Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1452112 > unrolled thread

[PATCH 0/7] char/random: Simplify random address requests

Started byJason Cooper <jason@lakedaemon.net>
First post2016-07-28 23:30 +0200
Last post2016-08-04 04:50 +0200
Articles 16 on this page of 36 — 6 participants

Back to article view | Back to linux.kernel

Contents

  [PATCH 0/7] char/random: Simplify random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-28 23:30 +0200
    [PATCH 1/7] random: Simplify API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-28 23:30 +0200
      Re: [PATCH 1/7] random: Simplify API for random address requests Yann Droneaud <ydroneaud@opteya.com> - 2016-07-29 11:00 +0200
        Re: [PATCH 1/7] random: Simplify API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-29 20:30 +0200
    [PATCH 5/7] tile: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-28 23:30 +0200
    [PATCH 7/7] random: Remove unused randomize_range() Jason Cooper <jason@lakedaemon.net> - 2016-07-28 23:30 +0200
    [PATCH 6/7] unicore32: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-28 23:30 +0200
    [PATCH 4/7] arm64: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-28 23:30 +0200
      Re: [PATCH 4/7] arm64: Use simpler API for random address requests Will Deacon <will.deacon@arm.com> - 2016-07-29 15:50 +0200
    [PATCH 3/7] ARM: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-28 23:30 +0200
    [PATCH v2 7/7] random: Remove unused randomize_range() Jason Cooper <jason@lakedaemon.net> - 2016-07-30 17:50 +0200
    [PATCH v2 4/7] arm64: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-30 17:50 +0200
    [PATCH v2 2/7] x86: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-30 17:50 +0200
    [PATCH v2 5/7] tile: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-30 17:50 +0200
    [PATCH v2 3/7] ARM: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-30 17:50 +0200
    [PATCH v2 1/7] random: Simplify API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-30 17:50 +0200
      Re: [PATCH v2 1/7] random: Simplify API for random address requests Kees Cook <keescook@chromium.org> - 2016-07-31 18:50 +0200
        Re: [PATCH v2 1/7] random: Simplify API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-31 23:00 +0200
          Re: [PATCH v2 1/7] random: Simplify API for random address requests Kees Cook <keescook@chromium.org> - 2016-08-01 21:50 +0200
            Re: [PATCH v2 1/7] random: Simplify API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-02 01:20 +0200
              Re: [kernel-hardening] Re: [PATCH v2 1/7] random: Simplify API for random address requests Michael Ellerman <mpe@ellerman.id.au> - 2016-08-02 05:40 +0200
                Re: [kernel-hardening] Re: [PATCH v2 1/7] random: Simplify API for  random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-03 20:50 +0200
    [PATCH v2 0/7] char/random: Simplify random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-30 17:50 +0200
      [PATCH v2 6/7] unicore32: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-07-30 17:50 +0200
    [PATCH v3 2/7] x86: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-04 01:50 +0200
    [PATCH v3 6/7] unicore32: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-04 01:50 +0200
    [PATCH v3 5/7] tile: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-04 01:50 +0200
    [PATCH v3 7/7] random: Remove unused randomize_range() Jason Cooper <jason@lakedaemon.net> - 2016-08-04 01:50 +0200
      Re: [PATCH v3 7/7] random: Remove unused randomize_range() Andrew Morton <akpm@linux-foundation.org> - 2016-08-04 01:50 +0200
        Re: [PATCH v3 7/7] random: Remove unused randomize_range() Jason Cooper <jason@lakedaemon.net> - 2016-08-04 02:20 +0200
    [PATCH v3 0/7] char/random: Simplify random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-04 01:50 +0200
      [PATCH v3 4/7] arm64: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-04 01:50 +0200
      [PATCH v3 1/7] random: Simplify API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-04 01:50 +0200
        Re: [PATCH v3 1/7] random: Simplify API for random address requests Yann Droneaud <ydroneaud@opteya.com> - 2016-08-04 14:50 +0200
      [PATCH v3 3/7] ARM: Use simpler API for random address requests Jason Cooper <jason@lakedaemon.net> - 2016-08-04 01:50 +0200
      Re: [PATCH v3 0/7] char/random: Simplify random address requests Kees Cook <keescook@chromium.org> - 2016-08-04 04:50 +0200

Page 2 of 2 — ← Prev page 1 [2]

#1453569 — Re: [kernel-hardening] Re: [PATCH v2 1/7] random: Simplify API for random address requests

FromMichael Ellerman <mpe@ellerman.id.au>
Date2016-08-02 05:40 +0200
SubjectRe: [kernel-hardening] Re: [PATCH v2 1/7] random: Simplify API for random address requests
Message-ID<s1yIG-7go-17@gated-at.bofh.it>
In reply to#1453503
Jason Cooper <jason@lakedaemon.net> writes:
> On Mon, Aug 01, 2016 at 12:47:59PM -0700, Kees Cook wrote:
>> On Sun, Jul 31, 2016 at 1:56 PM, Jason Cooper <jason@lakedaemon.net> wrote:
>> 
>> I have no new call sites in mind, but it seems safe to add a BUG_ON to
>> verify we don't gain callers that don't follow the correct
>> expectations. (Or maybe WARN and return start.)
>
> No, I think BUG_ON is appropriate.  afaict, the only time this will be
> encountered is during the development process.

Unless it's not.

Why crash someone's system when you could just page align the value
you're given?

cheers

[toc] | [prev] | [next] | [standalone]

#1455967 — Re: [kernel-hardening] Re: [PATCH v2 1/7] random: Simplify API for random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-03 20:50 +0200
SubjectRe: [kernel-hardening] Re: [PATCH v2 1/7] random: Simplify API for random address requests
Message-ID<s29oT-6hy-37@gated-at.bofh.it>
In reply to#1453569
On Tue, Aug 02, 2016 at 01:35:13PM +1000, Michael Ellerman wrote:
> Jason Cooper <jason@lakedaemon.net> writes:
> > On Mon, Aug 01, 2016 at 12:47:59PM -0700, Kees Cook wrote:
> >> On Sun, Jul 31, 2016 at 1:56 PM, Jason Cooper <jason@lakedaemon.net> wrote:
> >> 
> >> I have no new call sites in mind, but it seems safe to add a BUG_ON to
> >> verify we don't gain callers that don't follow the correct
> >> expectations. (Or maybe WARN and return start.)
> >
> > No, I think BUG_ON is appropriate.  afaict, the only time this will be
> > encountered is during the development process.
> 
> Unless it's not.
> 
> Why crash someone's system when you could just page align the value
> you're given?

Ack, v3 on it's way.

thx,

Jason.

[toc] | [prev] | [next] | [standalone]

#1452713 — [PATCH v2 0/7] char/random: Simplify random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-07-30 17:50 +0200
Subject[PATCH v2 0/7] char/random: Simplify random address requests
Message-ID<s0EGt-4lH-3@gated-at.bofh.it>
In reply to#1452112
Two previous attempts have been made to rework this API.  The first can be
found at:

  https://lkml.kernel.org/r/cover.1390770607.git.ydroneaud@opteya.com

The second at:

  https://lkml.kernel.org/r/1469471141-25669-1-git-send-email-william.c.roberts@intel.com

The RFC version of this series can been seen at:

  https://lkml.kernel.org/r/20160726030201.6775-1-jason@lakedaemon.net

In addition to incorporating ideas from these two previous efforts, this series
adds several desirable features.  First, we take the range as an argument
directly, which removes math both before the call and inside the function.
Second, we return the start address on error.  All callers fell back to the
start address on error, so we remove the need to check for errors.  Third, we
cap range to prevent overflow.  Last, we use kerneldoc to describe the new
function.

If possible, I'd like to request Acks from the various subsystems so that we
can merge this as one bisectable branch.

Changes from v1:
 - Explicitly mention page_aligned start assumption (Yann Droneaud)
 - pick random pages vice random addresses (Yann Droneaud)
 - catch range=0 last
 - Add Ack for arm64 (Will Deacon)

Jason Cooper (7):
  random: Simplify API for random address requests
  x86: Use simpler API for random address requests
  ARM: Use simpler API for random address requests
  arm64: Use simpler API for random address requests
  tile: Use simpler API for random address requests
  unicore32: Use simpler API for random address requests
  random: Remove unused randomize_range()

 arch/arm/kernel/process.c       |  3 +--
 arch/arm64/kernel/process.c     |  8 ++------
 arch/tile/mm/mmap.c             |  3 +--
 arch/unicore32/kernel/process.c |  3 +--
 arch/x86/kernel/process.c       |  3 +--
 arch/x86/kernel/sys_x86_64.c    |  5 +----
 drivers/char/random.c           | 31 ++++++++++++++++++++-----------
 include/linux/random.h          |  2 +-
 8 files changed, 28 insertions(+), 30 deletions(-)

-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1452715 — [PATCH v2 6/7] unicore32: Use simpler API for random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-07-30 17:50 +0200
Subject[PATCH v2 6/7] unicore32: Use simpler API for random address requests
Message-ID<s0EGu-4lH-25@gated-at.bofh.it>
In reply to#1452713
Currently, all callers to randomize_range() set the length to 0 and
calculate end by adding a constant to the start address.  We can
simplify the API to remove a bunch of needless checks and variables.

Use the new randomize_addr(start, range) call to set the requested
address.

Signed-off-by: Jason Cooper <jason@lakedaemon.net>
---
Changes from v1:
 - none

 arch/unicore32/kernel/process.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/unicore32/kernel/process.c b/arch/unicore32/kernel/process.c
index 00299c927852..b856178cf167 100644
--- a/arch/unicore32/kernel/process.c
+++ b/arch/unicore32/kernel/process.c
@@ -295,8 +295,7 @@ unsigned long get_wchan(struct task_struct *p)
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-	unsigned long range_end = mm->brk + 0x02000000;
-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+	return randomize_addr(mm->brk, 0x02000000);
 }
 
 /*
-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456060 — [PATCH v3 2/7] x86: Use simpler API for random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 01:50 +0200
Subject[PATCH v3 2/7] x86: Use simpler API for random address requests
Message-ID<s2e5b-U8-1@gated-at.bofh.it>
In reply to#1452112
Currently, all callers to randomize_range() set the length to 0 and
calculate end by adding a constant to the start address.  We can
simplify the API to remove a bunch of needless checks and variables.

Use the new randomize_addr(start, range) call to set the requested
address.

Signed-off-by: Jason Cooper <jason@lakedaemon.net>
---
Changes from v2:
 - s/randomize_addr/randomize_page/ (Kees Cook)

 arch/x86/kernel/process.c    | 3 +--
 arch/x86/kernel/sys_x86_64.c | 5 +----
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 96becbbb52e0..8ca7f42d97f3 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -507,8 +507,7 @@ unsigned long arch_align_stack(unsigned long sp)
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-	unsigned long range_end = mm->brk + 0x02000000;
-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+	return randomize_page(mm->brk, 0x02000000);
 }
 
 /*
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index 10e0272d789a..a55ed63b9f91 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -101,7 +101,6 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
 			   unsigned long *end)
 {
 	if (!test_thread_flag(TIF_ADDR32) && (flags & MAP_32BIT)) {
-		unsigned long new_begin;
 		/* This is usually used needed to map code in small
 		   model, so it needs to be in the first 31bit. Limit
 		   it to that.  This means we need to move the
@@ -112,9 +111,7 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
 		*begin = 0x40000000;
 		*end = 0x80000000;
 		if (current->flags & PF_RANDOMIZE) {
-			new_begin = randomize_range(*begin, *begin + 0x02000000, 0);
-			if (new_begin)
-				*begin = new_begin;
+			*begin = randomize_page(*begin, 0x02000000);
 		}
 	} else {
 		*begin = current->mm->mmap_legacy_base;
-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456061 — [PATCH v3 6/7] unicore32: Use simpler API for random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 01:50 +0200
Subject[PATCH v3 6/7] unicore32: Use simpler API for random address requests
Message-ID<s2e5b-U8-5@gated-at.bofh.it>
In reply to#1452112
Currently, all callers to randomize_range() set the length to 0 and
calculate end by adding a constant to the start address.  We can
simplify the API to remove a bunch of needless checks and variables.

Use the new randomize_addr(start, range) call to set the requested
address.

Signed-off-by: Jason Cooper <jason@lakedaemon.net>
---
Changes from v2:
 - s/randomize_addr/randomize_page/ (Kees Cook)

 arch/unicore32/kernel/process.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/unicore32/kernel/process.c b/arch/unicore32/kernel/process.c
index 00299c927852..d7c6b676b3a5 100644
--- a/arch/unicore32/kernel/process.c
+++ b/arch/unicore32/kernel/process.c
@@ -295,8 +295,7 @@ unsigned long get_wchan(struct task_struct *p)
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-	unsigned long range_end = mm->brk + 0x02000000;
-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+	return randomize_page(mm->brk, 0x02000000);
 }
 
 /*
-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456063 — [PATCH v3 5/7] tile: Use simpler API for random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 01:50 +0200
Subject[PATCH v3 5/7] tile: Use simpler API for random address requests
Message-ID<s2e5b-U8-9@gated-at.bofh.it>
In reply to#1452112
Currently, all callers to randomize_range() set the length to 0 and
calculate end by adding a constant to the start address.  We can
simplify the API to remove a bunch of needless checks and variables.

Use the new randomize_addr(start, range) call to set the requested
address.

Signed-off-by: Jason Cooper <jason@lakedaemon.net>
---
Changes from v2:
 - s/randomize_addr/randomize_page/ (Kees Cook)

 arch/tile/mm/mmap.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/tile/mm/mmap.c b/arch/tile/mm/mmap.c
index 851a94e6ae58..ef61c597898b 100644
--- a/arch/tile/mm/mmap.c
+++ b/arch/tile/mm/mmap.c
@@ -88,6 +88,5 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-	unsigned long range_end = mm->brk + 0x02000000;
-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+	return randomize_page(mm->brk, 0x02000000);
 }
-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456064 — [PATCH v3 7/7] random: Remove unused randomize_range()

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 01:50 +0200
Subject[PATCH v3 7/7] random: Remove unused randomize_range()
Message-ID<s2e5b-U8-11@gated-at.bofh.it>
In reply to#1452112
All call sites for randomize_range have been updated to use the much
simpler and more robust randomize_addr.  Remove the now unnecessary
code.

Signed-off-by: Jason Cooper <jason@lakedaemon.net>
---
 drivers/char/random.c  | 19 -------------------
 include/linux/random.h |  1 -
 2 files changed, 20 deletions(-)

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 61cb434e3bea..46d332dd27a4 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1821,25 +1821,6 @@ unsigned long get_random_long(void)
 }
 EXPORT_SYMBOL(get_random_long);
 
-/*
- * randomize_range() returns a start address such that
- *
- *    [...... <range> .....]
- *  start                  end
- *
- * a <range> with size "len" starting at the return value is inside in the
- * area defined by [start, end], but is otherwise randomized.
- */
-unsigned long
-randomize_range(unsigned long start, unsigned long end, unsigned long len)
-{
-	unsigned long range = end - len - start;
-
-	if (end <= start + len)
-		return 0;
-	return PAGE_ALIGN(get_random_int() % range + start);
-}
-
 /**
  * randomize_page - Generate a random, page aligned address
  * @start:	The smallest acceptable address the caller will take.
diff --git a/include/linux/random.h b/include/linux/random.h
index 098fec690d65..9281dbbb7f4a 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -34,7 +34,6 @@ extern const struct file_operations random_fops, urandom_fops;
 
 unsigned int get_random_int(void);
 unsigned long get_random_long(void);
-unsigned long randomize_range(unsigned long start, unsigned long end, unsigned long len);
 unsigned long randomize_page(unsigned long start, unsigned long range);
 
 u32 prandom_u32(void);
-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456068 — Re: [PATCH v3 7/7] random: Remove unused randomize_range()

FromAndrew Morton <akpm@linux-foundation.org>
Date2016-08-04 01:50 +0200
SubjectRe: [PATCH v3 7/7] random: Remove unused randomize_range()
Message-ID<s2e5b-U8-13@gated-at.bofh.it>
In reply to#1456064
On Wed,  3 Aug 2016 23:39:13 +0000 Jason Cooper <jason@lakedaemon.net> wrote:

> All call sites for randomize_range have been updated to use the much
> simpler and more robust randomize_addr.  Remove the now unnecessary
> code.

"randomize_page'.

I think I'll grab these patches, see if anybody emits any squeaks.

[toc] | [prev] | [next] | [standalone]

#1456078 — Re: [PATCH v3 7/7] random: Remove unused randomize_range()

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 02:20 +0200
SubjectRe: [PATCH v3 7/7] random: Remove unused randomize_range()
Message-ID<s2eyd-1j2-3@gated-at.bofh.it>
In reply to#1456068
On Wed, Aug 03, 2016 at 04:48:10PM -0700, Andrew Morton wrote:
> On Wed,  3 Aug 2016 23:39:13 +0000 Jason Cooper <jason@lakedaemon.net> wrote:
> 
> > All call sites for randomize_range have been updated to use the much
> > simpler and more robust randomize_addr.  Remove the now unnecessary
> > code.
> 
> "randomize_page'.

Doh!

> I think I'll grab these patches, see if anybody emits any squeaks.

Thanks, Andrew!

thx,

Jason.

[toc] | [prev] | [next] | [standalone]

#1456065 — [PATCH v3 0/7] char/random: Simplify random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 01:50 +0200
Subject[PATCH v3 0/7] char/random: Simplify random address requests
Message-ID<s2e5b-U8-3@gated-at.bofh.it>
In reply to#1452112
Two previous attempts have been made to rework this API.  The first can be
found at:

  https://lkml.kernel.org/r/cover.1390770607.git.ydroneaud@opteya.com

The second at:

  https://lkml.kernel.org/r/1469471141-25669-1-git-send-email-william.c.roberts@intel.com

Previous versions of this series can been seen at:

RFC:  https://lkml.kernel.org/r/20160726030201.6775-1-jason@lakedaemon.net
 v1:  https://lkml.kernel.org/r/20160728204730.27453-1-jason@lakedaemon.net
 v2:  https://lkml.kernel.org/r/20160730154244.403-1-jason@lakedaemon.net

In addition to incorporating ideas from these two previous efforts, this series
adds several desirable features.  First, we take the range as an argument
directly, which removes math both before the call and inside the function.
Second, we return the start address on error.  All callers fell back to the
start address on error, so we remove the need to check for errors.  Third, we
cap range to prevent overflow.  Last, we use kerneldoc to describe the new
function.

If possible, I'd like to request Acks from the various subsystems so that we
can merge this as one bisectable branch.

Changes from v2:
 - s/randomize_addr/randomize_page/ (Kees Cook)
 - PAGE_ALIGN(start) if it wasn't (Kees Cook, Michael Ellerman)

Changes from v1:
 - Explicitly mention page_aligned start assumption (Yann Droneaud)
 - pick random pages vice random addresses (Yann Droneaud)
 - catch range=0 last
 - Add Ack for arm64 (Will Deacon)

Jason Cooper (7):
  random: Simplify API for random address requests
  x86: Use simpler API for random address requests
  ARM: Use simpler API for random address requests
  arm64: Use simpler API for random address requests
  tile: Use simpler API for random address requests
  unicore32: Use simpler API for random address requests
  random: Remove unused randomize_range()

 arch/arm/kernel/process.c       |  3 +--
 arch/arm64/kernel/process.c     |  8 ++------
 arch/tile/mm/mmap.c             |  3 +--
 arch/unicore32/kernel/process.c |  3 +--
 arch/x86/kernel/process.c       |  3 +--
 arch/x86/kernel/sys_x86_64.c    |  5 +----
 drivers/char/random.c           | 36 +++++++++++++++++++++++++-----------
 include/linux/random.h          |  2 +-
 8 files changed, 33 insertions(+), 30 deletions(-)

-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456066 — [PATCH v3 4/7] arm64: Use simpler API for random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 01:50 +0200
Subject[PATCH v3 4/7] arm64: Use simpler API for random address requests
Message-ID<s2e5b-U8-15@gated-at.bofh.it>
In reply to#1456065
Currently, all callers to randomize_range() set the length to 0 and
calculate end by adding a constant to the start address.  We can
simplify the API to remove a bunch of needless checks and variables.

Use the new randomize_addr(start, range) call to set the requested
address.

Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Acked-by: Will Deacon <will.deacon@arm.com>
---
Changes from v2:
 - s/randomize_addr/randomize_page/ (Kees Cook)

 arch/arm64/kernel/process.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index 6cd2612236dc..6ac2950ffb78 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -374,12 +374,8 @@ unsigned long arch_align_stack(unsigned long sp)
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-	unsigned long range_end = mm->brk;
-
 	if (is_compat_task())
-		range_end += 0x02000000;
+		return randomize_page(mm->brk, 0x02000000);
 	else
-		range_end += 0x40000000;
-
-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+		return randomize_page(mm->brk, 0x40000000);
 }
-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456067 — [PATCH v3 1/7] random: Simplify API for random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 01:50 +0200
Subject[PATCH v3 1/7] random: Simplify API for random address requests
Message-ID<s2e5b-U8-17@gated-at.bofh.it>
In reply to#1456065
To date, all callers of randomize_range() have set the length to 0, and
check for a zero return value.  For the current callers, the only way
to get zero returned is if end <= start.  Since they are all adding a
constant to the start address, this is unnecessary.

We can remove a bunch of needless checks by simplifying the API to do
just what everyone wants, return an address between [start, start +
range).

While we're here, s/get_random_int/get_random_long/.  No current call
site is adversely affected by get_random_int(), since all current range
requests are < UINT_MAX.  However, we should match caller expectations
to avoid coming up short (ha!) in the future.

All current callers to randomize_range() chose to use the start address
if randomize_range() failed.  Therefore, we simplify things by just
returning the start address on error.

randomize_range() will be removed once all callers have been converted
over to randomize_addr().

Signed-off-by: Jason Cooper <jason@lakedaemon.net>
---
Changes from v2:
 - s/randomize_addr/randomize_page/ (Kees Cook)
 - PAGE_ALIGN(start) if it wasn't (Kees Cook, Michael Ellerman)

 drivers/char/random.c  | 33 +++++++++++++++++++++++++++++++++
 include/linux/random.h |  1 +
 2 files changed, 34 insertions(+)

diff --git a/drivers/char/random.c b/drivers/char/random.c
index 0158d3bff7e5..61cb434e3bea 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1840,6 +1840,39 @@ randomize_range(unsigned long start, unsigned long end, unsigned long len)
 	return PAGE_ALIGN(get_random_int() % range + start);
 }
 
+/**
+ * randomize_page - Generate a random, page aligned address
+ * @start:	The smallest acceptable address the caller will take.
+ * @range:	The size of the area, starting at @start, within which the
+ *		random address must fall.
+ *
+ * If @start + @range would overflow, @range is capped.
+ *
+ * NOTE: Historical use of randomize_range, which this replaces, presumed that
+ * @start was already page aligned.  We now align it regardless.
+ *
+ * Return: A page aligned address within [start, start + range).  On error,
+ * @start is returned.
+ */
+unsigned long
+randomize_page(unsigned long start, unsigned long range)
+{
+	if (!PAGE_ALIGNED(start)) {
+		range -= PAGE_ALIGN(start) - start;
+		start = PAGE_ALIGN(start);
+	}
+
+	if (start > ULONG_MAX - range)
+		range = ULONG_MAX - start;
+
+	range >>= PAGE_SHIFT;
+
+	if (range == 0)
+		return start;
+
+	return start + (get_random_long() % range << PAGE_SHIFT);
+}
+
 /* Interface for in-kernel drivers of true hardware RNGs.
  * Those devices may produce endless random bits and will be throttled
  * when our pool is full.
diff --git a/include/linux/random.h b/include/linux/random.h
index e47e533742b5..098fec690d65 100644
--- a/include/linux/random.h
+++ b/include/linux/random.h
@@ -35,6 +35,7 @@ extern const struct file_operations random_fops, urandom_fops;
 unsigned int get_random_int(void);
 unsigned long get_random_long(void);
 unsigned long randomize_range(unsigned long start, unsigned long end, unsigned long len);
+unsigned long randomize_page(unsigned long start, unsigned long range);
 
 u32 prandom_u32(void);
 void prandom_bytes(void *buf, size_t nbytes);
-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456387 — Re: [PATCH v3 1/7] random: Simplify API for random address requests

FromYann Droneaud <ydroneaud@opteya.com>
Date2016-08-04 14:50 +0200
SubjectRe: [PATCH v3 1/7] random: Simplify API for random address requests
Message-ID<s2qg2-IE-19@gated-at.bofh.it>
In reply to#1456067
Hi,

Le mercredi 03 août 2016 à 23:39 +0000, Jason Cooper a écrit :
> 
> diff --git a/drivers/char/random.c b/drivers/char/random.c
> index 0158d3bff7e5..61cb434e3bea 100644
> --- a/drivers/char/random.c
> +++ b/drivers/char/random.c
> @@ -1840,6 +1840,39 @@ randomize_range(unsigned long start, unsigned
> long end, unsigned long len)
>  	return PAGE_ALIGN(get_random_int() % range + start);
>  }
>  
> +/**
> + * randomize_page - Generate a random, page aligned address
> + * @start:	The smallest acceptable address the caller will
> take.
> + * @range:	The size of the area, starting at @start, within
> which the
> + *		random address must fall.
> + *
> + * If @start + @range would overflow, @range is capped.
> + *
> + * NOTE: Historical use of randomize_range, which this replaces,
> presumed that
> + * @start was already page aligned.  We now align it regardless.
> + *
> + * Return: A page aligned address within [start, start + range).  On
> error,
> + * @start is returned.
> + */
> +unsigned long
> +randomize_page(unsigned long start, unsigned long range)
> +{

To prevent an underflow if start is not page aligned (but will one
would ever use a non aligned start address *and* range ? ...)

        if (range < PAGE_SIZE)
                return start;


> +	if (!PAGE_ALIGNED(start)) {
> +		range -= PAGE_ALIGN(start) - start;
> +		start = PAGE_ALIGN(start);
> +	}
> +
> +	if (start > ULONG_MAX - range)
> +		range = ULONG_MAX - start;
> +
> +	range >>= PAGE_SHIFT;
> +
> +	if (range == 0)
> +		return start;
> +
> +	return start + (get_random_long() % range << PAGE_SHIFT);
> +}
> +
>  /* Interface for in-kernel drivers of true hardware RNGs.
>   * Those devices may produce endless random bits and will be
> throttled
>   * when our pool is full.
> 

Regards.

-- 
Yann Droneaud
OPTEYA

[toc] | [prev] | [next] | [standalone]

#1456071 — [PATCH v3 3/7] ARM: Use simpler API for random address requests

FromJason Cooper <jason@lakedaemon.net>
Date2016-08-04 01:50 +0200
Subject[PATCH v3 3/7] ARM: Use simpler API for random address requests
Message-ID<s2e5c-U8-21@gated-at.bofh.it>
In reply to#1456065
Currently, all callers to randomize_range() set the length to 0 and
calculate end by adding a constant to the start address.  We can
simplify the API to remove a bunch of needless checks and variables.

Use the new randomize_addr(start, range) call to set the requested
address.

Signed-off-by: Jason Cooper <jason@lakedaemon.net>
---
Changes from v2:
 - s/randomize_addr/randomize_page/ (Kees Cook)

 arch/arm/kernel/process.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm/kernel/process.c b/arch/arm/kernel/process.c
index 4a803c5a1ff7..3ee2fb4c9ae6 100644
--- a/arch/arm/kernel/process.c
+++ b/arch/arm/kernel/process.c
@@ -314,8 +314,7 @@ unsigned long get_wchan(struct task_struct *p)
 
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-	unsigned long range_end = mm->brk + 0x02000000;
-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+	return randomize_page(mm->brk, 0x02000000);
 }
 
 #ifdef CONFIG_MMU
-- 
2.9.2

[toc] | [prev] | [next] | [standalone]

#1456121 — Re: [PATCH v3 0/7] char/random: Simplify random address requests

FromKees Cook <keescook@chromium.org>
Date2016-08-04 04:50 +0200
SubjectRe: [PATCH v3 0/7] char/random: Simplify random address requests
Message-ID<s2gTo-2O7-3@gated-at.bofh.it>
In reply to#1456065
On Wed, Aug 3, 2016 at 4:39 PM, Jason Cooper <jason@lakedaemon.net> wrote:
> Two previous attempts have been made to rework this API.  The first can be
> found at:
>
>   https://lkml.kernel.org/r/cover.1390770607.git.ydroneaud@opteya.com
>
> The second at:
>
>   https://lkml.kernel.org/r/1469471141-25669-1-git-send-email-william.c.roberts@intel.com
>
> Previous versions of this series can been seen at:
>
> RFC:  https://lkml.kernel.org/r/20160726030201.6775-1-jason@lakedaemon.net
>  v1:  https://lkml.kernel.org/r/20160728204730.27453-1-jason@lakedaemon.net
>  v2:  https://lkml.kernel.org/r/20160730154244.403-1-jason@lakedaemon.net
>
> In addition to incorporating ideas from these two previous efforts, this series
> adds several desirable features.  First, we take the range as an argument
> directly, which removes math both before the call and inside the function.
> Second, we return the start address on error.  All callers fell back to the
> start address on error, so we remove the need to check for errors.  Third, we
> cap range to prevent overflow.  Last, we use kerneldoc to describe the new
> function.
>
> If possible, I'd like to request Acks from the various subsystems so that we
> can merge this as one bisectable branch.
>
> Changes from v2:
>  - s/randomize_addr/randomize_page/ (Kees Cook)
>  - PAGE_ALIGN(start) if it wasn't (Kees Cook, Michael Ellerman)
>
> Changes from v1:
>  - Explicitly mention page_aligned start assumption (Yann Droneaud)
>  - pick random pages vice random addresses (Yann Droneaud)
>  - catch range=0 last
>  - Add Ack for arm64 (Will Deacon)
>
> Jason Cooper (7):
>   random: Simplify API for random address requests
>   x86: Use simpler API for random address requests
>   ARM: Use simpler API for random address requests
>   arm64: Use simpler API for random address requests
>   tile: Use simpler API for random address requests
>   unicore32: Use simpler API for random address requests
>   random: Remove unused randomize_range()
>
>  arch/arm/kernel/process.c       |  3 +--
>  arch/arm64/kernel/process.c     |  8 ++------
>  arch/tile/mm/mmap.c             |  3 +--
>  arch/unicore32/kernel/process.c |  3 +--
>  arch/x86/kernel/process.c       |  3 +--
>  arch/x86/kernel/sys_x86_64.c    |  5 +----
>  drivers/char/random.c           | 36 +++++++++++++++++++++++++-----------
>  include/linux/random.h          |  2 +-
>  8 files changed, 33 insertions(+), 30 deletions(-)

This looks great! Thanks for the v3. :)

Acked-by: Kees Cook <keescook@chromium.org>

-Kees

-- 
Kees Cook
Brillo & Chrome OS Security

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.kernel

csiph-web