From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Mon, 23 Oct 2017 10:32:16 +1100 From: "Tobin C. Harding" Message-ID: <20171022233216.GM29874@eros> References: <1508362242-12857-1-git-send-email-me@tobin.cc> <20171019013106.GE604@jagdpanzerIV> <20171019014429.GG31318@eros> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Subject: [kernel-hardening] Re: [PATCH v5] printk: hash addresses printed with %p To: "Jason A. Donenfeld" Cc: Sergey Senozhatsky , kernel-hardening@lists.openwall.com, Theodore Ts'o , Linus Torvalds , Kees Cook , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Joe Perches , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , LKML List-ID: On Thu, Oct 19, 2017 at 07:49:06AM +0200, Jason A. Donenfeld wrote: > A small detail carried over from the other thread: > > > > > but a bigger problem might the following thing: > > > > vscnprintf() > > pointer() > > ptr_to_id() > > initialize_ptr_secret() > > get_random_bytes() > > _get_random_bytes() > > extract_crng() > > _extract_crng() > > spin_lock_irqsave(&crng->lock, flags); <<<<< > > > > > > this, once again, can deadlock. can it? just like before: > > So, actually, then, we need to do this as an initcall. Fortunately, > that simplifies things greatly. Here's a rough sketch of what that > looks like, which you'll probably need to debug and refine: > > > > static siphash_key_t ptr_secret __ro_after_init; > static DEFINE_STATIC_KEY_TRUE(no_ptr_secret); > > static char *ptr_to_id(char *buf, char *end, void *ptr, struct printf_spec spec) > { > if (static_branch_unlikely(&no_ptr_secret)) > return "(pointer value)"; > > hashval = .... > > } > > static void fill_random_ptr_key(struct random_ready_callback *rdy) > { > get_random_bytes(&ptr_secret, sizeof(ptr_secret)); > static_branch_disable(&no_ptr_secret); > } > > static struct random_ready_callback random_ready = { > .func = fill_random_ptr_key > }; > > static int __init initialize_ptr_random(void) > { > int ret = add_random_ready_callback(&random_ready); > > if (!ret) > return 0; > else if (ret == -EALREADY) { > fill_random_ptr_key(&random_ready); > return 0; > } > > return ret; > } > early_initcall(initialize_ptr_random); Thanks for this Jason. This is _conceptually_ what I wanted since before v1, I obviously did not ask the right questions. Not to worry, we got there in the end. The process works, thanks to every bodies patience :) Implemented for v6 as suggested (including __read_mostly), you even got it fast for the usual case. Thanks, I learned a whole bunch from this email. Tobin. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932237AbdJVXcV (ORCPT ); Sun, 22 Oct 2017 19:32:21 -0400 Received: from out4-smtp.messagingengine.com ([66.111.4.28]:43537 "EHLO out4-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932123AbdJVXcU (ORCPT ); Sun, 22 Oct 2017 19:32:20 -0400 X-ME-Sender: Date: Mon, 23 Oct 2017 10:32:16 +1100 From: "Tobin C. Harding" To: "Jason A. Donenfeld" Cc: Sergey Senozhatsky , kernel-hardening@lists.openwall.com, "Theodore Ts'o" , Linus Torvalds , Kees Cook , Paolo Bonzini , Tycho Andersen , "Roberts, William C" , Tejun Heo , Jordan Glover , Greg KH , Petr Mladek , Joe Perches , Ian Campbell , Sergey Senozhatsky , Catalin Marinas , Will Deacon , Steven Rostedt , Chris Fries , Dave Weinstein , Daniel Micay , Djalal Harouni , LKML Subject: Re: [PATCH v5] printk: hash addresses printed with %p Message-ID: <20171022233216.GM29874@eros> References: <1508362242-12857-1-git-send-email-me@tobin.cc> <20171019013106.GE604@jagdpanzerIV> <20171019014429.GG31318@eros> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Mailer: Mutt 1.5.24 (2015-08-30) User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Oct 19, 2017 at 07:49:06AM +0200, Jason A. Donenfeld wrote: > A small detail carried over from the other thread: > > > > > but a bigger problem might the following thing: > > > > vscnprintf() > > pointer() > > ptr_to_id() > > initialize_ptr_secret() > > get_random_bytes() > > _get_random_bytes() > > extract_crng() > > _extract_crng() > > spin_lock_irqsave(&crng->lock, flags); <<<<< > > > > > > this, once again, can deadlock. can it? just like before: > > So, actually, then, we need to do this as an initcall. Fortunately, > that simplifies things greatly. Here's a rough sketch of what that > looks like, which you'll probably need to debug and refine: > > > > static siphash_key_t ptr_secret __ro_after_init; > static DEFINE_STATIC_KEY_TRUE(no_ptr_secret); > > static char *ptr_to_id(char *buf, char *end, void *ptr, struct printf_spec spec) > { > if (static_branch_unlikely(&no_ptr_secret)) > return "(pointer value)"; > > hashval = .... > > } > > static void fill_random_ptr_key(struct random_ready_callback *rdy) > { > get_random_bytes(&ptr_secret, sizeof(ptr_secret)); > static_branch_disable(&no_ptr_secret); > } > > static struct random_ready_callback random_ready = { > .func = fill_random_ptr_key > }; > > static int __init initialize_ptr_random(void) > { > int ret = add_random_ready_callback(&random_ready); > > if (!ret) > return 0; > else if (ret == -EALREADY) { > fill_random_ptr_key(&random_ready); > return 0; > } > > return ret; > } > early_initcall(initialize_ptr_random); Thanks for this Jason. This is _conceptually_ what I wanted since before v1, I obviously did not ask the right questions. Not to worry, we got there in the end. The process works, thanks to every bodies patience :) Implemented for v6 as suggested (including __read_mostly), you even got it fast for the usual case. Thanks, I learned a whole bunch from this email. Tobin.