linux-kernel - Re: [PATCH v2] arm64: pageattr: Explicitly bail out when changing permissions for vmalloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6cd5a4ef-5835-41db-8282-4b022df7c953@arm.com>
Date: Mon, 14 Apr 2025 14:48:47 +0100
From: Ryan Roberts <ryan.roberts@....com>
To: David Hildenbrand <david@...hat.com>, Dev Jain <dev.jain@....com>,
 catalin.marinas@....com, will@...nel.org
Cc: gshan@...hat.com, rppt@...nel.org, steven.price@....com,
 suzuki.poulose@....com, tianyaxiong@...inos.cn, ardb@...nel.org,
 urezki@...il.com, linux-arm-kernel@...ts.infradead.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] arm64: pageattr: Explicitly bail out when changing
 permissions for vmalloc_huge mappings

On 04/04/2025 13:57, David Hildenbrand wrote:
> On 03.04.25 07:28, Dev Jain wrote:
>> arm64 uses apply_to_page_range to change permissions for kernel vmalloc mappings,
>> which does not support changing permissions for block mappings. This function
>> will change permissions until it encounters a block mapping, and will bail
>> out with a warning. Since there are no reports of this triggering, it
>> implies that there are currently no cases of code doing a vmalloc_huge()
>> followed by partial permission change. But this is a footgun waiting to
>> go off, so let's detect it early and avoid the possibility of permissions
>> in an intermediate state. So,  explicitly disallow changing permissions
>> for VM_ALLOW_HUGE_VMAP mappings.
>>
>> Reviewed-by: Ryan Roberts <ryan.roberts@....com>
>> Reviewed-by: Mike Rapoport (Microsoft) <rppt@...nel.org>
>> Signed-off-by: Dev Jain <dev.jain@....com>
>> ---
>> v1->v2:
>>   - Improve changelog, keep mention of page mappings in comment
>>
>>   arch/arm64/mm/pageattr.c | 6 +++---
>>   1 file changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c
>> index 39fd1f7ff02a..04d4a8f676db 100644
>> --- a/arch/arm64/mm/pageattr.c
>> +++ b/arch/arm64/mm/pageattr.c
>> @@ -96,8 +96,8 @@ static int change_memory_common(unsigned long addr, int
>> numpages,
>>        * we are operating on does not result in such splitting.
>>        *
>>        * Let's restrict ourselves to mappings created by vmalloc (or vmap).
>> -     * Those are guaranteed to consist entirely of page mappings, and
>> -     * splitting is never needed.
>> +     * Disallow VM_ALLOW_HUGE_VMAP mappings to guarantee that only page
>> +     * mappings are updated and splitting is never needed.
>>        *
>>        * So check whether the [addr, addr + size) interval is entirely
>>        * covered by precisely one VM area that has the VM_ALLOC flag set.
>> @@ -105,7 +105,7 @@ static int change_memory_common(unsigned long addr, int
>> numpages,
>>       area = find_vm_area((void *)addr);
>>       if (!area ||
>>           end > (unsigned long)kasan_reset_tag(area->addr) + area->size ||
>> -        !(area->flags & VM_ALLOC))
>> +        ((area->flags & (VM_ALLOC | VM_ALLOW_HUGE_VMAP)) != VM_ALLOC))
>>           return -EINVAL;
>>         if (!numpages)
> 
> Makes sense to me. Whenever required, we can improve the checks (or even try
> supporting splitting).

Yes that's the plan; I'd like to get to the point where we can do huge vmalloc
mappings by default on systems that support BBML2, then split mappings when needed.


> 
> Acked-by: David Hildenbrand <david@...hat.com>
>