From patchwork Thu Jan 17 00:32:42 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: "Edgecombe, Rick P" X-Patchwork-Id: 10767231 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C43201390 for ; Thu, 17 Jan 2019 00:33:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B57BD2FCBC for ; Thu, 17 Jan 2019 00:33:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B137F2FD2A; Thu, 17 Jan 2019 00:33:40 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F06AD2FCBC for ; Thu, 17 Jan 2019 00:33:39 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id D17338E0004; Wed, 16 Jan 2019 19:33:38 -0500 (EST) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id CC7848E0002; Wed, 16 Jan 2019 19:33:38 -0500 (EST) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B900C8E0004; Wed, 16 Jan 2019 19:33:38 -0500 (EST) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) by kanga.kvack.org (Postfix) with ESMTP id 7A0808E0002 for ; Wed, 16 Jan 2019 19:33:38 -0500 (EST) Received: by mail-pg1-f199.google.com with SMTP id a2so5000489pgt.11 for ; Wed, 16 Jan 2019 16:33:38 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-original-authentication-results:x-gm-message-state:from:to:cc :subject:date:message-id:mime-version:content-transfer-encoding; bh=dkFpcfzUNUxXxqqxNU8xrUagOp7iGRMiMKkSdW/TWN0=; b=gA5UFKcepfXCpI+B/9rY84SnyV1yBglmOK7117o4Dcw4Q2zJz7Xqlaqb6yHUxSzI7l aVqyWGO5hsaysm9UsvzhmS2CkoCvJ0zGha6Csg/f7NOm2JstL6AEVW2HzXU602Aj5sob 8EB9sPwHPjCbGYag+ev7b0AZ2SnqGlVIxkaa90vLjlMfCP5BYD65OSiF8w5UUmRdiQOz CfzlzbzN67d5euQ8mooZTuyJHCjQKCxxVifD9xSDnkihZTPAg1LIBQrGtPitAAH5qbi7 eFqMcKI0BU8lHbgx7DCZl2pehjo1FO54vE+Hpwt+n2ldbV6jqcmBQg405PLnzzZWoK3G 1irw== X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.120 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Gm-Message-State: AJcUukdON8HLsD9vIkUbE0pa98anyFFIxlwPeEfvSaYd1hxVDbBGx1gC DgV+9uPRYS+A5yfZXOybZpOmz2LIW210rH9LSX8EIx6cEnYZDxmUZihSqUQnhf/N3tjf3eFxU7g cuQLRHt0k9wJgEf377h4QxoCk6F124dANOp2Xc+ip5tXN2F5wOcIQt3JCjpEglepQKg== X-Received: by 2002:a62:b80a:: with SMTP id p10mr11447052pfe.32.1547685218093; Wed, 16 Jan 2019 16:33:38 -0800 (PST) X-Google-Smtp-Source: ALg8bN5TneXb+wcPFWfCYcfFLmlthWD/gCCfpicIB4a7LZxMmx4t4CFcv49hywjHoap+IZW2TD2V X-Received: by 2002:a62:b80a:: with SMTP id p10mr11446974pfe.32.1547685217076; Wed, 16 Jan 2019 16:33:37 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1547685217; cv=none; d=google.com; s=arc-20160816; b=PxPh4ObiRGrqGG/VOfxGmdqng074XwtSDqvIoyk32Mh65R5Mlz6wDeJToZRGmHyO1q 1qgpXJJ7EKFiE1VJAzTJV19O9LAbN+2rOHcXyJUEUCr9uUCmiFh2D05/bA9/94XTWizS DrY+slFE6xNvRvxy/SxfLATwP8pv8KQMM4M2TP06nD2zcGmbPt/LB+cFQJOXCZr36jNw YwY3+u/x1Mq2hLMCDoeEfpL7EA/YtVAxKUIHyiDQ5RRXHFiFf8iJaW3oA2VwSR0w5rvy 6G73enlWIpTE2KKZbdq5//Ewa0TknFKCn52GFUhZ3jBXD6Cm+SE9VI63P7hT/l5+5iGj 9ofQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from; bh=dkFpcfzUNUxXxqqxNU8xrUagOp7iGRMiMKkSdW/TWN0=; b=kczDolWzayDqPk6v+lTdr9yOKHNItAalScsLJCcrqva+Dk98xVC7d4PCL+unUn9WCV vjCThwu0/h0MftzWQTUjQ2X6ZsikiuafqRZvJ+5V7GPn7jddaY8Li5uXWRMntEve1EDm /yEDLrdfFQ2Qi79Gt/nv367g2Epg3PnkM/4IBsaYrfuVilp7d60aGRvsQn019+aGunvY R2RajdTbxlFKeWGgObUbjTIsV4nCGNbC8hjMHlXmsWowxWNwqz0wsnxZ+Cu8dmQdJL2a o/a51Mr3Le1/Id14bqHVqJLAW/NzoELwQAT22N1sG12ZzmEHbVuctCggUdazJGCi0Xc2 O7hg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.120 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com Received: from mga04.intel.com (mga04.intel.com. [192.55.52.120]) by mx.google.com with ESMTPS id y10si7582915plt.406.2019.01.16.16.33.36 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 16 Jan 2019 16:33:37 -0800 (PST) Received-SPF: pass (google.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.120 as permitted sender) client-ip=192.55.52.120; Authentication-Results: mx.google.com; spf=pass (google.com: domain of rick.p.edgecombe@intel.com designates 192.55.52.120 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=intel.com X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga005.jf.intel.com ([10.7.209.41]) by fmsmga104.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 Jan 2019 16:33:36 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.56,488,1539673200"; d="scan'208";a="292166007" Received: from rpedgeco-desk5.jf.intel.com ([10.54.75.79]) by orsmga005.jf.intel.com with ESMTP; 16 Jan 2019 16:33:34 -0800 From: Rick Edgecombe To: Andy Lutomirski , Ingo Molnar Cc: linux-kernel@vger.kernel.org, x86@kernel.org, hpa@zytor.com, Thomas Gleixner , Borislav Petkov , Nadav Amit , Dave Hansen , Peter Zijlstra , linux_dti@icloud.com, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, akpm@linux-foundation.org, kernel-hardening@lists.openwall.com, linux-mm@kvack.org, will.deacon@arm.com, ard.biesheuvel@linaro.org, kristen@linux.intel.com, deneen.t.dock@intel.com, Rick Edgecombe Subject: [PATCH 00/17] Merge text_poke fixes and executable lockdowns Date: Wed, 16 Jan 2019 16:32:42 -0800 Message-Id: <20190117003259.23141-1-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This patchset improves several overlapping issues around stale TLB entries and W^X violations. It is combined from a slightly tweaked "x86/alternative: text_poke() enhancements v7" [1] and a next version of the "Don’t leave executable TLB entries to freed pages v2" [2] patchsets that were conflicting. The related issues that this fixes: 1. Fixmap PTEs that are used for patching are available for access from other cores and might be exploited. They are not even flushed from the TLB in remote cores, so the risk is even higher. Address this issue by introducing a temporary mm that is only used during patching. Unfortunately, due to init ordering, fixmap is still used during boot-time patching. Future patches can eliminate the need for it. 2. Missing lockdep assertion to ensure text_mutex is taken. It is actually not always taken, so fix the instances that were found not to take the lock (although they should be safe even without taking the lock). 3. Module_alloc returning memory that is RWX until a module is finished loading. 4. Sometimes when memory is freed via the module subsystem, an executable permissioned TLB entry can remain to a freed page. If the page is re-used to back an address that will receive data from userspace, it can result in user data being mapped as executable in the kernel. The root of this behavior is vfree lazily flushing the TLB, but not lazily freeing the underlying pages. The new changes from "Don’t leave executable TLB entries to freed pages v2": - Add support for case of hibernate trying to save an unmapped page on the directmap. (Ard Biesheuvel) - No week arch breakout for vfree-ing special memory (Andy Lutomirski) - Avoid changing deferred free code by moving modules init free to work queue (Andy Lutomirski) - Plug in new flag for kprobes and ftrace - More arch generic names for set_pages functions (Ard Biesheuvel) - Fix for TLB not always flushing the directmap (Nadav Amit) New changes from from "x86/alternative: text_poke() enhancements v7" - Fix build failure on CONFIG_RANDOMIZE_BASE=n (Rick) - Remove text_poke usage from ftrace (Nadav) [1] https://lkml.org/lkml/2018/12/5/200 [2] https://lkml.org/lkml/2018/12/11/1571 Andy Lutomirski (1): x86/mm: temporary mm struct Nadav Amit (12): Fix "x86/alternatives: Lockdep-enforce text_mutex in text_poke*()" x86/jump_label: Use text_poke_early() during early init fork: provide a function for copying init_mm x86/alternative: initializing temporary mm for patching x86/alternative: use temporary mm for text poking x86/kgdb: avoid redundant comparison of patched code x86/ftrace: set trampoline pages as executable x86/kprobes: Instruction pages initialization enhancements x86: avoid W^X being broken during modules loading x86/jump-label: remove support for custom poker x86/alternative: Remove the return value of text_poke_*() module: Prevent module removal racing with text_poke() Rick Edgecombe (4): Add set_alias_ function and x86 implementation mm: Make hibernate handle unmapped pages vmalloc: New flags for safe vfree on special perms Plug in new special vfree flag arch/Kconfig | 4 + arch/x86/Kconfig | 1 + arch/x86/include/asm/fixmap.h | 2 - arch/x86/include/asm/mmu_context.h | 32 +++++ arch/x86/include/asm/pgtable.h | 3 + arch/x86/include/asm/set_memory.h | 3 + arch/x86/include/asm/text-patching.h | 7 +- arch/x86/kernel/alternative.c | 197 ++++++++++++++++++++------- arch/x86/kernel/ftrace.c | 15 +- arch/x86/kernel/jump_label.c | 19 ++- arch/x86/kernel/kgdb.c | 25 +--- arch/x86/kernel/kprobes/core.c | 19 ++- arch/x86/kernel/module.c | 2 +- arch/x86/mm/init_64.c | 36 +++++ arch/x86/mm/pageattr.c | 16 ++- arch/x86/xen/mmu_pv.c | 2 - include/linux/filter.h | 18 +-- include/linux/mm.h | 18 +-- include/linux/sched/task.h | 1 + include/linux/set_memory.h | 10 ++ include/linux/vmalloc.h | 13 ++ init/main.c | 3 + kernel/bpf/core.c | 1 - kernel/fork.c | 24 +++- kernel/module.c | 87 ++++++------ mm/page_alloc.c | 6 +- mm/vmalloc.c | 122 ++++++++++++++--- 27 files changed, 497 insertions(+), 189 deletions(-) Acked-by: Peter Zijlstra (Intel)