Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1281169 > unrolled thread

[PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS.

Started byDaniel Cashman <dcashman@android.com>
First post2015-12-01 21:20 +0100
Last post2015-12-08 11:10 +0100
Articles 8 — 4 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  [PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS. Daniel Cashman <dcashman@android.com> - 2015-12-01 21:20 +0100
    [PATCH v5 4/4] x86: mm: support ARCH_MMAP_RND_BITS. Daniel Cashman <dcashman@android.com> - 2015-12-01 21:20 +0100
    Re: [PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS. Will Deacon <will.deacon@arm.com> - 2015-12-03 13:20 +0100
      Re: [PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS. Daniel Cashman <dcashman@android.com> - 2015-12-03 17:20 +0100
    Re: [PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS. Jon Hunter <jonathanh@nvidia.com> - 2015-12-07 11:30 +0100
      Re: [PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS. Arnd Bergmann <arnd@arndb.de> - 2015-12-07 12:20 +0100
        Re: [PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS. Daniel Cashman <dcashman@android.com> - 2015-12-07 19:30 +0100
          Re: [PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS. Arnd Bergmann <arnd@arndb.de> - 2015-12-08 11:10 +0100

#1281169 — [PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS.

FromDaniel Cashman <dcashman@android.com>
Date2015-12-01 21:20 +0100
Subject[PATCH v5 3/4] arm64: mm: support ARCH_MMAP_RND_BITS.
Message-ID<qAZz4-5UF-11@gated-at.bofh.it>
From: dcashman <dcashman@google.com>

arm64: arch_mmap_rnd() uses STACK_RND_MASK to generate the
random offset for the mmap base address.  This value represents a
compromise between increased ASLR effectiveness and avoiding
address-space fragmentation. Replace it with a Kconfig option, which
is sensibly bounded, so that platform developers may choose where to
place this compromise. Keep default values as new minimums.

Signed-off-by: Daniel Cashman <dcashman@android.com>
---
 arch/arm64/Kconfig   | 31 +++++++++++++++++++++++++++++++
 arch/arm64/mm/mmap.c |  8 ++++++--
 2 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 871f217..fb57649 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -51,6 +51,8 @@ config ARM64
 	select HAVE_ARCH_JUMP_LABEL
 	select HAVE_ARCH_KASAN if SPARSEMEM_VMEMMAP && !(ARM64_16K_PAGES && ARM64_VA_BITS_48)
 	select HAVE_ARCH_KGDB
+	select HAVE_ARCH_MMAP_RND_BITS if MMU
+	select HAVE_ARCH_MMAP_RND_COMPAT_BITS if MMU && COMPAT
 	select HAVE_ARCH_SECCOMP_FILTER
 	select HAVE_ARCH_TRACEHOOK
 	select HAVE_BPF_JIT
@@ -104,6 +106,35 @@ config ARCH_PHYS_ADDR_T_64BIT
 config MMU
 	def_bool y
 
+config ARCH_MMAP_RND_BITS_MIN
+       default 15 if ARM64_64K_PAGES
+       default 17 if ARM64_16K_PAGES
+       default 19
+
+config ARCH_MMAP_RND_BITS_MAX
+       default 19 if ARM64_VA_BITS=36
+       default 20 if ARM64_64K_PAGES && ARM64_VA_BITS=39
+       default 22 if ARM64_16K_PAGES && ARM64_VA_BITS=39
+       default 24 if ARM64_VA_BITS=39
+       default 23 if ARM64_64K_PAGES && ARM64_VA_BITS=42
+       default 25 if ARM64_16K_PAGES && ARM64_VA_BITS=42
+       default 27 if ARM64_VA_BITS=42
+       default 30 if ARM64_VA_BITS=47
+       default 29 if ARM64_64K_PAGES && ARM64_VA_BITS=48
+       default 31 if ARM64_16K_PAGES && ARM64_VA_BITS=48
+       default 33 if ARM64_VA_BITS=48
+       default 15 if ARM64_64K_PAGES
+       default 17 if ARM64_16K_PAGES
+       default 19
+
+config ARCH_MMAP_RND_COMPAT_BITS_MIN
+       default 7 if ARM64_64K_PAGES
+       default 9 if ARM64_16K_PAGES
+       default 11
+
+config ARCH_MMAP_RND_COMPAT_BITS_MAX
+       default 16
+
 config NO_IOPORT_MAP
 	def_bool y if !PCI
 
diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index ed17747..af461b9 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -51,8 +51,12 @@ unsigned long arch_mmap_rnd(void)
 {
 	unsigned long rnd;
 
-	rnd = (unsigned long)get_random_int() & STACK_RND_MASK;
-
+ifdef CONFIG_COMPAT
+	if (test_thread_flag(TIF_32BIT))
+		rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_compat_bits);
+	else
+#endif
+		rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_bits);
 	return rnd << PAGE_SHIFT;
 }
 
-- 
2.6.0.rc2.230.g3dd15c0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1281176 — [PATCH v5 4/4] x86: mm: support ARCH_MMAP_RND_BITS.

FromDaniel Cashman <dcashman@android.com>
Date2015-12-01 21:20 +0100
Subject[PATCH v5 4/4] x86: mm: support ARCH_MMAP_RND_BITS.
Message-ID<qAZz5-5UF-31@gated-at.bofh.it>
In reply to#1281169
From: dcashman <dcashman@google.com>

x86: arch_mmap_rnd() uses hard-coded values, 8 for 32-bit and 28 for
64-bit, to generate the random offset for the mmap base address.
This value represents a compromise between increased ASLR
effectiveness and avoiding address-space fragmentation. Replace it
with a Kconfig option, which is sensibly bounded, so that platform
developers may choose where to place this compromise. Keep default
values as new minimums.

Signed-off-by: Daniel Cashman <dcashman@android.com>
---
 arch/x86/Kconfig   | 16 ++++++++++++++++
 arch/x86/mm/mmap.c | 12 ++++++------
 2 files changed, 22 insertions(+), 6 deletions(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index db3622f..bdc67d2 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -82,6 +82,8 @@ config X86
 	select HAVE_ARCH_KASAN			if X86_64 && SPARSEMEM_VMEMMAP
 	select HAVE_ARCH_KGDB
 	select HAVE_ARCH_KMEMCHECK
+	select HAVE_ARCH_MMAP_RND_BITS		if MMU
+	select HAVE_ARCH_MMAP_RND_COMPAT_BITS	if MMU && COMPAT
 	select HAVE_ARCH_SECCOMP_FILTER
 	select HAVE_ARCH_SOFT_DIRTY		if X86_64
 	select HAVE_ARCH_TRACEHOOK
@@ -183,6 +185,20 @@ config HAVE_LATENCYTOP_SUPPORT
 config MMU
 	def_bool y
 
+config ARCH_MMAP_RND_BITS_MIN
+       default 28 if 64BIT
+       default 8
+
+config ARCH_MMAP_RND_BITS_MAX
+	default 32 if 64BIT
+	default 16
+
+config ARCH_MMAP_RND_COMPAT_BITS_MIN
+	default 8
+
+config ARCH_MMAP_RND_COMPAT_BITS_MAX
+	default 16
+
 config SBUS
 	bool
 
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 844b06d..647fecf 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -69,14 +69,14 @@ unsigned long arch_mmap_rnd(void)
 {
 	unsigned long rnd;
 
-	/*
-	 *  8 bits of randomness in 32bit mmaps, 20 address space bits
-	 * 28 bits of randomness in 64bit mmaps, 40 address space bits
-	 */
 	if (mmap_is_ia32())
-		rnd = (unsigned long)get_random_int() % (1<<8);
+#ifdef CONFIG_COMPAT
+		rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_compat_bits);
+#else
+		rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_bits);
+#endif
 	else
-		rnd = (unsigned long)get_random_int() % (1<<28);
+		rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_bits);
 
 	return rnd << PAGE_SHIFT;
 }
-- 
2.6.0.rc2.230.g3dd15c0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1282986

FromWill Deacon <will.deacon@arm.com>
Date2015-12-03 13:20 +0100
Message-ID<qBB1E-4Pm-9@gated-at.bofh.it>
In reply to#1281169
Hi Daniel,

On Tue, Dec 01, 2015 at 12:10:57PM -0800, Daniel Cashman wrote:
> From: dcashman <dcashman@google.com>
> 
> arm64: arch_mmap_rnd() uses STACK_RND_MASK to generate the
> random offset for the mmap base address.  This value represents a
> compromise between increased ASLR effectiveness and avoiding
> address-space fragmentation. Replace it with a Kconfig option, which
> is sensibly bounded, so that platform developers may choose where to
> place this compromise. Keep default values as new minimums.
> 
> Signed-off-by: Daniel Cashman <dcashman@android.com>
> ---
>  arch/arm64/Kconfig   | 31 +++++++++++++++++++++++++++++++
>  arch/arm64/mm/mmap.c |  8 ++++++--
>  2 files changed, 37 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
> index 871f217..fb57649 100644
> --- a/arch/arm64/Kconfig
> +++ b/arch/arm64/Kconfig
> @@ -51,6 +51,8 @@ config ARM64
>  	select HAVE_ARCH_JUMP_LABEL
>  	select HAVE_ARCH_KASAN if SPARSEMEM_VMEMMAP && !(ARM64_16K_PAGES && ARM64_VA_BITS_48)
>  	select HAVE_ARCH_KGDB
> +	select HAVE_ARCH_MMAP_RND_BITS if MMU
> +	select HAVE_ARCH_MMAP_RND_COMPAT_BITS if MMU && COMPAT

You can drop the 'if MMU' bits, since we don't support !MMU on arm64.

>  	select HAVE_ARCH_SECCOMP_FILTER
>  	select HAVE_ARCH_TRACEHOOK
>  	select HAVE_BPF_JIT
> @@ -104,6 +106,35 @@ config ARCH_PHYS_ADDR_T_64BIT
>  config MMU
>  	def_bool y
>  
> +config ARCH_MMAP_RND_BITS_MIN
> +       default 15 if ARM64_64K_PAGES
> +       default 17 if ARM64_16K_PAGES
> +       default 19

Is this correct? We currently have a mask of 0x3ffff, so that's 18 bits.

> +config ARCH_MMAP_RND_BITS_MAX
> +       default 19 if ARM64_VA_BITS=36
> +       default 20 if ARM64_64K_PAGES && ARM64_VA_BITS=39
> +       default 22 if ARM64_16K_PAGES && ARM64_VA_BITS=39
> +       default 24 if ARM64_VA_BITS=39
> +       default 23 if ARM64_64K_PAGES && ARM64_VA_BITS=42
> +       default 25 if ARM64_16K_PAGES && ARM64_VA_BITS=42
> +       default 27 if ARM64_VA_BITS=42
> +       default 30 if ARM64_VA_BITS=47
> +       default 29 if ARM64_64K_PAGES && ARM64_VA_BITS=48
> +       default 31 if ARM64_16K_PAGES && ARM64_VA_BITS=48
> +       default 33 if ARM64_VA_BITS=48
> +       default 15 if ARM64_64K_PAGES
> +       default 17 if ARM64_16K_PAGES
> +       default 19

Could you add a comment above this with the formula
(VA_BITS - PAGE_SHIFT - 3), please, so that we can update this easily in
the future if we need to?

Will
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1283166

FromDaniel Cashman <dcashman@android.com>
Date2015-12-03 17:20 +0100
Message-ID<qBELU-7sA-19@gated-at.bofh.it>
In reply to#1282986
On 12/3/15 4:17 AM, Will Deacon wrote:
>> +	select HAVE_ARCH_MMAP_RND_BITS if MMU
>> +	select HAVE_ARCH_MMAP_RND_COMPAT_BITS if MMU && COMPAT
> 
> You can drop the 'if MMU' bits, since we don't support !MMU on arm64.

Ok, will do. I was a little uneasy leaving it implicit, but even if
something w/out MMU on arm64 shows up, it'll easily be corrected.

>> +config ARCH_MMAP_RND_BITS_MIN
>> +       default 15 if ARM64_64K_PAGES
>> +       default 17 if ARM64_16K_PAGES
>> +       default 19
> 
> Is this correct? We currently have a mask of 0x3ffff, so that's 18 bits.

Off-by-one errors provide a good example of why hardening features are
useful? =/ Will change.

>> +config ARCH_MMAP_RND_BITS_MAX
>> +       default 19 if ARM64_VA_BITS=36
>> +       default 20 if ARM64_64K_PAGES && ARM64_VA_BITS=39
>> +       default 22 if ARM64_16K_PAGES && ARM64_VA_BITS=39
>> +       default 24 if ARM64_VA_BITS=39
>> +       default 23 if ARM64_64K_PAGES && ARM64_VA_BITS=42
>> +       default 25 if ARM64_16K_PAGES && ARM64_VA_BITS=42
>> +       default 27 if ARM64_VA_BITS=42
>> +       default 30 if ARM64_VA_BITS=47
>> +       default 29 if ARM64_64K_PAGES && ARM64_VA_BITS=48
>> +       default 31 if ARM64_16K_PAGES && ARM64_VA_BITS=48
>> +       default 33 if ARM64_VA_BITS=48
>> +       default 15 if ARM64_64K_PAGES
>> +       default 17 if ARM64_16K_PAGES
>> +       default 19
> 
> Could you add a comment above this with the formula
> (VA_BITS - PAGE_SHIFT - 3), please, so that we can update this easily in
> the future if we need to?
> 
Yes, seems reasonable.  Time will tell if this remains true for all
architectures, or even here, but it would be good to document it where
someone considering a change could easily find it.

Thank You,
Dan

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1285183

FromJon Hunter <jonathanh@nvidia.com>
Date2015-12-07 11:30 +0100
Message-ID<qD1do-3eK-25@gated-at.bofh.it>
In reply to#1281169
On 01/12/15 20:10, Daniel Cashman wrote:
> From: dcashman <dcashman@google.com>
> 
> arm64: arch_mmap_rnd() uses STACK_RND_MASK to generate the
> random offset for the mmap base address.  This value represents a
> compromise between increased ASLR effectiveness and avoiding
> address-space fragmentation. Replace it with a Kconfig option, which
> is sensibly bounded, so that platform developers may choose where to
> place this compromise. Keep default values as new minimums.
> 
> Signed-off-by: Daniel Cashman <dcashman@android.com>
> ---
>  arch/arm64/Kconfig   | 31 +++++++++++++++++++++++++++++++
>  arch/arm64/mm/mmap.c |  8 ++++++--
>  2 files changed, 37 insertions(+), 2 deletions(-)

[snip]

> diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
> index ed17747..af461b9 100644
> --- a/arch/arm64/mm/mmap.c
> +++ b/arch/arm64/mm/mmap.c
> @@ -51,8 +51,12 @@ unsigned long arch_mmap_rnd(void)
>  {
>  	unsigned long rnd;
>  
> -	rnd = (unsigned long)get_random_int() & STACK_RND_MASK;
> -
> +ifdef CONFIG_COMPAT
> +	if (test_thread_flag(TIF_32BIT))
> +		rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_compat_bits);
> +	else
> +#endif
> +		rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_bits);
>  	return rnd << PAGE_SHIFT;
>  }

The above is causing a build failure on -next today.

commit 42a6c8953112a9856dd09148c3d6a2cc106b6003
Author: Jon Hunter <jonathanh@nvidia.com>
Date:   Mon Dec 7 10:15:47 2015 +0000

    ARM64: mm: Fix build failure caused by invalid ifdef statement
    
    Commit 2e4614190421 ("arm64-mm-support-arch_mmap_rnd_bits-v4") caused the
    following build failure due to a missing "#". Fix this.
    
    arch/arm64/mm/mmap.c: In function ‘arch_mmap_rnd’:
    arch/arm64/mm/mmap.c:54:1: error: ‘ifdef’ undeclared (first use in this function)
     ifdef CONFIG_COMPAT
      ^
    Signed-off-by: Jon Hunter <jonathanh@nvidia.com>

diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
index af461b935137..e59a75a308bc 100644
--- a/arch/arm64/mm/mmap.c
+++ b/arch/arm64/mm/mmap.c
@@ -51,7 +51,7 @@ unsigned long arch_mmap_rnd(void)
 {
        unsigned long rnd;
 
-ifdef CONFIG_COMPAT
+#ifdef CONFIG_COMPAT
        if (test_thread_flag(TIF_32BIT))
                rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_compat_bits);
        else

Cheers
Jon
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1285218

FromArnd Bergmann <arnd@arndb.de>
Date2015-12-07 12:20 +0100
Message-ID<qD1ZM-3Ks-11@gated-at.bofh.it>
In reply to#1285183
On Monday 07 December 2015 10:26:16 Jon Hunter wrote:
> 
> diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
> index af461b935137..e59a75a308bc 100644
> --- a/arch/arm64/mm/mmap.c
> +++ b/arch/arm64/mm/mmap.c
> @@ -51,7 +51,7 @@ unsigned long arch_mmap_rnd(void)
>  {
>         unsigned long rnd;
>  
> -ifdef CONFIG_COMPAT
> +#ifdef CONFIG_COMPAT
>         if (test_thread_flag(TIF_32BIT))
>                 rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_compat_bits);
>         else
> 
> Cheers
> 

Ideally we'd remove the #ifdef around the mmap_rnd_compat_bits declaration
and change this code to use

	if (IS_ENABLED(CONFIG_COMPAT) && test_thread_flag(TIF_32BIT))

	Arnd
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1285844

FromDaniel Cashman <dcashman@android.com>
Date2015-12-07 19:30 +0100
Message-ID<qD8HU-8aH-9@gated-at.bofh.it>
In reply to#1285218
On 12/07/2015 03:13 AM, Arnd Bergmann wrote:
> On Monday 07 December 2015 10:26:16 Jon Hunter wrote:
>>
>> diff --git a/arch/arm64/mm/mmap.c b/arch/arm64/mm/mmap.c
>> index af461b935137..e59a75a308bc 100644
>> --- a/arch/arm64/mm/mmap.c
>> +++ b/arch/arm64/mm/mmap.c
>> @@ -51,7 +51,7 @@ unsigned long arch_mmap_rnd(void)
>>  {
>>         unsigned long rnd;
>>  
>> -ifdef CONFIG_COMPAT
>> +#ifdef CONFIG_COMPAT

Thank you Jon.  This ought to persuade me to do a final build against
the final patch, rather than the ugly porting I had been doing.  I'll
include this in v6. (how embarassing =/)

>>         if (test_thread_flag(TIF_32BIT))
>>                 rnd = (unsigned long)get_random_int() % (1 << mmap_rnd_compat_bits);
>>         else
>>
>> Cheers
>>
> 
> Ideally we'd remove the #ifdef around the mmap_rnd_compat_bits declaration
> and change this code to use
> 
> 	if (IS_ENABLED(CONFIG_COMPAT) && test_thread_flag(TIF_32BIT))
> 
> 	Arnd

That would result in "undefined reference to mmap_rnd_compat_bits" in
the not-defined case, no?

Thank You,
Dan
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1286365

FromArnd Bergmann <arnd@arndb.de>
Date2015-12-08 11:10 +0100
Message-ID<qDnnA-TA-9@gated-at.bofh.it>
In reply to#1285844
On Monday 07 December 2015 10:26:34 Daniel Cashman wrote:
> > Ideally we'd remove the #ifdef around the mmap_rnd_compat_bits declaration
> > and change this code to use
> > 
> >       if (IS_ENABLED(CONFIG_COMPAT) && test_thread_flag(TIF_32BIT))
> > 
> That would result in "undefined reference to mmap_rnd_compat_bits" in
> the not-defined case, no?

No. The compiler eliminates all code paths that it knows are unused.
The IS_ENABLED() macro is designed to let the compiler figure this out.

	Arnd
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web