Commit 4fc19708 authored by Nadav Amit's avatar Nadav Amit Committed by Ingo Molnar
Browse files

x86/alternatives: Initialize temporary mm for patching 



To prevent improper use of the PTEs that are used for text patching, the
next patches will use a temporary mm struct. Initailize it by copying
the init mm.

The address that will be used for patching is taken from the lower area
that is usually used for the task memory. Doing so prevents the need to
frequently synchronize the temporary-mm (e.g., when BPF programs are
installed), since different PGDs are used for the task memory.

Finally, randomize the address of the PTEs to harden against exploits
that use these PTEs.

Suggested-by: default avatarAndy Lutomirski <luto@kernel.org>
Tested-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: default avatarNadav Amit <namit@vmware.com>
Signed-off-by: default avatarRick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: default avatarMasami Hiramatsu <mhiramat@kernel.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Dave Hansen <dave.hansen@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Rik van Riel <riel@surriel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: akpm@linux-foundation.org
Cc: ard.biesheuvel@linaro.org
Cc: deneen.t.dock@intel.com
Cc: kernel-hardening@lists.openwall.com
Cc: kristen@linux.intel.com
Cc: linux_dti@icloud.com
Cc: will.deacon@arm.com
Link: https://lkml.kernel.org/r/20190426232303.28381-8-nadav.amit@gmail.com


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 13585fa0

arch/x86/include/asm/pgtable.h

+3 −0
Original line number Diff line number Diff line
@@ -1021,6 +1021,9 @@ static inline void __meminit init_trampoline_default(void) 
	/* Default trampoline pgd value */

	trampoline_pgd_entry = init_top_pgt[pgd_index(__PAGE_OFFSET)];

}



void __init poking_init(void);



# ifdef CONFIG_RANDOMIZE_MEMORY

void __meminit init_trampoline(void);

# else

arch/x86/include/asm/text-patching.h

+2 −0
Original line number Diff line number Diff line
@@ -39,5 +39,7 @@ extern void *text_poke_kgdb(void *addr, const void *opcode, size_t len); 
extern int poke_int3_handler(struct pt_regs *regs);

extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler);

extern int after_bootmem;

extern __ro_after_init struct mm_struct *poking_mm;

extern __ro_after_init unsigned long poking_addr;



#endif /* _ASM_X86_TEXT_PATCHING_H */

arch/x86/kernel/alternative.c

+3 −0
Original line number Diff line number Diff line
@@ -679,6 +679,9 @@ void *__init_or_module text_poke_early(void *addr, const void *opcode, 
	return addr;

}



__ro_after_init struct mm_struct *poking_mm;

__ro_after_init unsigned long poking_addr;



static void *__text_poke(void *addr, const void *opcode, size_t len)

{

	unsigned long flags;

arch/x86/mm/init.c

+37 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 
#include <linux/swapfile.h>

#include <linux/swapops.h>

#include <linux/kmemleak.h>

#include <linux/sched/task.h>



#include <asm/set_memory.h>

#include <asm/e820/api.h>
@@ -23,6 +24,7 @@ 
#include <asm/hypervisor.h>

#include <asm/cpufeature.h>

#include <asm/pti.h>

#include <asm/text-patching.h>



/*

 * We need to define the tracepoints somewhere, and tlb.c
@@ -701,6 +703,41 @@ void __init init_mem_mapping(void) 
	early_memtest(0, max_pfn_mapped << PAGE_SHIFT);

}



/*

 * Initialize an mm_struct to be used during poking and a pointer to be used

 * during patching.

 */

void __init poking_init(void)

{

	spinlock_t *ptl;

	pte_t *ptep;



	poking_mm = copy_init_mm();

	BUG_ON(!poking_mm);



	/*

	 * Randomize the poking address, but make sure that the following page

	 * will be mapped at the same PMD. We need 2 pages, so find space for 3,

	 * and adjust the address if the PMD ends after the first one.

	 */

	poking_addr = TASK_UNMAPPED_BASE;

	if (IS_ENABLED(CONFIG_RANDOMIZE_BASE))

		poking_addr += (kaslr_get_random_long("Poking") & PAGE_MASK) %

			(TASK_SIZE - TASK_UNMAPPED_BASE - 3 * PAGE_SIZE);



	if (((poking_addr + PAGE_SIZE) & ~PMD_MASK) == 0)

		poking_addr += PAGE_SIZE;



	/*

	 * We need to trigger the allocation of the page-tables that will be

	 * needed for poking now. Later, poking may be performed in an atomic

	 * section, which might cause allocation to fail.

	 */

	ptep = get_locked_pte(poking_mm, poking_addr, &ptl);

	BUG_ON(!ptep);

	pte_unmap_unlock(ptep, ptl);

}



/*

 * devmem_is_allowed() checks to see if /dev/mem access to a certain address

 * is valid. The argument is a physical page number.

init/main.c

+3 −0
Original line number Diff line number Diff line
@@ -504,6 +504,8 @@ void __init __weak thread_stack_cache_init(void) 


void __init __weak mem_encrypt_init(void) { }



void __init __weak poking_init(void) { }



bool initcall_debug;

core_param(initcall_debug, initcall_debug, bool, 0644);
@@ -737,6 +739,7 @@ asmlinkage __visible void __init start_kernel(void) 
	taskstats_init_early();

	delayacct_init();



	poking_init();

	check_bugs();



	acpi_subsystem_init();

CRA Git | Maintained and supported by SUSTech CRA and CCSE