Received: by 2002:ac0:a5a6:0:0:0:0:0 with SMTP id m35-v6csp344959imm; Wed, 29 Aug 2018 01:15:52 -0700 (PDT) X-Google-Smtp-Source: ANB0VdYrVh9IH4dcCeBvr3+LzA9j2YrvASxYzIS484hZXSECdVkrQTWbqnYUaEzCSHpNDsMi0lbl X-Received: by 2002:aa7:86cb:: with SMTP id h11-v6mr4846465pfo.58.1535530552455; Wed, 29 Aug 2018 01:15:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1535530552; cv=none; d=google.com; s=arc-20160816; b=sVFTDAxrtvz3XbgQd+gtR44bob95LLIjYs55yvWwUhFj0jja51oMf/ss1PCDGKAeRW cT3Ra9ynZai+9ALfW7H2DBaZr3sbZoz1CCLzyFY4CS1u1bL6knDsOq2QYTBkABuasCAo G9giITUQ/C+H2eZsm1Axq7TiKfqCV+8zSZUxaEgoLa+JidxyuSkhLWfyoR5lgkOjHCfv FQ6YKu02WySGViza6785Q6MVQgxyHVoN22nIHX0MIpxBM2lCtjixvbHKOoQYuxD7SxCP O5gqTKHxGx/Ec++DjtsavMEb4JbQaJvu1YgQ5vlYJGdMw/Ddrdwl1cgidqCpgMv4AuMO wOoA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:message-id:date:subject:cc :to:from:arc-authentication-results; bh=eLC7gjQhWQswtgE4h1uMLQyrZ6mZOGpjiM3LJAqujpw=; b=HdbQ67CmiK2N9gSVmFDKpLpFsPt/jqCP4WkiYaXWY5wti2fLc75mtPVZ7ELmccsBBr wqUxFqdIHCy6r5YhRAcSbnivj5Gf9z/Aded44KUj4ixiziZhUypYXzovP8286U3sjZRX 3+IxJmO9q5PWRs3IP3NR4Fj00E1tdSbOwQOSNpBTb/gZACYUbvavl5O6tvCjBh80bwQj 7u8R3RPUHPcmOW12TZWNUJ89+H0h6QarSDiAp1ZGC7KrszL0vUXMFuypOgbZDymFMhi9 AacnV56a4kMUgx4yyG7OGYZnsmfvJtMYPvjwUPhFFwkhjZdoWnHgBfCK+IiKDB+rxOpI IyTQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=vmware.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id i7-v6si3260453pfk.146.2018.08.29.01.15.37; Wed, 29 Aug 2018 01:15:52 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=vmware.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727996AbeH2MJJ (ORCPT + 99 others); Wed, 29 Aug 2018 08:09:09 -0400 Received: from ex13-edg-ou-001.vmware.com ([208.91.0.189]:43187 "EHLO EX13-EDG-OU-001.vmware.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727198AbeH2MJH (ORCPT ); Wed, 29 Aug 2018 08:09:07 -0400 Received: from sc9-mailhost3.vmware.com (10.113.161.73) by EX13-EDG-OU-001.vmware.com (10.113.208.155) with Microsoft SMTP Server id 15.0.1156.6; Wed, 29 Aug 2018 01:13:09 -0700 Received: from sc2-haas01-esx0118.eng.vmware.com (sc2-haas01-esx0118.eng.vmware.com [10.172.44.118]) by sc9-mailhost3.vmware.com (Postfix) with ESMTP id 23B5540B4D; Wed, 29 Aug 2018 01:13:26 -0700 (PDT) From: Nadav Amit To: Thomas Gleixner CC: , Ingo Molnar , , Arnd Bergmann , , Nadav Amit , Andy Lutomirski , Masami Hiramatsu , Kees Cook , Peter Zijlstra Subject: [RFC PATCH 0/6] x86: text_poke() fixes Date: Wed, 29 Aug 2018 01:11:41 -0700 Message-ID: <20180829081147.184610-1-namit@vmware.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 Content-Type: text/plain Received-SPF: None (EX13-EDG-OU-001.vmware.com: namit@vmware.com does not designate permitted sender hosts) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch-set addresses some issues that were raised in the recent correspondence and might affect the security and the correctness of code patching. (Note that patching performance is not addressed by this patch-set). The main issue that the patches deal with is the fact that the fixmap PTEs that are used for patching are available for access from other cores and might be exploited. They are not even flushed from the TLB in remote cores, so the risk is even higher. Address this issue by introducing a temporary mm that is only used during patching. Unfortunately, due to init ordering, fixmap is still used during boot-time patching. Future patches can eliminate the need for it. The second issue is the missing lockdep assertion to ensure text_mutex is taken. It is actually not always taken, so fix the instances that were found not to take the lock (although they should be safe even without taking the lock). Finally, try to be more conservative and to map a single page, instead of two, when possible. This helps both security and performance. In addition, there is some cleanup of the patching code to make it more readable. [ Andy: please provide your SOB for your patch ] Cc: Andy Lutomirski Cc: Masami Hiramatsu Cc: Kees Cook Cc: Peter Zijlstra Andy Lutomirski (1): x86/mm: temporary mm struct Nadav Amit (5): x86/alternative: assert text_mutex is taken fork: provide a function for copying init_mm x86/alternatives: initializing temporary mm for patching x86/alternatives: use temporary mm for text poking x86/alternatives: remove text_poke() return value arch/x86/include/asm/mmu_context.h | 20 ++++ arch/x86/include/asm/pgtable.h | 4 + arch/x86/include/asm/text-patching.h | 4 +- arch/x86/kernel/alternative.c | 157 +++++++++++++++++++++++---- arch/x86/kernel/kgdb.c | 9 ++ arch/x86/mm/init_64.c | 35 ++++++ include/asm-generic/pgtable.h | 4 + include/linux/sched/task.h | 1 + init/main.c | 1 + kernel/fork.c | 24 +++- 10 files changed, 230 insertions(+), 29 deletions(-) -- 2.17.1