|
Message-ID: <1537815484.19013.48.camel@intel.com> Date: Mon, 24 Sep 2018 18:57:35 +0000 From: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com> To: "keescook@...omium.org" <keescook@...omium.org> CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "daniel@...earbox.net" <daniel@...earbox.net>, "jannh@...gle.com" <jannh@...gle.com>, "arjan@...ux.intel.com" <arjan@...ux.intel.com>, "tglx@...utronix.de" <tglx@...utronix.de>, "linux-mm@...ck.org" <linux-mm@...ck.org>, "x86@...nel.org" <x86@...nel.org>, "kristen@...ux.intel.com" <kristen@...ux.intel.com>, "hpa@...or.com" <hpa@...or.com>, "mingo@...hat.com" <mingo@...hat.com>, "alexei.starovoitov@...il.com" <alexei.starovoitov@...il.com>, "kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>, "Hansen, Dave" <dave.hansen@...el.com> Subject: Re: [PATCH v6 2/4] x86/modules: Increase randomization for modules On Fri, 2018-09-21 at 12:05 -0700, Kees Cook wrote: > On Thu, Sep 13, 2018 at 2:31 PM, Rick Edgecombe > <rick.p.edgecombe@...el.com> wrote: > I would find this much more readable as: > static unsigned long get_module_vmalloc_start(void) > { > unsigned long addr = MODULES_VADDR; > > if (kaslr_randomize_base()) > addr += get_module_load_offset(); > > if (kaslr_randomize_each_module()) > addr += get_modules_rand_len(); > > return addr; > } Thanks, that looks better. > > > void *module_alloc(unsigned long size) > > { > > @@ -84,16 +201,18 @@ void *module_alloc(unsigned long size) > > if (PAGE_ALIGN(size) > MODULES_LEN) > > return NULL; > > > > - p = __vmalloc_node_range(size, MODULE_ALIGN, > > - MODULES_VADDR + > > get_module_load_offset(), > > - MODULES_END, GFP_KERNEL, > > - PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE, > > - __builtin_return_address(0)); > > + p = try_module_randomize_each(size); > > + > > + if (!p) > > + p = __vmalloc_node_range(size, MODULE_ALIGN, > > + get_module_vmalloc_start(), MODULES_END, > > + GFP_KERNEL, PAGE_KERNEL_EXEC, 0, > > + NUMA_NO_NODE, __builtin_return_address(0)); > Instead of having two open-coded __vmalloc_node_range() calls left in > this after the change, can this be done in terms of a call to > try_module_alloc() instead? I see they're slightly different, but it > might be nice for making the two paths share more code. Not sure what you mean. Across the whole change, there is one call to __vmalloc_node_range, and one to __vmalloc_node_try_addr.
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.