Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1537815484.19013.48.camel@intel.com>
Date: Mon, 24 Sep 2018 18:57:35 +0000
From: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To: "keescook@...omium.org" <keescook@...omium.org>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"daniel@...earbox.net" <daniel@...earbox.net>, "jannh@...gle.com"
	<jannh@...gle.com>, "arjan@...ux.intel.com" <arjan@...ux.intel.com>,
	"tglx@...utronix.de" <tglx@...utronix.de>, "linux-mm@...ck.org"
	<linux-mm@...ck.org>, "x86@...nel.org" <x86@...nel.org>,
	"kristen@...ux.intel.com" <kristen@...ux.intel.com>, "hpa@...or.com"
	<hpa@...or.com>, "mingo@...hat.com" <mingo@...hat.com>,
	"alexei.starovoitov@...il.com" <alexei.starovoitov@...il.com>,
	"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>,
	"Hansen, Dave" <dave.hansen@...el.com>
Subject: Re: [PATCH v6 2/4] x86/modules: Increase randomization for modules

On Fri, 2018-09-21 at 12:05 -0700, Kees Cook wrote:
> On Thu, Sep 13, 2018 at 2:31 PM, Rick Edgecombe
> <rick.p.edgecombe@...el.com> wrote:
> I would find this much more readable as:
> static unsigned long get_module_vmalloc_start(void)
> {
>        unsigned long addr = MODULES_VADDR;
> 
>        if (kaslr_randomize_base())
>               addr += get_module_load_offset();
> 
>        if (kaslr_randomize_each_module())
>                addr += get_modules_rand_len();
> 
>        return addr;
> }
Thanks, that looks better.

> 
> >  void *module_alloc(unsigned long size)
> >  {
> > @@ -84,16 +201,18 @@ void *module_alloc(unsigned long size)
> >         if (PAGE_ALIGN(size) > MODULES_LEN)
> >                 return NULL;
> > 
> > -       p = __vmalloc_node_range(size, MODULE_ALIGN,
> > -                                   MODULES_VADDR +
> > get_module_load_offset(),
> > -                                   MODULES_END, GFP_KERNEL,
> > -                                   PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
> > -                                   __builtin_return_address(0));
> > +       p = try_module_randomize_each(size);
> > +
> > +       if (!p)
> > +               p = __vmalloc_node_range(size, MODULE_ALIGN,
> > +                               get_module_vmalloc_start(), MODULES_END,
> > +                               GFP_KERNEL, PAGE_KERNEL_EXEC, 0,
> > +                               NUMA_NO_NODE, __builtin_return_address(0));
> Instead of having two open-coded __vmalloc_node_range() calls left in
> this after the change, can this be done in terms of a call to
> try_module_alloc() instead? I see they're slightly different, but it
> might be nice for making the two paths share more code.
Not sure what you mean. Across the whole change, there is one call
to __vmalloc_node_range, and one to __vmalloc_node_try_addr.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.