linux-kernel - Re: [v2 PATCH] arm64: kprobes: call set_memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aMxAwDr11M2VG5XV@willie-the-truck>
Date: Thu, 18 Sep 2025 18:26:24 +0100
From: Will Deacon <will@...nel.org>
To: Yang Shi <yang@...amperecomputing.com>
Cc: catalin.marinas@....com, ryan.roberts@....com,
	linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
	stable@...r.kernel.org
Subject: Re: [v2 PATCH] arm64: kprobes: call set_memory_rox() for kprobe page

On Thu, Sep 18, 2025 at 09:23:49AM -0700, Yang Shi wrote:
> The kprobe page is allocated by execmem allocator with ROX permission.
> It needs to call set_memory_rox() to set proper permission for the
> direct map too. It was missed.
> 
> Fixes: 10d5e97c1bf8 ("arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page")
> Cc: <stable@...r.kernel.org>
> Signed-off-by: Yang Shi <yang@...amperecomputing.com>
> Reviewed-by: Catalin Marinas <catalin.marinas@....com>
> ---
> v2: Separated the patch from BBML2 series since it is an orthogonal bug
>     fix per Ryan.
>     Fixed the variable name nit per Catalin.
>     Collected R-bs from Catalin.
> 
>  arch/arm64/kernel/probes/kprobes.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/arch/arm64/kernel/probes/kprobes.c b/arch/arm64/kernel/probes/kprobes.c
> index 0c5d408afd95..8ab6104a4883 100644
> --- a/arch/arm64/kernel/probes/kprobes.c
> +++ b/arch/arm64/kernel/probes/kprobes.c
> @@ -10,6 +10,7 @@
>  
>  #define pr_fmt(fmt) "kprobes: " fmt
>  
> +#include <linux/execmem.h>
>  #include <linux/extable.h>
>  #include <linux/kasan.h>
>  #include <linux/kernel.h>
> @@ -41,6 +42,17 @@ DEFINE_PER_CPU(struct kprobe_ctlblk, kprobe_ctlblk);
>  static void __kprobes
>  post_kprobe_handler(struct kprobe *, struct kprobe_ctlblk *, struct pt_regs *);
>  
> +void *alloc_insn_page(void)
> +{
> +	void *addr;
> +
> +	addr = execmem_alloc(EXECMEM_KPROBES, PAGE_SIZE);
> +	if (!addr)
> +		return NULL;
> +	set_memory_rox((unsigned long)addr, 1);
> +	return addr;
> +}

Why isn't execmem taking care of this? It looks to me like the
execmem_cache_alloc() path calls set_memory_rox() but the
execmem_vmalloc() path doesn't?

It feels a bit bizarre to me that we have to provide our own wrapper
(which is identical to what s390 does). Also, how does alloc_insn_page()
handle the direct map alias on x86?

Will