| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20220613144550.3760857-23-ardb@kernel.org>
Date: Mon, 13 Jun 2022 16:45:46 +0200
From: Ard Biesheuvel <ardb@...nel.org>
To: linux-arm-kernel@...ts.infradead.org
Cc: linux-hardening@...r.kernel.org, Ard Biesheuvel <ardb@...nel.org>,
Marc Zyngier <maz@...nel.org>, Will Deacon <will@...nel.org>,
Mark Rutland <mark.rutland@....com>,
Kees Cook <keescook@...omium.org>,
Catalin Marinas <catalin.marinas@....com>,
Mark Brown <broonie@...nel.org>,
Anshuman Khandual <anshuman.khandual@....com>
Subject: [PATCH v4 22/26] arm64: mm: move ro_after_init section into the data segment
Currently, the ro_after_init sections sits right in the middle of the
text/rodata/inittext segment, making it difficult to map any of those
non-writable during early boot. So instead, move it to the start of
.data, and update the init sequences so that the section is remapped
read-only once startup completes.
Note that this moves the entire HYP data section into .data as well -
this likely needs to remain as a single block for now, but could perhaps
split into a .rodata and .data..ro_after_init section later.
Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
---
arch/arm64/kernel/vmlinux.lds.S | 42 ++++++++++++--------
arch/arm64/mm/mmu.c | 29 ++++++++------
2 files changed, 42 insertions(+), 29 deletions(-)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 45131e354e27..736aca63dad1 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -59,6 +59,7 @@
#define RO_EXCEPTION_TABLE_ALIGN 4
#define RUNTIME_DISCARD_EXIT
+#define RO_AFTER_INIT_DATA
#include <asm-generic/vmlinux.lds.h>
#include <asm/cache.h>
@@ -188,30 +189,13 @@ SECTIONS
/* everything from this point to __init_begin will be marked RO NX */
RO_DATA(PAGE_SIZE)
- HYPERVISOR_DATA_SECTIONS
-
/* code sections that are never executed via the kernel mapping */
.rodata.text : {
TRAMP_TEXT
HIBERNATE_TEXT
KEXEC_TEXT
- . = ALIGN(PAGE_SIZE);
}
- idmap_pg_dir = .;
- . += PAGE_SIZE;
-
-#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
- tramp_pg_dir = .;
- . += PAGE_SIZE;
-#endif
-
- reserved_pg_dir = .;
- . += PAGE_SIZE;
-
- swapper_pg_dir = .;
- . += PAGE_SIZE;
-
. = ALIGN(SEGMENT_ALIGN);
__init_begin = .;
__inittext_begin = .;
@@ -274,6 +258,30 @@ SECTIONS
_data = .;
_sdata = .;
+
+ __start_ro_after_init = .;
+ idmap_pg_dir = .;
+ . += PAGE_SIZE;
+
+#ifdef CONFIG_UNMAP_KERNEL_AT_EL0
+ tramp_pg_dir = .;
+ . += PAGE_SIZE;
+#endif
+ reserved_pg_dir = .;
+ . += PAGE_SIZE;
+
+ swapper_pg_dir = .;
+ . += PAGE_SIZE;
+
+ HYPERVISOR_DATA_SECTIONS
+
+ .data.ro_after_init : {
+ *(.data..ro_after_init)
+ JUMP_TABLE_DATA
+ . = ALIGN(SEGMENT_ALIGN);
+ __end_ro_after_init = .;
+ }
+
RW_DATA(L1_CACHE_BYTES, PAGE_SIZE, THREAD_ALIGN)
/*
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 9828ad826837..e9b074ffc768 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -495,11 +495,17 @@ static void __init __map_memblock(pgd_t *pgdp, phys_addr_t start,
void __init mark_linear_text_alias_ro(void)
{
/*
- * Remove the write permissions from the linear alias of .text/.rodata
+ * Remove the write permissions from the linear alias of .text/.rodata/ro_after_init
*/
update_mapping_prot(__pa_symbol(_stext), (unsigned long)lm_alias(_stext),
(unsigned long)__init_begin - (unsigned long)_stext,
PAGE_KERNEL_RO);
+
+ update_mapping_prot(__pa_symbol(__start_ro_after_init),
+ (unsigned long)lm_alias(__start_ro_after_init),
+ (unsigned long)__end_ro_after_init -
+ (unsigned long)__start_ro_after_init,
+ PAGE_KERNEL_RO);
}
static bool crash_mem_map __initdata;
@@ -608,12 +614,10 @@ void mark_rodata_ro(void)
{
unsigned long section_size;
- /*
- * mark .rodata as read only. Use __init_begin rather than __end_rodata
- * to cover NOTES and EXCEPTION_TABLE.
- */
- section_size = (unsigned long)__init_begin - (unsigned long)__start_rodata;
- update_mapping_prot(__pa_symbol(__start_rodata), (unsigned long)__start_rodata,
+ section_size = (unsigned long)__end_ro_after_init -
+ (unsigned long)__start_ro_after_init;
+ update_mapping_prot(__pa_symbol(__start_ro_after_init),
+ (unsigned long)__start_ro_after_init,
section_size, PAGE_KERNEL_RO);
debug_checkwx();
@@ -733,18 +737,19 @@ static void __init map_kernel(pgd_t *pgdp)
text_prot = __pgprot_modify(text_prot, PTE_GP, PTE_GP);
/*
- * Only rodata will be remapped with different permissions later on,
- * all other segments are allowed to use contiguous mappings.
+ * Only data will be partially remapped with different permissions
+ * later on, all other segments are allowed to use contiguous mappings.
*/
map_kernel_segment(pgdp, _stext, _etext, text_prot, &vmlinux_text, 0,
VM_NO_GUARD);
- map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL,
- &vmlinux_rodata, NO_CONT_MAPPINGS, VM_NO_GUARD);
+ map_kernel_segment(pgdp, __start_rodata, __inittext_begin, PAGE_KERNEL_RO,
+ &vmlinux_rodata, 0, VM_NO_GUARD);
map_kernel_segment(pgdp, __inittext_begin, __inittext_end, text_prot,
&vmlinux_inittext, 0, VM_NO_GUARD);
map_kernel_segment(pgdp, __initdata_begin, __initdata_end, PAGE_KERNEL,
&vmlinux_initdata, 0, VM_NO_GUARD);
- map_kernel_segment(pgdp, _data, _end, PAGE_KERNEL, &vmlinux_data, 0, 0);
+ map_kernel_segment(pgdp, _data, _end, PAGE_KERNEL, &vmlinux_data,
+ NO_CONT_MAPPINGS | NO_BLOCK_MAPPINGS, 0);
if (!READ_ONCE(pgd_val(*pgd_offset_pgd(pgdp, FIXADDR_START)))) {
/*
--
2.30.2
Powered by blists - more mailing lists