lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <202210071010.52C672FA9@keescook> Date: Fri, 7 Oct 2022 10:12:42 -0700 From: Kees Cook <keescook@...omium.org> To: "Jason A. Donenfeld" <Jason@...c4.com> Cc: Christophe Leroy <christophe.leroy@...roup.eu>, "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "patches@...ts.linux.dev" <patches@...ts.linux.dev>, Andreas Noever <andreas.noever@...il.com>, Andrew Morton <akpm@...ux-foundation.org>, Andy Shevchenko <andriy.shevchenko@...ux.intel.com>, Borislav Petkov <bp@...en8.de>, Catalin Marinas <catalin.marinas@....com>, Christoph Böhmwalder <christoph.boehmwalder@...bit.com>, Christoph Hellwig <hch@....de>, Daniel Borkmann <daniel@...earbox.net>, Dave Airlie <airlied@...hat.com>, Dave Hansen <dave.hansen@...ux.intel.com>, "David S . Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Florian Westphal <fw@...len.de>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, "H . Peter Anvin" <hpa@...or.com>, Heiko Carstens <hca@...ux.ibm.com>, Helge Deller <deller@....de>, Herbert Xu <herbert@...dor.apana.org.au>, Huacai Chen <chenhuacai@...nel.org>, Hugh Dickins <hughd@...gle.com>, Jakub Kicinski <kuba@...nel.org>, "James E . J . Bottomley" <jejb@...ux.ibm.com>, Jan Kara <jack@...e.com>, Jason Gunthorpe <jgg@...pe.ca>, Jens Axboe <axboe@...nel.dk>, Johannes Berg <johannes@...solutions.net>, Jonathan Corbet <corbet@....net>, Jozsef Kadlecsik <kadlec@...filter.org>, KP Singh <kpsingh@...nel.org>, Marco Elver <elver@...gle.com>, Mauro Carvalho Chehab <mchehab@...nel.org>, Michael Ellerman <mpe@...erman.id.au>, Pablo Neira Ayuso <pablo@...filter.org>, Paolo Abeni <pabeni@...hat.com>, Peter Zijlstra <peterz@...radead.org>, Richard Weinberger <richard@....at>, Russell King <linux@...linux.org.uk>, Theodore Ts'o <tytso@....edu>, Thomas Bogendoerfer <tsbogend@...ha.franken.de>, Thomas Gleixner <tglx@...utronix.de>, Thomas Graf <tgraf@...g.ch>, Ulf Hansson <ulf.hansson@...aro.org>, Vignesh Raghavendra <vigneshr@...com>, WANG Xuerui <kernel@...0n.name>, Will Deacon <will@...nel.org>, Yury Norov <yury.norov@...il.com>, "dri-devel@...ts.freedesktop.org" <dri-devel@...ts.freedesktop.org>, "kasan-dev@...glegroups.com" <kasan-dev@...glegroups.com>, "kernel-janitors@...r.kernel.org" <kernel-janitors@...r.kernel.org>, "linux-arm-kernel@...ts.infradead.org" <linux-arm-kernel@...ts.infradead.org>, "linux-block@...r.kernel.org" <linux-block@...r.kernel.org>, "linux-crypto@...r.kernel.org" <linux-crypto@...r.kernel.org>, "linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>, "linux-fsdevel@...r.kernel.org" <linux-fsdevel@...r.kernel.org>, "linux-media@...r.kernel.org" <linux-media@...r.kernel.org>, "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>, "linux-mm@...ck.org" <linux-mm@...ck.org>, "linux-mmc@...r.kernel.org" <linux-mmc@...r.kernel.org>, "linux-mtd@...ts.infradead.org" <linux-mtd@...ts.infradead.org>, "linux-nvme@...ts.infradead.org" <linux-nvme@...ts.infradead.org>, "linux-parisc@...r.kernel.org" <linux-parisc@...r.kernel.org>, "linux-rdma@...r.kernel.org" <linux-rdma@...r.kernel.org>, "linux-s390@...r.kernel.org" <linux-s390@...r.kernel.org>, "linux-um@...ts.infradead.org" <linux-um@...ts.infradead.org>, "linux-usb@...r.kernel.org" <linux-usb@...r.kernel.org>, "linux-wireless@...r.kernel.org" <linux-wireless@...r.kernel.org>, "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>, "loongarch@...ts.linux.dev" <loongarch@...ts.linux.dev>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>, "sparclinux@...r.kernel.org" <sparclinux@...r.kernel.org>, "x86@...nel.org" <x86@...nel.org>, Toke Høiland-Jørgensen <toke@...e.dk>, Chuck Lever <chuck.lever@...cle.com>, Jan Kara <jack@...e.cz> Subject: Re: [PATCH v3 3/5] treewide: use get_random_u32() when possible On Fri, Oct 07, 2022 at 08:07:58AM -0600, Jason A. Donenfeld wrote: > On Fri, Oct 07, 2022 at 04:57:24AM +0000, Christophe Leroy wrote: > > > > > > Le 07/10/2022 à 01:36, Jason A. Donenfeld a écrit : > > > On 10/6/22, Christophe Leroy <christophe.leroy@...roup.eu> wrote: > > >> > > >> > > >> Le 06/10/2022 à 19:31, Christophe Leroy a écrit : > > >>> > > >>> > > >>> Le 06/10/2022 à 19:24, Jason A. Donenfeld a écrit : > > >>>> Hi Christophe, > > >>>> > > >>>> On Thu, Oct 6, 2022 at 11:21 AM Christophe Leroy > > >>>> <christophe.leroy@...roup.eu> wrote: > > >>>>> Le 06/10/2022 à 18:53, Jason A. Donenfeld a écrit : > > >>>>>> The prandom_u32() function has been a deprecated inline wrapper around > > >>>>>> get_random_u32() for several releases now, and compiles down to the > > >>>>>> exact same code. Replace the deprecated wrapper with a direct call to > > >>>>>> the real function. The same also applies to get_random_int(), which is > > >>>>>> just a wrapper around get_random_u32(). > > >>>>>> > > >>>>>> Reviewed-by: Kees Cook <keescook@...omium.org> > > >>>>>> Acked-by: Toke Høiland-Jørgensen <toke@...e.dk> # for sch_cake > > >>>>>> Acked-by: Chuck Lever <chuck.lever@...cle.com> # for nfsd > > >>>>>> Reviewed-by: Jan Kara <jack@...e.cz> # for ext4 > > >>>>>> Signed-off-by: Jason A. Donenfeld <Jason@...c4.com> > > >>>>>> --- > > >>>>> > > >>>>>> diff --git a/arch/powerpc/kernel/process.c > > >>>>>> b/arch/powerpc/kernel/process.c > > >>>>>> index 0fbda89cd1bb..9c4c15afbbe8 100644 > > >>>>>> --- a/arch/powerpc/kernel/process.c > > >>>>>> +++ b/arch/powerpc/kernel/process.c > > >>>>>> @@ -2308,6 +2308,6 @@ void notrace __ppc64_runlatch_off(void) > > >>>>>> unsigned long arch_align_stack(unsigned long sp) > > >>>>>> { > > >>>>>> if (!(current->personality & ADDR_NO_RANDOMIZE) && > > >>>>>> randomize_va_space) > > >>>>>> - sp -= get_random_int() & ~PAGE_MASK; > > >>>>>> + sp -= get_random_u32() & ~PAGE_MASK; > > >>>>>> return sp & ~0xf; > > >>>>> > > >>>>> Isn't that a candidate for prandom_u32_max() ? > > >>>>> > > >>>>> Note that sp is deemed to be 16 bytes aligned at all time. > > >>>> > > >>>> Yes, probably. It seemed non-trivial to think about, so I didn't. But > > >>>> let's see here... maybe it's not too bad: > > >>>> > > >>>> If PAGE_MASK is always ~(PAGE_SIZE-1), then ~PAGE_MASK is > > >>>> (PAGE_SIZE-1), so prandom_u32_max(PAGE_SIZE) should yield the same > > >>>> thing? Is that accurate? And holds across platforms (this comes up a > > >>>> few places)? If so, I'll do that for a v4. > > >>>> > > >>> > > >>> On powerpc it is always (from arch/powerpc/include/asm/page.h) : > > >>> > > >>> /* > > >>> * Subtle: (1 << PAGE_SHIFT) is an int, not an unsigned long. So if we > > >>> * assign PAGE_MASK to a larger type it gets extended the way we want > > >>> * (i.e. with 1s in the high bits) > > >>> */ > > >>> #define PAGE_MASK (~((1 << PAGE_SHIFT) - 1)) > > >>> > > >>> #define PAGE_SIZE (1UL << PAGE_SHIFT) > > >>> > > >>> > > >>> So it would work I guess. > > >> > > >> But taking into account that sp must remain 16 bytes aligned, would it > > >> be better to do something like ? > > >> > > >> sp -= prandom_u32_max(PAGE_SIZE >> 4) << 4; > > >> > > >> return sp; > > > > > > Does this assume that sp is already aligned at the beginning of the > > > function? I'd assume from the function's name that this isn't the > > > case? > > > > Ah you are right, I overlooked it. > > So I think to stay on the safe side, I'm going to go with > `prandom_u32_max(PAGE_SIZE)`. Sound good? Given these kinds of less mechanical changes, it may make sense to split these from the "trivial" conversions in a treewide patch. The chance of needing a revert from the simple 1:1 conversions is much lower than the need to revert by-hand changes. The Cocci script I suggested in my v1 review gets 80% of the first patch, for example. -- Kees Cook
Powered by blists - more mailing lists