Messages in this thread | | | Date | Fri, 2 Oct 2015 09:19:07 +0200 | From | Ingo Molnar <> | Subject | Re: rwx mapping between ex_table and rodata |
| |
* Kees Cook <keescook@chromium.org> wrote:
> On Thu, Oct 1, 2015 at 2:12 AM, Ingo Molnar <mingo@kernel.org> wrote: > > > > * Thomas Gleixner <tglx@linutronix.de> wrote: > > > >> On Mon, 28 Sep 2015, Kees Cook wrote: > >> > > --- a/arch/x86/mm/init_64.c > >> > > +++ b/arch/x86/mm/init_64.c > >> > > @@ -1132,7 +1132,7 @@ void mark_rodata_ro(void) > >> > > * has been zapped already via cleanup_highmem(). > >> > > */ > >> > > all_end = roundup((unsigned long)_brk_end, PMD_SIZE); > >> > > - set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT); > >> > > + set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT); > >> > > > >> > > rodata_test(); > >> > > > >> > > > >> > > >> > That should work, yeah. I'd still like to find the default permissions and > >> > make them W+nx, though. Regardless, let's get the above added. > >> > >> The default permissions are set at boot time when setting up the early page > >> tables. When we split them up later on we inherit the PTE bits and then we do > >> that _ro/nx cleanup after the overall layout has been settled. > >> > >> We can't make them W+nx in the early setup without shooting ourself in the foot, > >> because we only set up at the pud/pmd level. > > > > So I think at minimum we should do a (debug) scan in late init, of the whole > > range, for any leftover WX permissions? That would have caught this bug. (and > > might catch other existing bugs that might occur with various configs/hw-layouts.) > > I think this would be great. I'd like to disassociate it from PTDUMP, > though, since that exposes kernel address to userspace. It'd be nice > to have the check without also the debugfs entry.
Yeah, so it could still use pretty much the same code, except no registry in /debug?
Thanks,
Ingo
| |