Re: [PATCH] arm64: dump: hide kernel pointers

[Laura Abbott]

On 02/28/2017 07:52 PM, Will Deacon wrote:
> On Tue, Feb 28, 2017 at 02:55:51PM -0800, Laura Abbott wrote:
>> On 02/28/2017 02:04 AM, Mark Rutland wrote:
>>> On Tue, Feb 28, 2017 at 08:42:51AM +, Ard Biesheuvel wrote:
 On 28 February 2017 at 07:05, Miles Chen  wrote:
> Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
> /proc/vmallocinfo does.
>
> With sysctl kernel.kptr_restrict=0 or 1:
> cat /sys/kernel/debug/kernel_page_tables

 I wonder if this file should be accessible at all if kptr_restrict > 0
>>>
>>> I don't have strong feelings either way.
>>>
>>> This isn't typically enabled, and it's under debugfs, so this shouldn't
>>> be accessible by a typical user anyhow.
>>>
>>> That said, there are very few of us who need to take a look at this
>>> file. I'm happy to deal with attacking kptr_restrict when required.
>>>
>>
>> In the interest of security it's probably for the best to switch to the
>> restricted pointer. Who knows what might get enabled or forgotten about.
>> I don't like the idea of tying enablement of the file to kptr_restrict
>> though.
> 
> ... but it's also pretty weird to show the sizes, mapping type and
> permissions yet hide the virtual addresses. If you want to keep the file
> in spite of kptr_restrict, which bits are actually useful once the
> addresses are nobbled?
> 
> Will
> 

I'm not saying the file is really useful, I just don't think kptr_restrict
is the right mechanism for this. The current documented purpose is for printk
formatting only and trying to double use that seems likely to confuse 
people if others start following the pattern elsewhere in the kernel.
A separate knob might be cleaner.

Thanks,
Laura

Re: [PATCH] arm64: dump: hide kernel pointers

[Laura Abbott]

On 02/28/2017 07:52 PM, Will Deacon wrote:
> On Tue, Feb 28, 2017 at 02:55:51PM -0800, Laura Abbott wrote:
>> On 02/28/2017 02:04 AM, Mark Rutland wrote:
>>> On Tue, Feb 28, 2017 at 08:42:51AM +, Ard Biesheuvel wrote:
 On 28 February 2017 at 07:05, Miles Chen  wrote:
> Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
> /proc/vmallocinfo does.
>
> With sysctl kernel.kptr_restrict=0 or 1:
> cat /sys/kernel/debug/kernel_page_tables

 I wonder if this file should be accessible at all if kptr_restrict > 0
>>>
>>> I don't have strong feelings either way.
>>>
>>> This isn't typically enabled, and it's under debugfs, so this shouldn't
>>> be accessible by a typical user anyhow.
>>>
>>> That said, there are very few of us who need to take a look at this
>>> file. I'm happy to deal with attacking kptr_restrict when required.
>>>
>>
>> In the interest of security it's probably for the best to switch to the
>> restricted pointer. Who knows what might get enabled or forgotten about.
>> I don't like the idea of tying enablement of the file to kptr_restrict
>> though.
> 
> ... but it's also pretty weird to show the sizes, mapping type and
> permissions yet hide the virtual addresses. If you want to keep the file
> in spite of kptr_restrict, which bits are actually useful once the
> addresses are nobbled?
> 
> Will
> 

I'm not saying the file is really useful, I just don't think kptr_restrict
is the right mechanism for this. The current documented purpose is for printk
formatting only and trying to double use that seems likely to confuse 
people if others start following the pattern elsewhere in the kernel.
A separate knob might be cleaner.

Thanks,
Laura

Re: [PATCH] arm64: dump: hide kernel pointers

[Laura Abbott]

On 02/28/2017 02:04 AM, Mark Rutland wrote:
> On Tue, Feb 28, 2017 at 08:42:51AM +, Ard Biesheuvel wrote:
>> (+ Mark)
> 
> (+ Laura)
> 
>> On 28 February 2017 at 07:05, Miles Chen  wrote:
>>> Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
>>> /proc/vmallocinfo does.
>>>
>>> With sysctl kernel.kptr_restrict=0 or 1:
>>> cat /sys/kernel/debug/kernel_page_tables
>>
>> I wonder if this file should be accessible at all if kptr_restrict > 0
> 
> I don't have strong feelings either way.
> 
> This isn't typically enabled, and it's under debugfs, so this shouldn't
> be accessible by a typical user anyhow.
> 
> That said, there are very few of us who need to take a look at this
> file. I'm happy to deal with attacking kptr_restrict when required.
> 

In the interest of security it's probably for the best to switch to the
restricted pointer. Who knows what might get enabled or forgotten about.
I don't like the idea of tying enablement of the file to kptr_restrict
though.

This should probably be fixed up on all arches that implement the
page table dump feature.

Laura

> Thanks,
> Mark.
> 
>>> ---[ Modules start ]---
>>> ---[ Modules end ]---
>>> ---[ vmalloc() Area ]---
>>> ff800800-ff800801  64K PTE   RW NX SHD AF...
>>> ff8008015000-ff8008016000   4K PTE   RW NX SHD AF...
>>> ff800802-ff800803  64K PTE   RW NX SHD AF...
>>> ff8008031000-ff8008071000 256K PTE   RW NX SHD AF...
>>> ff800808-ff8008201536K PTE   ro x  SHD AF...
>>> ff800820-ff800840   2M PMD   ro x  SHD AF...
>>> ff800840-ff8008541280K PTE   ro x  SHD AF...
>>> ff800854-ff8008691344K PTE   ro NX SHD AF...
>>> ff800894-ff8008a1 832K PTE   RW NX SHD AF...
>>> ff8008aca000-ff8008acd000  12K PTE   RW NX SHD AF...
>>> ffbebffd8000-ffbebffdb000  12K PTE   RW NX SHD AF...
>>> ---[ vmalloc() End ]---
>>> ---[ Fixmap start ]---
>>> ffbefe80-ffbefea0   2M PMD   ro NX SHD AF...
>>> ---[ Fixmap end ]---
>>> ---[ PCI I/O start ]---
>>> ---[ PCI I/O end ]---
>>> ---[ Linear Mapping ]---
>>> ffc0-ffc8 512K PTE   RW NX SHD AF...
>>> ffc8-ffc000201536K PTE   ro NX SHD AF...
>>> ffc00020-ffc00060   4M PMD   ro NX SHD AF...
>>> ffc00060-ffc00069 576K PTE   ro NX SHD AF...
>>> ffc00069-ffc000801472K PTE   RW NX SHD AF...
>>> ffc00080-ffc00200  24M PMD   RW NX SHD AF...
>>> ffc00200-ffc04000 992M PMD   RW NX SHD AF...
>>> ffc04000-ffc08000   1G PGD   RW NX SHD AF...
>>>
>>> With sysctl kernel.kptr_restrict=2:
>>> cat /sys/kernel/debug/kernel_page_tables
>>> ---[ Modules start ]---
>>> ---[ Modules end ]---
>>> ---[ vmalloc() Area ]---
>>> -  64K PTE   RW NX SHD AF...
>>> -   4K PTE   RW NX SHD AF...
>>> -  64K PTE   RW NX SHD AF...
>>> - 256K PTE   RW NX SHD AF...
>>> -1536K PTE   ro x  SHD AF...
>>> -   2M PMD   ro x  SHD AF...
>>> -1280K PTE   ro x  SHD AF...
>>> -1344K PTE   ro NX SHD AF...
>>> - 832K PTE   RW NX SHD AF...
>>> -  12K PTE   RW NX SHD AF...
>>> -  12K PTE   RW NX SHD AF...
>>> ---[ vmalloc() End ]---
>>> ---[ Fixmap start ]---
>>> -   2M PMD   ro NX SHD AF...
>>> ---[ Fixmap end ]---
>>> ---[ PCI I/O start ]---
>>> ---[ PCI I/O end ]---
>>> ---[ Linear Mapping ]---
>>> - 512K PTE   RW NX SHD AF...
>>> -1536K PTE   ro NX SHD AF...
>>> -   4M PMD   ro NX SHD AF...
>>> - 576K PTE   ro NX SHD AF...
>>> -1472K PTE   RW NX SHD AF...
>>> -  24M PMD   RW NX SHD AF...
>>> - 992M PMD   RW NX SHD AF...
>>> -   1G PGD   RW NX SHD AF...
>>>
>>> Signed-off-by: Miles Chen 
>>> ---
>>>  arch/arm64/mm/dump.c | 4 ++--
>>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git 

Re: [PATCH] arm64: dump: hide kernel pointers

[Laura Abbott]

On 02/28/2017 02:04 AM, Mark Rutland wrote:
> On Tue, Feb 28, 2017 at 08:42:51AM +, Ard Biesheuvel wrote:
>> (+ Mark)
> 
> (+ Laura)
> 
>> On 28 February 2017 at 07:05, Miles Chen  wrote:
>>> Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
>>> /proc/vmallocinfo does.
>>>
>>> With sysctl kernel.kptr_restrict=0 or 1:
>>> cat /sys/kernel/debug/kernel_page_tables
>>
>> I wonder if this file should be accessible at all if kptr_restrict > 0
> 
> I don't have strong feelings either way.
> 
> This isn't typically enabled, and it's under debugfs, so this shouldn't
> be accessible by a typical user anyhow.
> 
> That said, there are very few of us who need to take a look at this
> file. I'm happy to deal with attacking kptr_restrict when required.
> 

In the interest of security it's probably for the best to switch to the
restricted pointer. Who knows what might get enabled or forgotten about.
I don't like the idea of tying enablement of the file to kptr_restrict
though.

This should probably be fixed up on all arches that implement the
page table dump feature.

Laura

> Thanks,
> Mark.
> 
>>> ---[ Modules start ]---
>>> ---[ Modules end ]---
>>> ---[ vmalloc() Area ]---
>>> ff800800-ff800801  64K PTE   RW NX SHD AF...
>>> ff8008015000-ff8008016000   4K PTE   RW NX SHD AF...
>>> ff800802-ff800803  64K PTE   RW NX SHD AF...
>>> ff8008031000-ff8008071000 256K PTE   RW NX SHD AF...
>>> ff800808-ff8008201536K PTE   ro x  SHD AF...
>>> ff800820-ff800840   2M PMD   ro x  SHD AF...
>>> ff800840-ff8008541280K PTE   ro x  SHD AF...
>>> ff800854-ff8008691344K PTE   ro NX SHD AF...
>>> ff800894-ff8008a1 832K PTE   RW NX SHD AF...
>>> ff8008aca000-ff8008acd000  12K PTE   RW NX SHD AF...
>>> ffbebffd8000-ffbebffdb000  12K PTE   RW NX SHD AF...
>>> ---[ vmalloc() End ]---
>>> ---[ Fixmap start ]---
>>> ffbefe80-ffbefea0   2M PMD   ro NX SHD AF...
>>> ---[ Fixmap end ]---
>>> ---[ PCI I/O start ]---
>>> ---[ PCI I/O end ]---
>>> ---[ Linear Mapping ]---
>>> ffc0-ffc8 512K PTE   RW NX SHD AF...
>>> ffc8-ffc000201536K PTE   ro NX SHD AF...
>>> ffc00020-ffc00060   4M PMD   ro NX SHD AF...
>>> ffc00060-ffc00069 576K PTE   ro NX SHD AF...
>>> ffc00069-ffc000801472K PTE   RW NX SHD AF...
>>> ffc00080-ffc00200  24M PMD   RW NX SHD AF...
>>> ffc00200-ffc04000 992M PMD   RW NX SHD AF...
>>> ffc04000-ffc08000   1G PGD   RW NX SHD AF...
>>>
>>> With sysctl kernel.kptr_restrict=2:
>>> cat /sys/kernel/debug/kernel_page_tables
>>> ---[ Modules start ]---
>>> ---[ Modules end ]---
>>> ---[ vmalloc() Area ]---
>>> -  64K PTE   RW NX SHD AF...
>>> -   4K PTE   RW NX SHD AF...
>>> -  64K PTE   RW NX SHD AF...
>>> - 256K PTE   RW NX SHD AF...
>>> -1536K PTE   ro x  SHD AF...
>>> -   2M PMD   ro x  SHD AF...
>>> -1280K PTE   ro x  SHD AF...
>>> -1344K PTE   ro NX SHD AF...
>>> - 832K PTE   RW NX SHD AF...
>>> -  12K PTE   RW NX SHD AF...
>>> -  12K PTE   RW NX SHD AF...
>>> ---[ vmalloc() End ]---
>>> ---[ Fixmap start ]---
>>> -   2M PMD   ro NX SHD AF...
>>> ---[ Fixmap end ]---
>>> ---[ PCI I/O start ]---
>>> ---[ PCI I/O end ]---
>>> ---[ Linear Mapping ]---
>>> - 512K PTE   RW NX SHD AF...
>>> -1536K PTE   ro NX SHD AF...
>>> -   4M PMD   ro NX SHD AF...
>>> - 576K PTE   ro NX SHD AF...
>>> -1472K PTE   RW NX SHD AF...
>>> -  24M PMD   RW NX SHD AF...
>>> - 992M PMD   RW NX SHD AF...
>>> -   1G PGD   RW NX SHD AF...
>>>
>>> Signed-off-by: Miles Chen 
>>> ---
>>>  arch/arm64/mm/dump.c | 4 ++--
>>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
>>> index 

Re: [PATCH] arm64: dump: hide kernel pointers

[Will Deacon]

On Tue, Feb 28, 2017 at 02:55:51PM -0800, Laura Abbott wrote:
> On 02/28/2017 02:04 AM, Mark Rutland wrote:
> > On Tue, Feb 28, 2017 at 08:42:51AM +, Ard Biesheuvel wrote:
> >> On 28 February 2017 at 07:05, Miles Chen  wrote:
> >>> Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
> >>> /proc/vmallocinfo does.
> >>>
> >>> With sysctl kernel.kptr_restrict=0 or 1:
> >>> cat /sys/kernel/debug/kernel_page_tables
> >>
> >> I wonder if this file should be accessible at all if kptr_restrict > 0
> > 
> > I don't have strong feelings either way.
> > 
> > This isn't typically enabled, and it's under debugfs, so this shouldn't
> > be accessible by a typical user anyhow.
> > 
> > That said, there are very few of us who need to take a look at this
> > file. I'm happy to deal with attacking kptr_restrict when required.
> > 
> 
> In the interest of security it's probably for the best to switch to the
> restricted pointer. Who knows what might get enabled or forgotten about.
> I don't like the idea of tying enablement of the file to kptr_restrict
> though.

... but it's also pretty weird to show the sizes, mapping type and
permissions yet hide the virtual addresses. If you want to keep the file
in spite of kptr_restrict, which bits are actually useful once the
addresses are nobbled?

Will

Re: [PATCH] arm64: dump: hide kernel pointers

[Will Deacon]

On Tue, Feb 28, 2017 at 02:55:51PM -0800, Laura Abbott wrote:
> On 02/28/2017 02:04 AM, Mark Rutland wrote:
> > On Tue, Feb 28, 2017 at 08:42:51AM +, Ard Biesheuvel wrote:
> >> On 28 February 2017 at 07:05, Miles Chen  wrote:
> >>> Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
> >>> /proc/vmallocinfo does.
> >>>
> >>> With sysctl kernel.kptr_restrict=0 or 1:
> >>> cat /sys/kernel/debug/kernel_page_tables
> >>
> >> I wonder if this file should be accessible at all if kptr_restrict > 0
> > 
> > I don't have strong feelings either way.
> > 
> > This isn't typically enabled, and it's under debugfs, so this shouldn't
> > be accessible by a typical user anyhow.
> > 
> > That said, there are very few of us who need to take a look at this
> > file. I'm happy to deal with attacking kptr_restrict when required.
> > 
> 
> In the interest of security it's probably for the best to switch to the
> restricted pointer. Who knows what might get enabled or forgotten about.
> I don't like the idea of tying enablement of the file to kptr_restrict
> though.

... but it's also pretty weird to show the sizes, mapping type and
permissions yet hide the virtual addresses. If you want to keep the file
in spite of kptr_restrict, which bits are actually useful once the
addresses are nobbled?

Will

Re: [PATCH] arm64: dump: hide kernel pointers

[Ard Biesheuvel]

(+ Mark)

On 28 February 2017 at 07:05, Miles Chen  wrote:
> Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
> /proc/vmallocinfo does.
>
> With sysctl kernel.kptr_restrict=0 or 1:
> cat /sys/kernel/debug/kernel_page_tables

I wonder if this file should be accessible at all if kptr_restrict > 0

> ---[ Modules start ]---
> ---[ Modules end ]---
> ---[ vmalloc() Area ]---
> ff800800-ff800801  64K PTE   RW NX SHD AF...
> ff8008015000-ff8008016000   4K PTE   RW NX SHD AF...
> ff800802-ff800803  64K PTE   RW NX SHD AF...
> ff8008031000-ff8008071000 256K PTE   RW NX SHD AF...
> ff800808-ff8008201536K PTE   ro x  SHD AF...
> ff800820-ff800840   2M PMD   ro x  SHD AF...
> ff800840-ff8008541280K PTE   ro x  SHD AF...
> ff800854-ff8008691344K PTE   ro NX SHD AF...
> ff800894-ff8008a1 832K PTE   RW NX SHD AF...
> ff8008aca000-ff8008acd000  12K PTE   RW NX SHD AF...
> ffbebffd8000-ffbebffdb000  12K PTE   RW NX SHD AF...
> ---[ vmalloc() End ]---
> ---[ Fixmap start ]---
> ffbefe80-ffbefea0   2M PMD   ro NX SHD AF...
> ---[ Fixmap end ]---
> ---[ PCI I/O start ]---
> ---[ PCI I/O end ]---
> ---[ Linear Mapping ]---
> ffc0-ffc8 512K PTE   RW NX SHD AF...
> ffc8-ffc000201536K PTE   ro NX SHD AF...
> ffc00020-ffc00060   4M PMD   ro NX SHD AF...
> ffc00060-ffc00069 576K PTE   ro NX SHD AF...
> ffc00069-ffc000801472K PTE   RW NX SHD AF...
> ffc00080-ffc00200  24M PMD   RW NX SHD AF...
> ffc00200-ffc04000 992M PMD   RW NX SHD AF...
> ffc04000-ffc08000   1G PGD   RW NX SHD AF...
>
> With sysctl kernel.kptr_restrict=2:
> cat /sys/kernel/debug/kernel_page_tables
> ---[ Modules start ]---
> ---[ Modules end ]---
> ---[ vmalloc() Area ]---
> -  64K PTE   RW NX SHD AF...
> -   4K PTE   RW NX SHD AF...
> -  64K PTE   RW NX SHD AF...
> - 256K PTE   RW NX SHD AF...
> -1536K PTE   ro x  SHD AF...
> -   2M PMD   ro x  SHD AF...
> -1280K PTE   ro x  SHD AF...
> -1344K PTE   ro NX SHD AF...
> - 832K PTE   RW NX SHD AF...
> -  12K PTE   RW NX SHD AF...
> -  12K PTE   RW NX SHD AF...
> ---[ vmalloc() End ]---
> ---[ Fixmap start ]---
> -   2M PMD   ro NX SHD AF...
> ---[ Fixmap end ]---
> ---[ PCI I/O start ]---
> ---[ PCI I/O end ]---
> ---[ Linear Mapping ]---
> - 512K PTE   RW NX SHD AF...
> -1536K PTE   ro NX SHD AF...
> -   4M PMD   ro NX SHD AF...
> - 576K PTE   ro NX SHD AF...
> -1472K PTE   RW NX SHD AF...
> -  24M PMD   RW NX SHD AF...
> - 992M PMD   RW NX SHD AF...
> -   1G PGD   RW NX SHD AF...
>
> Signed-off-by: Miles Chen 
> ---
>  arch/arm64/mm/dump.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
> index ca74a2a..e055ecf 100644
> --- a/arch/arm64/mm/dump.c
> +++ b/arch/arm64/mm/dump.c
> @@ -253,8 +253,8 @@ static void note_page(struct pg_state *st, unsigned long 
> addr, unsigned level,
> if (st->current_prot) {
> note_prot_uxn(st, addr);
> note_prot_wx(st, addr);
> -   pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx   ",
> -  st->start_address, addr);
> +   pt_dump_seq_printf(st->seq, "%pK-%pK   ",
> +  (void *)st->start_address, (void *)addr);
>
> delta = (addr - st->start_address) >> 10;
> while (!(delta & 1023) && unit[1]) {
> --
> 1.9.1
>
>
> ___
> linux-arm-kernel mailing list
> linux-arm-ker...@lists.infradead.org
> 

Re: [PATCH] arm64: dump: hide kernel pointers

[Ard Biesheuvel]

(+ Mark)

On 28 February 2017 at 07:05, Miles Chen  wrote:
> Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
> /proc/vmallocinfo does.
>
> With sysctl kernel.kptr_restrict=0 or 1:
> cat /sys/kernel/debug/kernel_page_tables

I wonder if this file should be accessible at all if kptr_restrict > 0

> ---[ Modules start ]---
> ---[ Modules end ]---
> ---[ vmalloc() Area ]---
> ff800800-ff800801  64K PTE   RW NX SHD AF...
> ff8008015000-ff8008016000   4K PTE   RW NX SHD AF...
> ff800802-ff800803  64K PTE   RW NX SHD AF...
> ff8008031000-ff8008071000 256K PTE   RW NX SHD AF...
> ff800808-ff8008201536K PTE   ro x  SHD AF...
> ff800820-ff800840   2M PMD   ro x  SHD AF...
> ff800840-ff8008541280K PTE   ro x  SHD AF...
> ff800854-ff8008691344K PTE   ro NX SHD AF...
> ff800894-ff8008a1 832K PTE   RW NX SHD AF...
> ff8008aca000-ff8008acd000  12K PTE   RW NX SHD AF...
> ffbebffd8000-ffbebffdb000  12K PTE   RW NX SHD AF...
> ---[ vmalloc() End ]---
> ---[ Fixmap start ]---
> ffbefe80-ffbefea0   2M PMD   ro NX SHD AF...
> ---[ Fixmap end ]---
> ---[ PCI I/O start ]---
> ---[ PCI I/O end ]---
> ---[ Linear Mapping ]---
> ffc0-ffc8 512K PTE   RW NX SHD AF...
> ffc8-ffc000201536K PTE   ro NX SHD AF...
> ffc00020-ffc00060   4M PMD   ro NX SHD AF...
> ffc00060-ffc00069 576K PTE   ro NX SHD AF...
> ffc00069-ffc000801472K PTE   RW NX SHD AF...
> ffc00080-ffc00200  24M PMD   RW NX SHD AF...
> ffc00200-ffc04000 992M PMD   RW NX SHD AF...
> ffc04000-ffc08000   1G PGD   RW NX SHD AF...
>
> With sysctl kernel.kptr_restrict=2:
> cat /sys/kernel/debug/kernel_page_tables
> ---[ Modules start ]---
> ---[ Modules end ]---
> ---[ vmalloc() Area ]---
> -  64K PTE   RW NX SHD AF...
> -   4K PTE   RW NX SHD AF...
> -  64K PTE   RW NX SHD AF...
> - 256K PTE   RW NX SHD AF...
> -1536K PTE   ro x  SHD AF...
> -   2M PMD   ro x  SHD AF...
> -1280K PTE   ro x  SHD AF...
> -1344K PTE   ro NX SHD AF...
> - 832K PTE   RW NX SHD AF...
> -  12K PTE   RW NX SHD AF...
> -  12K PTE   RW NX SHD AF...
> ---[ vmalloc() End ]---
> ---[ Fixmap start ]---
> -   2M PMD   ro NX SHD AF...
> ---[ Fixmap end ]---
> ---[ PCI I/O start ]---
> ---[ PCI I/O end ]---
> ---[ Linear Mapping ]---
> - 512K PTE   RW NX SHD AF...
> -1536K PTE   ro NX SHD AF...
> -   4M PMD   ro NX SHD AF...
> - 576K PTE   ro NX SHD AF...
> -1472K PTE   RW NX SHD AF...
> -  24M PMD   RW NX SHD AF...
> - 992M PMD   RW NX SHD AF...
> -   1G PGD   RW NX SHD AF...
>
> Signed-off-by: Miles Chen 
> ---
>  arch/arm64/mm/dump.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
> index ca74a2a..e055ecf 100644
> --- a/arch/arm64/mm/dump.c
> +++ b/arch/arm64/mm/dump.c
> @@ -253,8 +253,8 @@ static void note_page(struct pg_state *st, unsigned long 
> addr, unsigned level,
> if (st->current_prot) {
> note_prot_uxn(st, addr);
> note_prot_wx(st, addr);
> -   pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx   ",
> -  st->start_address, addr);
> +   pt_dump_seq_printf(st->seq, "%pK-%pK   ",
> +  (void *)st->start_address, (void *)addr);
>
> delta = (addr - st->start_address) >> 10;
> while (!(delta & 1023) && unit[1]) {
> --
> 1.9.1
>
>
> ___
> linux-arm-kernel mailing list
> linux-arm-ker...@lists.infradead.org
> 

Re: [PATCH] arm64: dump: hide kernel pointers

[Mark Rutland]

On Tue, Feb 28, 2017 at 08:42:51AM +, Ard Biesheuvel wrote:
> (+ Mark)

(+ Laura)

> On 28 February 2017 at 07:05, Miles Chen  wrote:
> > Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
> > /proc/vmallocinfo does.
> >
> > With sysctl kernel.kptr_restrict=0 or 1:
> > cat /sys/kernel/debug/kernel_page_tables
> 
> I wonder if this file should be accessible at all if kptr_restrict > 0

I don't have strong feelings either way.

This isn't typically enabled, and it's under debugfs, so this shouldn't
be accessible by a typical user anyhow.

That said, there are very few of us who need to take a look at this
file. I'm happy to deal with attacking kptr_restrict when required.

Thanks,
Mark.

> > ---[ Modules start ]---
> > ---[ Modules end ]---
> > ---[ vmalloc() Area ]---
> > ff800800-ff800801  64K PTE   RW NX SHD AF...
> > ff8008015000-ff8008016000   4K PTE   RW NX SHD AF...
> > ff800802-ff800803  64K PTE   RW NX SHD AF...
> > ff8008031000-ff8008071000 256K PTE   RW NX SHD AF...
> > ff800808-ff8008201536K PTE   ro x  SHD AF...
> > ff800820-ff800840   2M PMD   ro x  SHD AF...
> > ff800840-ff8008541280K PTE   ro x  SHD AF...
> > ff800854-ff8008691344K PTE   ro NX SHD AF...
> > ff800894-ff8008a1 832K PTE   RW NX SHD AF...
> > ff8008aca000-ff8008acd000  12K PTE   RW NX SHD AF...
> > ffbebffd8000-ffbebffdb000  12K PTE   RW NX SHD AF...
> > ---[ vmalloc() End ]---
> > ---[ Fixmap start ]---
> > ffbefe80-ffbefea0   2M PMD   ro NX SHD AF...
> > ---[ Fixmap end ]---
> > ---[ PCI I/O start ]---
> > ---[ PCI I/O end ]---
> > ---[ Linear Mapping ]---
> > ffc0-ffc8 512K PTE   RW NX SHD AF...
> > ffc8-ffc000201536K PTE   ro NX SHD AF...
> > ffc00020-ffc00060   4M PMD   ro NX SHD AF...
> > ffc00060-ffc00069 576K PTE   ro NX SHD AF...
> > ffc00069-ffc000801472K PTE   RW NX SHD AF...
> > ffc00080-ffc00200  24M PMD   RW NX SHD AF...
> > ffc00200-ffc04000 992M PMD   RW NX SHD AF...
> > ffc04000-ffc08000   1G PGD   RW NX SHD AF...
> >
> > With sysctl kernel.kptr_restrict=2:
> > cat /sys/kernel/debug/kernel_page_tables
> > ---[ Modules start ]---
> > ---[ Modules end ]---
> > ---[ vmalloc() Area ]---
> > -  64K PTE   RW NX SHD AF...
> > -   4K PTE   RW NX SHD AF...
> > -  64K PTE   RW NX SHD AF...
> > - 256K PTE   RW NX SHD AF...
> > -1536K PTE   ro x  SHD AF...
> > -   2M PMD   ro x  SHD AF...
> > -1280K PTE   ro x  SHD AF...
> > -1344K PTE   ro NX SHD AF...
> > - 832K PTE   RW NX SHD AF...
> > -  12K PTE   RW NX SHD AF...
> > -  12K PTE   RW NX SHD AF...
> > ---[ vmalloc() End ]---
> > ---[ Fixmap start ]---
> > -   2M PMD   ro NX SHD AF...
> > ---[ Fixmap end ]---
> > ---[ PCI I/O start ]---
> > ---[ PCI I/O end ]---
> > ---[ Linear Mapping ]---
> > - 512K PTE   RW NX SHD AF...
> > -1536K PTE   ro NX SHD AF...
> > -   4M PMD   ro NX SHD AF...
> > - 576K PTE   ro NX SHD AF...
> > -1472K PTE   RW NX SHD AF...
> > -  24M PMD   RW NX SHD AF...
> > - 992M PMD   RW NX SHD AF...
> > -   1G PGD   RW NX SHD AF...
> >
> > Signed-off-by: Miles Chen 
> > ---
> >  arch/arm64/mm/dump.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
> > index ca74a2a..e055ecf 100644
> > --- a/arch/arm64/mm/dump.c
> > +++ b/arch/arm64/mm/dump.c
> > @@ -253,8 +253,8 @@ static void note_page(struct pg_state *st, unsigned 
> > long addr, unsigned level,
> > if (st->current_prot) {
> > note_prot_uxn(st, addr);
> > note_prot_wx(st, addr);
> > -  

Re: [PATCH] arm64: dump: hide kernel pointers

[Mark Rutland]

On Tue, Feb 28, 2017 at 08:42:51AM +, Ard Biesheuvel wrote:
> (+ Mark)

(+ Laura)

> On 28 February 2017 at 07:05, Miles Chen  wrote:
> > Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
> > /proc/vmallocinfo does.
> >
> > With sysctl kernel.kptr_restrict=0 or 1:
> > cat /sys/kernel/debug/kernel_page_tables
> 
> I wonder if this file should be accessible at all if kptr_restrict > 0

I don't have strong feelings either way.

This isn't typically enabled, and it's under debugfs, so this shouldn't
be accessible by a typical user anyhow.

That said, there are very few of us who need to take a look at this
file. I'm happy to deal with attacking kptr_restrict when required.

Thanks,
Mark.

> > ---[ Modules start ]---
> > ---[ Modules end ]---
> > ---[ vmalloc() Area ]---
> > ff800800-ff800801  64K PTE   RW NX SHD AF...
> > ff8008015000-ff8008016000   4K PTE   RW NX SHD AF...
> > ff800802-ff800803  64K PTE   RW NX SHD AF...
> > ff8008031000-ff8008071000 256K PTE   RW NX SHD AF...
> > ff800808-ff8008201536K PTE   ro x  SHD AF...
> > ff800820-ff800840   2M PMD   ro x  SHD AF...
> > ff800840-ff8008541280K PTE   ro x  SHD AF...
> > ff800854-ff8008691344K PTE   ro NX SHD AF...
> > ff800894-ff8008a1 832K PTE   RW NX SHD AF...
> > ff8008aca000-ff8008acd000  12K PTE   RW NX SHD AF...
> > ffbebffd8000-ffbebffdb000  12K PTE   RW NX SHD AF...
> > ---[ vmalloc() End ]---
> > ---[ Fixmap start ]---
> > ffbefe80-ffbefea0   2M PMD   ro NX SHD AF...
> > ---[ Fixmap end ]---
> > ---[ PCI I/O start ]---
> > ---[ PCI I/O end ]---
> > ---[ Linear Mapping ]---
> > ffc0-ffc8 512K PTE   RW NX SHD AF...
> > ffc8-ffc000201536K PTE   ro NX SHD AF...
> > ffc00020-ffc00060   4M PMD   ro NX SHD AF...
> > ffc00060-ffc00069 576K PTE   ro NX SHD AF...
> > ffc00069-ffc000801472K PTE   RW NX SHD AF...
> > ffc00080-ffc00200  24M PMD   RW NX SHD AF...
> > ffc00200-ffc04000 992M PMD   RW NX SHD AF...
> > ffc04000-ffc08000   1G PGD   RW NX SHD AF...
> >
> > With sysctl kernel.kptr_restrict=2:
> > cat /sys/kernel/debug/kernel_page_tables
> > ---[ Modules start ]---
> > ---[ Modules end ]---
> > ---[ vmalloc() Area ]---
> > -  64K PTE   RW NX SHD AF...
> > -   4K PTE   RW NX SHD AF...
> > -  64K PTE   RW NX SHD AF...
> > - 256K PTE   RW NX SHD AF...
> > -1536K PTE   ro x  SHD AF...
> > -   2M PMD   ro x  SHD AF...
> > -1280K PTE   ro x  SHD AF...
> > -1344K PTE   ro NX SHD AF...
> > - 832K PTE   RW NX SHD AF...
> > -  12K PTE   RW NX SHD AF...
> > -  12K PTE   RW NX SHD AF...
> > ---[ vmalloc() End ]---
> > ---[ Fixmap start ]---
> > -   2M PMD   ro NX SHD AF...
> > ---[ Fixmap end ]---
> > ---[ PCI I/O start ]---
> > ---[ PCI I/O end ]---
> > ---[ Linear Mapping ]---
> > - 512K PTE   RW NX SHD AF...
> > -1536K PTE   ro NX SHD AF...
> > -   4M PMD   ro NX SHD AF...
> > - 576K PTE   ro NX SHD AF...
> > -1472K PTE   RW NX SHD AF...
> > -  24M PMD   RW NX SHD AF...
> > - 992M PMD   RW NX SHD AF...
> > -   1G PGD   RW NX SHD AF...
> >
> > Signed-off-by: Miles Chen 
> > ---
> >  arch/arm64/mm/dump.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
> > index ca74a2a..e055ecf 100644
> > --- a/arch/arm64/mm/dump.c
> > +++ b/arch/arm64/mm/dump.c
> > @@ -253,8 +253,8 @@ static void note_page(struct pg_state *st, unsigned 
> > long addr, unsigned level,
> > if (st->current_prot) {
> > note_prot_uxn(st, addr);
> > note_prot_wx(st, addr);
> > -   pt_dump_seq_printf(st->seq, 

[PATCH] arm64: dump: hide kernel pointers

[Miles Chen]

Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
/proc/vmallocinfo does.

With sysctl kernel.kptr_restrict=0 or 1:
cat /sys/kernel/debug/kernel_page_tables
---[ Modules start ]---
---[ Modules end ]---
---[ vmalloc() Area ]---
ff800800-ff800801  64K PTE   RW NX SHD AF...
ff8008015000-ff8008016000   4K PTE   RW NX SHD AF...
ff800802-ff800803  64K PTE   RW NX SHD AF...
ff8008031000-ff8008071000 256K PTE   RW NX SHD AF...
ff800808-ff8008201536K PTE   ro x  SHD AF...
ff800820-ff800840   2M PMD   ro x  SHD AF...
ff800840-ff8008541280K PTE   ro x  SHD AF...
ff800854-ff8008691344K PTE   ro NX SHD AF...
ff800894-ff8008a1 832K PTE   RW NX SHD AF...
ff8008aca000-ff8008acd000  12K PTE   RW NX SHD AF...
ffbebffd8000-ffbebffdb000  12K PTE   RW NX SHD AF...
---[ vmalloc() End ]---
---[ Fixmap start ]---
ffbefe80-ffbefea0   2M PMD   ro NX SHD AF...
---[ Fixmap end ]---
---[ PCI I/O start ]---
---[ PCI I/O end ]---
---[ Linear Mapping ]---
ffc0-ffc8 512K PTE   RW NX SHD AF...
ffc8-ffc000201536K PTE   ro NX SHD AF...
ffc00020-ffc00060   4M PMD   ro NX SHD AF...
ffc00060-ffc00069 576K PTE   ro NX SHD AF...
ffc00069-ffc000801472K PTE   RW NX SHD AF...
ffc00080-ffc00200  24M PMD   RW NX SHD AF...
ffc00200-ffc04000 992M PMD   RW NX SHD AF...
ffc04000-ffc08000   1G PGD   RW NX SHD AF...

With sysctl kernel.kptr_restrict=2:
cat /sys/kernel/debug/kernel_page_tables
---[ Modules start ]---
---[ Modules end ]---
---[ vmalloc() Area ]---
-  64K PTE   RW NX SHD AF...
-   4K PTE   RW NX SHD AF...
-  64K PTE   RW NX SHD AF...
- 256K PTE   RW NX SHD AF...
-1536K PTE   ro x  SHD AF...
-   2M PMD   ro x  SHD AF...
-1280K PTE   ro x  SHD AF...
-1344K PTE   ro NX SHD AF...
- 832K PTE   RW NX SHD AF...
-  12K PTE   RW NX SHD AF...
-  12K PTE   RW NX SHD AF...
---[ vmalloc() End ]---
---[ Fixmap start ]---
-   2M PMD   ro NX SHD AF...
---[ Fixmap end ]---
---[ PCI I/O start ]---
---[ PCI I/O end ]---
---[ Linear Mapping ]---
- 512K PTE   RW NX SHD AF...
-1536K PTE   ro NX SHD AF...
-   4M PMD   ro NX SHD AF...
- 576K PTE   ro NX SHD AF...
-1472K PTE   RW NX SHD AF...
-  24M PMD   RW NX SHD AF...
- 992M PMD   RW NX SHD AF...
-   1G PGD   RW NX SHD AF...

Signed-off-by: Miles Chen 
---
 arch/arm64/mm/dump.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index ca74a2a..e055ecf 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -253,8 +253,8 @@ static void note_page(struct pg_state *st, unsigned long 
addr, unsigned level,
if (st->current_prot) {
note_prot_uxn(st, addr);
note_prot_wx(st, addr);
-   pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx   ",
-  st->start_address, addr);
+   pt_dump_seq_printf(st->seq, "%pK-%pK   ",
+  (void *)st->start_address, (void *)addr);
 
delta = (addr - st->start_address) >> 10;
while (!(delta & 1023) && unit[1]) {
-- 
1.9.1

[PATCH] arm64: dump: hide kernel pointers

[Miles Chen]

Mask kernel pointers of /sys/kernel/debug/kernel_page_tables entry like
/proc/vmallocinfo does.

With sysctl kernel.kptr_restrict=0 or 1:
cat /sys/kernel/debug/kernel_page_tables
---[ Modules start ]---
---[ Modules end ]---
---[ vmalloc() Area ]---
ff800800-ff800801  64K PTE   RW NX SHD AF...
ff8008015000-ff8008016000   4K PTE   RW NX SHD AF...
ff800802-ff800803  64K PTE   RW NX SHD AF...
ff8008031000-ff8008071000 256K PTE   RW NX SHD AF...
ff800808-ff8008201536K PTE   ro x  SHD AF...
ff800820-ff800840   2M PMD   ro x  SHD AF...
ff800840-ff8008541280K PTE   ro x  SHD AF...
ff800854-ff8008691344K PTE   ro NX SHD AF...
ff800894-ff8008a1 832K PTE   RW NX SHD AF...
ff8008aca000-ff8008acd000  12K PTE   RW NX SHD AF...
ffbebffd8000-ffbebffdb000  12K PTE   RW NX SHD AF...
---[ vmalloc() End ]---
---[ Fixmap start ]---
ffbefe80-ffbefea0   2M PMD   ro NX SHD AF...
---[ Fixmap end ]---
---[ PCI I/O start ]---
---[ PCI I/O end ]---
---[ Linear Mapping ]---
ffc0-ffc8 512K PTE   RW NX SHD AF...
ffc8-ffc000201536K PTE   ro NX SHD AF...
ffc00020-ffc00060   4M PMD   ro NX SHD AF...
ffc00060-ffc00069 576K PTE   ro NX SHD AF...
ffc00069-ffc000801472K PTE   RW NX SHD AF...
ffc00080-ffc00200  24M PMD   RW NX SHD AF...
ffc00200-ffc04000 992M PMD   RW NX SHD AF...
ffc04000-ffc08000   1G PGD   RW NX SHD AF...

With sysctl kernel.kptr_restrict=2:
cat /sys/kernel/debug/kernel_page_tables
---[ Modules start ]---
---[ Modules end ]---
---[ vmalloc() Area ]---
-  64K PTE   RW NX SHD AF...
-   4K PTE   RW NX SHD AF...
-  64K PTE   RW NX SHD AF...
- 256K PTE   RW NX SHD AF...
-1536K PTE   ro x  SHD AF...
-   2M PMD   ro x  SHD AF...
-1280K PTE   ro x  SHD AF...
-1344K PTE   ro NX SHD AF...
- 832K PTE   RW NX SHD AF...
-  12K PTE   RW NX SHD AF...
-  12K PTE   RW NX SHD AF...
---[ vmalloc() End ]---
---[ Fixmap start ]---
-   2M PMD   ro NX SHD AF...
---[ Fixmap end ]---
---[ PCI I/O start ]---
---[ PCI I/O end ]---
---[ Linear Mapping ]---
- 512K PTE   RW NX SHD AF...
-1536K PTE   ro NX SHD AF...
-   4M PMD   ro NX SHD AF...
- 576K PTE   ro NX SHD AF...
-1472K PTE   RW NX SHD AF...
-  24M PMD   RW NX SHD AF...
- 992M PMD   RW NX SHD AF...
-   1G PGD   RW NX SHD AF...

Signed-off-by: Miles Chen 
---
 arch/arm64/mm/dump.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c
index ca74a2a..e055ecf 100644
--- a/arch/arm64/mm/dump.c
+++ b/arch/arm64/mm/dump.c
@@ -253,8 +253,8 @@ static void note_page(struct pg_state *st, unsigned long 
addr, unsigned level,
if (st->current_prot) {
note_prot_uxn(st, addr);
note_prot_wx(st, addr);
-   pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx   ",
-  st->start_address, addr);
+   pt_dump_seq_printf(st->seq, "%pK-%pK   ",
+  (void *)st->start_address, (void *)addr);
 
delta = (addr - st->start_address) >> 10;
while (!(delta & 1023) && unit[1]) {
-- 
1.9.1