linux-kernel - Re: [PATCH v3 7/8] x86/kprobes: enable EXECMEM_ROX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20250715092130.0b4eda67c5db02e815e478b2@kernel.org>
Date: Tue, 15 Jul 2025 09:21:30 +0900
From: Masami Hiramatsu (Google) <mhiramat@...nel.org>
To: Mike Rapoport <rppt@...nel.org>
Cc: Andrew Morton <akpm@...ux-foundation.org>, Andy Lutomirski
 <luto@...nel.org>, Borislav Petkov <bp@...en8.de>, Christophe Leroy
 <christophe.leroy@...roup.eu>, Daniel Gomez <da.gomez@...sung.com>, Dave
 Hansen <dave.hansen@...ux.intel.com>, Ingo Molnar <mingo@...hat.com>,
 "Liam R. Howlett" <Liam.Howlett@...cle.com>, Luis Chamberlain
 <mcgrof@...nel.org>, Mark Rutland <mark.rutland@....com>, Masami Hiramatsu
 <mhiramat@...nel.org>, "H. Peter Anvin" <hpa@...or.com>, Peter Zijlstra
 <peterz@...radead.org>, Petr Pavlu <petr.pavlu@...e.com>, Sami Tolvanen
 <samitolvanen@...gle.com>, Steven Rostedt <rostedt@...dmis.org>, Thomas
 Gleixner <tglx@...utronix.de>, Yann Ylavic <ylavic.dev@...il.com>,
 linux-kernel@...r.kernel.org, linux-mm@...ck.org,
 linux-modules@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
 x86@...nel.org
Subject: Re: [PATCH v3 7/8] x86/kprobes: enable EXECMEM_ROX_CACHE for
 kprobes allocations

On Sun, 13 Jul 2025 10:17:29 +0300
Mike Rapoport <rppt@...nel.org> wrote:

> From: "Mike Rapoport (Microsoft)" <rppt@...nel.org>
> 
> x86::alloc_insn_page() always allocates ROX memory.
> 
> Instead of overriding this method, add EXECMEM_KPROBES entry in
> execmem_info with pgprot set to PAGE_KERNEL_ROX and  use ROX cache when
> configuration and CPU features allow it.
> 

Looks good to me.

Acked-by: Masami Hiramatsu (Google) <mhiramat@...nel.org>

Thanks!

> Acked-by: Peter Zijlstra (Intel) <peterz@...radead.org>
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@...nel.org>
> ---
>  arch/x86/kernel/kprobes/core.c | 18 ------------------
>  arch/x86/mm/init.c             |  9 ++++++++-
>  2 files changed, 8 insertions(+), 19 deletions(-)
> 
> diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
> index 47cb8eb138ba..6079d15dab8c 100644
> --- a/arch/x86/kernel/kprobes/core.c
> +++ b/arch/x86/kernel/kprobes/core.c
> @@ -481,24 +481,6 @@ static int prepare_singlestep(kprobe_opcode_t *buf, struct kprobe *p,
>  	return len;
>  }
>  
> -/* Make page to RO mode when allocate it */
> -void *alloc_insn_page(void)
> -{
> -	void *page;
> -
> -	page = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
> -	if (!page)
> -		return NULL;
> -
> -	/*
> -	 * TODO: Once additional kernel code protection mechanisms are set, ensure
> -	 * that the page was not maliciously altered and it is still zeroed.
> -	 */
> -	set_memory_rox((unsigned long)page, 1);
> -
> -	return page;
> -}
> -
>  /* Kprobe x86 instruction emulation - only regs->ip or IF flag modifiers */
>  
>  static void kprobe_emulate_ifmodifiers(struct kprobe *p, struct pt_regs *regs)
> diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c
> index dbc63f0d538f..442fafd8ff52 100644
> --- a/arch/x86/mm/init.c
> +++ b/arch/x86/mm/init.c
> @@ -1098,7 +1098,14 @@ struct execmem_info __init *execmem_arch_setup(void)
>  				.pgprot	= pgprot,
>  				.alignment = MODULE_ALIGN,
>  			},
> -			[EXECMEM_KPROBES ... EXECMEM_BPF] = {
> +			[EXECMEM_KPROBES] = {
> +				.flags	= flags,
> +				.start	= start,
> +				.end	= MODULES_END,
> +				.pgprot	= PAGE_KERNEL_ROX,
> +				.alignment = MODULE_ALIGN,
> +			},
> +			[EXECMEM_FTRACE ... EXECMEM_BPF] = {
>  				.flags	= EXECMEM_KASAN_SHADOW,
>  				.start	= start,
>  				.end	= MODULES_END,
> -- 
> 2.47.2
> 

-- 
Masami Hiramatsu (Google) <mhiramat@...nel.org>