Messages in this thread | | | From | "Edgecombe, Rick P" <> | Subject | Re: [PATCH] x86/mm: Set NX bit when making pages present | Date | Mon, 19 Sep 2022 18:14:48 +0000 |
| |
On Fri, 2022-09-09 at 08:27 -0700, Dave Hansen wrote: > 0day ran across a case triggered by module unloading, but that looks > to be a generic problem. It presumably goes like this: > > 1. Load module with direct map, P=1,W=1,NX=1 > 2. Map module executable, set P=1,W=0,NX=0 > 3. Free module, land in vfree()->vm_remove_mappings() > 4. Set P=0 during alias processing, P=0,W=0,NX=0 > 5. Restore kernel mapping via > set_direct_map_default_noflush(), > set P=1,W=1, resulting in P=1,W=1,NX=0
I don't think this is right. CPA skips NX modification on the alias, so the earlier module CPA's (1-2) shouldn't have touched NX where set_direct_map() is operating. So NX *shouldn't* have been cleared in this case.
Clearly somehow it is though. The original report has this in the log: Notice: NX (Execute Disable) protection cannot be enabled: non-PAE kernel!
So probably the W^X checker needs to check this non-PAE case differently.
| |