave Hansen <dave.hansen@...el.com>
To: Dan Williams <dan.j.williams@...el.com>, Kees Cook <kees@...nel.org>
Cc: dave.hansen@...ux.intel.com, Nikolay Borisov <nik.borisov@...e.com>,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 2/3] devmem: Block mmap access when read/write access
 is restricted

On 4/10/25 21:59, Dan Williams wrote:
>> I don't think we can just fail the mmap. 🙁
> For the TVM case the havoc of failing mmap for DMI info is smaller and
> the recommended fallback for /dev/mem being in accessible is
> /sys/firmware/dmi/tables. So I feel ok making TVMs take the modern
> replacement path which is what they would need to do anyway in the
> lockdown_kernel case. Tom, Dave, what do you think?

Yeah, doing the same as lockdown should be fine.

The other alternative to failing all mmap()s is to allow mmap(PROT_READ)
to succeed and then just map the zero page.