From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Message-ID: <1469010283.2800.5.camel@gmail.com> From: Balbir Singh Date: Wed, 20 Jul 2016 20:24:43 +1000 In-Reply-To: References: <1468619065-3222-1-git-send-email-keescook@chromium.org> <1468619065-3222-3-git-send-email-keescook@chromium.org> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [kernel-hardening] Re: [PATCH v3 02/11] mm: Hardened usercopy To: Kees Cook , Laura Abbott Cc: LKML , Daniel Micay , Josh Poimboeuf , Rik van Riel , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Borislav Petkov , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" List-ID: On Tue, 2016-07-19 at 11:48 -0700, Kees Cook wrote: > On Mon, Jul 18, 2016 at 6:06 PM, Laura Abbott wrote: > >  > > On 07/15/2016 02:44 PM, Kees Cook wrote: > >  > > This doesn't work when copying CMA allocated memory since CMA purposely > > allocates larger than a page block size without setting head pages. > > Given CMA may be used with drivers doing zero copy buffers, I think it > > should be permitted. > >  > > Something like the following lets it pass (I can clean up and submit > > the is_migrate_cma_page APIs as a separate patch for review) > Yeah, this would be great. I'd rather use an accessor to check this > than a direct check for MIGRATE_CMA. > > >          */ > >         for (; ptr <= end ; ptr += PAGE_SIZE, page = virt_to_head_page(ptr)) > > { > > -               if (!PageReserved(page)) > > +               if (!PageReserved(page) && !is_migrate_cma_page(page)) > >                         return ""; > >         } > Yeah, I'll modify this a bit so that which type it starts as is > maintained for all pages (rather than allowing to flip back and forth > -- even though that is likely impossible). >  Sorry, I completely missed the MIGRATE_CMA bits. Could you clarify if you caught this in testing/review? Balbir Singh. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Balbir Singh Subject: Re: [PATCH v3 02/11] mm: Hardened usercopy Date: Wed, 20 Jul 2016 20:24:43 +1000 Message-ID: <1469010283.2800.5.camel@gmail.com> References: <1468619065-3222-1-git-send-email-keescook@chromium.org> <1468619065-3222-3-git-send-email-keescook@chromium.org> Mime-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: Sender: owner-linux-mm@kvack.org To: Kees Cook , Laura Abbott Cc: LKML , Daniel Micay , Josh Poimboeuf , Rik van Riel , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Bori List-Id: linux-arch.vger.kernel.org On Tue, 2016-07-19 at 11:48 -0700, Kees Cook wrote: > On Mon, Jul 18, 2016 at 6:06 PM, Laura Abbott wrot= e: > >=C2=A0 > > On 07/15/2016 02:44 PM, Kees Cook wrote: > >=C2=A0 > > This doesn't work when copying CMA allocated memory since CMA purpose= ly > > allocates larger than a page block size without setting head pages. > > Given CMA may be used with drivers doing zero copy buffers, I think i= t > > should be permitted. > >=C2=A0 > > Something like the following lets it pass (I can clean up and submit > > the is_migrate_cma_page APIs as a separate patch for review) > Yeah, this would be great. I'd rather use an accessor to check this > than a direct check for MIGRATE_CMA. > > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0*/ > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0for (; ptr <=3D end ;= ptr +=3D PAGE_SIZE, page =3D virt_to_head_page(ptr)) > > { > > -=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0if (!PageReserved(page)) > > +=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0if (!PageReserved(page) && !is_migrate_cma_page(page= )) > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2= =A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0= return ""; > > =C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0} > Yeah, I'll modify this a bit so that which type it starts as is > maintained for all pages (rather than allowing to flip back and forth > -- even though that is likely impossible). >=C2=A0 Sorry, I completely missed the MIGRATE_CMA bits. Could you clarify if you caught this in testing/review? Balbir Singh. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pa0-f66.google.com ([209.85.220.66]:36531 "EHLO mail-pa0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753159AbcGTKYN (ORCPT ); Wed, 20 Jul 2016 06:24:13 -0400 Message-ID: <1469010283.2800.5.camel@gmail.com> Subject: Re: [PATCH v3 02/11] mm: Hardened usercopy From: Balbir Singh Date: Wed, 20 Jul 2016 20:24:43 +1000 In-Reply-To: References: <1468619065-3222-1-git-send-email-keescook@chromium.org> <1468619065-3222-3-git-send-email-keescook@chromium.org> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-arch-owner@vger.kernel.org List-ID: To: Kees Cook , Laura Abbott Cc: LKML , Daniel Micay , Josh Poimboeuf , Rik van Riel , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Borislav Petkov , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" Message-ID: <20160720102443.t8EXnL2InZBSDk-MdQuwbO9jZLu0fM7WO2NdRbkdu90@z> On Tue, 2016-07-19 at 11:48 -0700, Kees Cook wrote: > On Mon, Jul 18, 2016 at 6:06 PM, Laura Abbott wrote: > >  > > On 07/15/2016 02:44 PM, Kees Cook wrote: > >  > > This doesn't work when copying CMA allocated memory since CMA purposely > > allocates larger than a page block size without setting head pages. > > Given CMA may be used with drivers doing zero copy buffers, I think it > > should be permitted. > >  > > Something like the following lets it pass (I can clean up and submit > > the is_migrate_cma_page APIs as a separate patch for review) > Yeah, this would be great. I'd rather use an accessor to check this > than a direct check for MIGRATE_CMA. > > >          */ > >         for (; ptr <= end ; ptr += PAGE_SIZE, page = virt_to_head_page(ptr)) > > { > > -               if (!PageReserved(page)) > > +               if (!PageReserved(page) && !is_migrate_cma_page(page)) > >                         return ""; > >         } > Yeah, I'll modify this a bit so that which type it starts as is > maintained for all pages (rather than allowing to flip back and forth > -- even though that is likely impossible). >  Sorry, I completely missed the MIGRATE_CMA bits. Could you clarify if you caught this in testing/review? Balbir Singh. From mboxrd@z Thu Jan 1 00:00:00 1970 From: Balbir Singh Date: Wed, 20 Jul 2016 10:24:43 +0000 Subject: Re: [PATCH v3 02/11] mm: Hardened usercopy Message-Id: <1469010283.2800.5.camel@gmail.com> List-Id: References: <1468619065-3222-1-git-send-email-keescook@chromium.org> <1468619065-3222-3-git-send-email-keescook@chromium.org> In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit To: Kees Cook , Laura Abbott Cc: LKML , Daniel Micay , Josh Poimboeuf , Rik van Riel , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Borislav Petkov , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" On Tue, 2016-07-19 at 11:48 -0700, Kees Cook wrote: > On Mon, Jul 18, 2016 at 6:06 PM, Laura Abbott wrote: > >  > > On 07/15/2016 02:44 PM, Kees Cook wrote: > >  > > This doesn't work when copying CMA allocated memory since CMA purposely > > allocates larger than a page block size without setting head pages. > > Given CMA may be used with drivers doing zero copy buffers, I think it > > should be permitted. > >  > > Something like the following lets it pass (I can clean up and submit > > the is_migrate_cma_page APIs as a separate patch for review) > Yeah, this would be great. I'd rather use an accessor to check this > than a direct check for MIGRATE_CMA. > > >          */ > >         for (; ptr <= end ; ptr += PAGE_SIZE, page = virt_to_head_page(ptr)) > > { > > -               if (!PageReserved(page)) > > +               if (!PageReserved(page) && !is_migrate_cma_page(page)) > >                         return ""; > >         } > Yeah, I'll modify this a bit so that which type it starts as is > maintained for all pages (rather than allowing to flip back and forth > -- even though that is likely impossible). >  Sorry, I completely missed the MIGRATE_CMA bits. Could you clarify if you caught this in testing/review? Balbir Singh. From mboxrd@z Thu Jan 1 00:00:00 1970 From: bsingharora@gmail.com (Balbir Singh) Date: Wed, 20 Jul 2016 20:24:43 +1000 Subject: [PATCH v3 02/11] mm: Hardened usercopy In-Reply-To: References: <1468619065-3222-1-git-send-email-keescook@chromium.org> <1468619065-3222-3-git-send-email-keescook@chromium.org> Message-ID: <1469010283.2800.5.camel@gmail.com> To: linux-arm-kernel@lists.infradead.org List-Id: linux-arm-kernel.lists.infradead.org On Tue, 2016-07-19 at 11:48 -0700, Kees Cook wrote: > On Mon, Jul 18, 2016 at 6:06 PM, Laura Abbott wrote: > >? > > On 07/15/2016 02:44 PM, Kees Cook wrote: > >? > > This doesn't work when copying CMA allocated memory since CMA purposely > > allocates larger than a page block size without setting head pages. > > Given CMA may be used with drivers doing zero copy buffers, I think it > > should be permitted. > >? > > Something like the following lets it pass (I can clean up and submit > > the is_migrate_cma_page APIs as a separate patch for review) > Yeah, this would be great. I'd rather use an accessor to check this > than a direct check for MIGRATE_CMA. > > > ?????????*/ > > ????????for (; ptr <= end ; ptr += PAGE_SIZE, page = virt_to_head_page(ptr)) > > { > > -???????????????if (!PageReserved(page)) > > +???????????????if (!PageReserved(page) && !is_migrate_cma_page(page)) > > ????????????????????????return ""; > > ????????} > Yeah, I'll modify this a bit so that which type it starts as is > maintained for all pages (rather than allowing to flip back and forth > -- even though that is likely impossible). >? Sorry, I completely missed the MIGRATE_CMA bits. Could you clarify if you caught this in testing/review? Balbir Singh. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f199.google.com (mail-pf0-f199.google.com [209.85.192.199]) by kanga.kvack.org (Postfix) with ESMTP id 860C26B0005 for ; Wed, 20 Jul 2016 06:24:13 -0400 (EDT) Received: by mail-pf0-f199.google.com with SMTP id y134so91237779pfg.1 for ; Wed, 20 Jul 2016 03:24:13 -0700 (PDT) Received: from mail-pa0-x244.google.com (mail-pa0-x244.google.com. [2607:f8b0:400e:c03::244]) by mx.google.com with ESMTPS id b6si2714268pag.62.2016.07.20.03.24.12 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 20 Jul 2016 03:24:12 -0700 (PDT) Received: by mail-pa0-x244.google.com with SMTP id q2so3084928pap.0 for ; Wed, 20 Jul 2016 03:24:12 -0700 (PDT) Message-ID: <1469010283.2800.5.camel@gmail.com> Subject: Re: [PATCH v3 02/11] mm: Hardened usercopy From: Balbir Singh Date: Wed, 20 Jul 2016 20:24:43 +1000 In-Reply-To: References: <1468619065-3222-1-git-send-email-keescook@chromium.org> <1468619065-3222-3-git-send-email-keescook@chromium.org> Content-Type: text/plain; charset="UTF-8" Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: owner-linux-mm@kvack.org List-ID: To: Kees Cook , Laura Abbott Cc: LKML , Daniel Micay , Josh Poimboeuf , Rik van Riel , Casey Schaufler , PaX Team , Brad Spengler , Russell King , Catalin Marinas , Will Deacon , Ard Biesheuvel , Benjamin Herrenschmidt , Michael Ellerman , Tony Luck , Fenghua Yu , "David S. Miller" , "x86@kernel.org" , Christoph Lameter , Pekka Enberg , David Rientjes , Joonsoo Kim , Andrew Morton , Andy Lutomirski , Borislav Petkov , Mathias Krause , Jan Kara , Vitaly Wool , Andrea Arcangeli , Dmitry Vyukov , "linux-arm-kernel@lists.infradead.org" , linux-ia64@vger.kernel.org, "linuxppc-dev@lists.ozlabs.org" , sparclinux , linux-arch , Linux-MM , "kernel-hardening@lists.openwall.com" On Tue, 2016-07-19 at 11:48 -0700, Kees Cook wrote: > On Mon, Jul 18, 2016 at 6:06 PM, Laura Abbott wrote: > >A > > On 07/15/2016 02:44 PM, Kees Cook wrote: > >A > > This doesn't work when copying CMA allocated memory since CMA purposely > > allocates larger than a page block size without setting head pages. > > Given CMA may be used with drivers doing zero copy buffers, I think it > > should be permitted. > >A > > Something like the following lets it pass (I can clean up and submit > > the is_migrate_cma_page APIs as a separate patch for review) > Yeah, this would be great. I'd rather use an accessor to check this > than a direct check for MIGRATE_CMA. > > > A A A A A A A A A */ > > A A A A A A A A for (; ptr <= end ; ptr += PAGE_SIZE, page = virt_to_head_page(ptr)) > > { > > -A A A A A A A A A A A A A A A if (!PageReserved(page)) > > +A A A A A A A A A A A A A A A if (!PageReserved(page) && !is_migrate_cma_page(page)) > > A A A A A A A A A A A A A A A A A A A A A A A A return ""; > > A A A A A A A A } > Yeah, I'll modify this a bit so that which type it starts as is > maintained for all pages (rather than allowing to flip back and forth > -- even though that is likely impossible). >A Sorry, I completely missed the MIGRATE_CMA bits. Could you clarify if you caught this in testing/review? Balbir Singh. -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org