Messages in this thread | | | Date | Mon, 24 Oct 2022 14:13:29 -0400 | From | Steven Rostedt <> | Subject | Re: [PATCH] x86/mm: Do not verify W^X at boot up |
| |
On Mon, 24 Oct 2022 09:14:45 -0700 Dave Hansen <dave.hansen@intel.com> wrote:
> On 10/24/22 08:45, Steven Rostedt wrote: > > --- a/arch/x86/mm/pat/set_memory.c > > +++ b/arch/x86/mm/pat/set_memory.c > > @@ -587,6 +587,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star > > { > > unsigned long end; > > > > + /* Kernel text is rw at boot up */ > > + if (system_state == SYSTEM_BOOTING) > > + return new; > > Hi Steven, > > Thanks for the report and the patch. That seems reasonable, but I'm a > bit worried that it opens up a big hole (boot time) when a W+X mapping > could be created *anywhere*. > > Could we restrict this bypass to *only* kernel text addresses during > boot? Maybe something like this: > > if ((system_state == SYSTEM_BOOTING) && > __kernel_text_address(start)) > return new;
Actually, that brings back the warning, as ftrace creates a trampoline, but text_poke() will still use memcpy on it at early boot up.
The trampolines are set to ro at the end of boot up by:
59566b0b622e3 ("x86/ftrace: Have ftrace trampolines turn read-only at the end of system boot up")
Which was added because of text_poke() doing the memcpy().
> > That would be safe because we know that kernel_text_address() addresses > will be made read-only by the time userspace shows up and that > is_kernel_inittext() addresses will be freed. > > Long-term, I wonder if we could teach the early patching code that it > can't just use memcpy(). >
Maybe.
-- Steve
| |