lkml.org 
[lkml]   [2018]   [Sep]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v6 2/4] x86/modules: Increase randomization for modules
On Mon, Sep 24, 2018 at 11:57 AM, Edgecombe, Rick P
<rick.p.edgecombe@intel.com> wrote:
> On Fri, 2018-09-21 at 12:05 -0700, Kees Cook wrote:
>> On Thu, Sep 13, 2018 at 2:31 PM, Rick Edgecombe
>> <rick.p.edgecombe@intel.com> wrote:
>> I would find this much more readable as:
>> static unsigned long get_module_vmalloc_start(void)
>> {
>> unsigned long addr = MODULES_VADDR;
>>
>> if (kaslr_randomize_base())
>> addr += get_module_load_offset();
>>
>> if (kaslr_randomize_each_module())
>> addr += get_modules_rand_len();
>>
>> return addr;
>> }
> Thanks, that looks better.
>
>>
>> > void *module_alloc(unsigned long size)
>> > {
>> > @@ -84,16 +201,18 @@ void *module_alloc(unsigned long size)
>> > if (PAGE_ALIGN(size) > MODULES_LEN)
>> > return NULL;
>> >
>> > - p = __vmalloc_node_range(size, MODULE_ALIGN,
>> > - MODULES_VADDR +
>> > get_module_load_offset(),
>> > - MODULES_END, GFP_KERNEL,
>> > - PAGE_KERNEL_EXEC, 0, NUMA_NO_NODE,
>> > - __builtin_return_address(0));
>> > + p = try_module_randomize_each(size);
>> > +
>> > + if (!p)
>> > + p = __vmalloc_node_range(size, MODULE_ALIGN,
>> > + get_module_vmalloc_start(), MODULES_END,
>> > + GFP_KERNEL, PAGE_KERNEL_EXEC, 0,
>> > + NUMA_NO_NODE, __builtin_return_address(0));
>> Instead of having two open-coded __vmalloc_node_range() calls left in
>> this after the change, can this be done in terms of a call to
>> try_module_alloc() instead? I see they're slightly different, but it
>> might be nice for making the two paths share more code.
> Not sure what you mean. Across the whole change, there is one call
> to __vmalloc_node_range, and one to __vmalloc_node_try_addr.

I guess I meant the vmalloc calls -- one for node_range and one for
node_try_addr. I was wondering if the logic could be combined in some
way so that the __vmalloc_node_range() could be made in terms of the
the helper that try_module_randomize_each() uses. But this could just
be me hoping for nice-to-read changes. ;)

-Kees

--
Kees Cook
Pixel Security

\
 
 \ /
  Last update: 2018-09-24 21:59    [W:0.115 / U:0.556 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site