linux-kernel - Re: [PATCH] mm: Remove PMD alignment constraint in execmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <d4019be7-e24c-4715-a42a-4f1fc39a9bd4@arm.com>
Date: Thu, 18 Sep 2025 14:06:25 +0100
From: Ryan Roberts <ryan.roberts@....com>
To: Mike Rapoport <rppt@...nel.org>, Dev Jain <dev.jain@....com>
Cc: akpm@...ux-foundation.org, linux-mm@...ck.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm: Remove PMD alignment constraint in execmem_vmalloc()

On 18/09/2025 11:33, Mike Rapoport wrote:
> On Thu, Sep 18, 2025 at 03:04:53PM +0530, Dev Jain wrote:
>> When using vmalloc with VM_ALLOW_HUGE_VMAP flag, it will set the alignment
>> to PMD_SIZE internally, if it deems huge mappings to be eligible.
>> Therefore, setting the alignment in execmem_vmalloc is redundant. Apart
>> from this, it also reduces the probability of allocation in case vmalloc
>> fails to allocate hugepages - in the fallback case, vmalloc tries to use
>> the original alignment and allocate basepages, which unfortunately will
>> again be PMD_SIZE passed over from execmem_vmalloc, thus constraining
>> the search for a free space in vmalloc region.
>>
>> Therefore, remove this constraint.
>>
>> Signed-off-by: Dev Jain <dev.jain@....com>
> 
> Reviewed-by: Mike Rapoport (Microsoft) <rppt@...nel.org>

Hijacking this thread to ask Mike a related question, which I noticed during
code review...

execmem_alloc() determines the pgprot from the descriptor set by the
architecture, and for !CONFIG_ARCH_HAS_EXECMEM_ROX (a la arm64), passes the
value into __vmalloc_node_range() (via execmem_vmalloc()). vmalloc then uses the
pgprot to set the permissions of the vmap. But the linear map is left as is
(i.e. RW).

arm64 requests PAGE_KERNEL_ROX for the EXECMEM_KPROBES type. So by my reckoning,
the memory ends up ROX in vmap and RW in linear map. Naively that sounds like
something we should be avoiding? Is this intentional?

For arches using the ROX cache, execmem_cache_populate() calls set_memory_rox()
which sets both vmap and linear map to ROX.

Thanks,
Ryan

> 
>> ---
>> mm-selftests pass, but I am not sure if they touch execmem code, and I
>> have no experience with this code.
>>
>>  mm/execmem.c | 3 ---
>>  1 file changed, 3 deletions(-)
>>
>> diff --git a/mm/execmem.c b/mm/execmem.c
>> index 0822305413ec..810a4ba9c924 100644
>> --- a/mm/execmem.c
>> +++ b/mm/execmem.c
>> @@ -38,9 +38,6 @@ static void *execmem_vmalloc(struct execmem_range *range, size_t size,
>>  	if (kasan)
>>  		vm_flags |= VM_DEFER_KMEMLEAK;
>>  
>> -	if (vm_flags & VM_ALLOW_HUGE_VMAP)
>> -		align = PMD_SIZE;
>> -
>>  	p = __vmalloc_node_range(size, align, start, end, gfp_flags,
>>  				 pgprot, vm_flags, NUMA_NO_NODE,
>>  				 __builtin_return_address(0));
>> -- 
>> 2.30.2
>>
>