Re: [RESEND RFC PATCH 1/3] Introduce per thread user-kernel shared structure

On Sep 8, 2021, at 6:50 PM, Jann Horn [off-list ref] wrote:

On Thu, Sep 9, 2021 at 2:16 AM Prakash Sangappa
[off-list ref] wrote:

quoted

A structure per thread is allocated from a page that is shared mapped
between user space and kernel as means for faster communication. This will
facilitate sharing information, Ex: per thread stats shared between kernel
and user space, that can be read by applications without the need for
making frequent system calls in latency sensitive code path.

[...]

quoted

+               /* Try to map as high as possible, this is only a hint. */
+               pg->vaddr = get_unmapped_area(NULL, TASK_SIZE - PAGE_SIZE,
+                                       PAGE_SIZE, 0, 0);

I don't have an opinion on the rest of this patch, but from a security
perspective, please don't map things at fixed addresses; let the mmap
code pick some random address that it wants to use. If an attacker
manages to overwrite some userspace pointer with chosen data, we don't
want them to know an address where they can be sure something is
mapped.

Sure. I will address this. 
Thanks,
-Prakash