| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <87sid0jw1m.fsf@rustcorp.com.au>
Date: Fri, 20 Mar 2015 11:59:41 +1030
From: Rusty Russell <rusty@...abs.org>
To: Quentin Casasnovas <quentin.casasnovas@...cle.com>,
lkml <linux-kernel@...r.kernel.org>
Cc: Oleg Nesterov <oleg@...hat.com>, Borislav Petkov <bp@...en8.de>,
Linus Torvalds <torvalds@...ux-foundation.org>,
Quentin Casasnovas <quentin.casasnovas@...cle.com>
Subject: Re: [PATCH 1/7] modpost: add strict white-listing when referencing sections.
Quentin Casasnovas <quentin.casasnovas@...cle.com> writes:
> Prints a warning when a section references a section outside a strict
> white-list. This will be useful to print a warning if __ex_table
> references a non-executable section.
Hi Quentin,
Really pleasant to read these patches; nice work!
> diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
> index d439856..7094a57 100644
> --- a/scripts/mod/modpost.c
> +++ b/scripts/mod/modpost.c
> @@ -925,7 +925,8 @@ enum mismatch {
>
> struct sectioncheck {
> const char *fromsec[20];
> - const char *tosec[20];
> + const char *bad_tosec[20];
> + const char *good_tosec[20];
> enum mismatch mismatch;
> const char *symbol_white_list[20];
My only gripe is that these fields are undocumented. You maintain
the status quo, but some comments indicating what the mean would be
nice. Perhaps as a separate patch.
In case you need it (for the whole series):
Acked-by: Rusty Russell <rusty@...tcorp.com.au>
Thanks,
Rusty.
> };
> @@ -936,19 +937,19 @@ static const struct sectioncheck sectioncheck[] = {
> */
> {
> .fromsec = { TEXT_SECTIONS, NULL },
> - .tosec = { ALL_INIT_SECTIONS, NULL },
> + .bad_tosec = { ALL_INIT_SECTIONS, NULL },
> .mismatch = TEXT_TO_ANY_INIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> },
> {
> .fromsec = { DATA_SECTIONS, NULL },
> - .tosec = { ALL_XXXINIT_SECTIONS, NULL },
> + .bad_tosec = { ALL_XXXINIT_SECTIONS, NULL },
> .mismatch = DATA_TO_ANY_INIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> },
> {
> .fromsec = { DATA_SECTIONS, NULL },
> - .tosec = { INIT_SECTIONS, NULL },
> + .bad_tosec = { INIT_SECTIONS, NULL },
> .mismatch = DATA_TO_ANY_INIT,
> .symbol_white_list = {
> "*_template", "*_timer", "*_sht", "*_ops",
> @@ -957,54 +958,54 @@ static const struct sectioncheck sectioncheck[] = {
> },
> {
> .fromsec = { TEXT_SECTIONS, NULL },
> - .tosec = { ALL_EXIT_SECTIONS, NULL },
> + .bad_tosec = { ALL_EXIT_SECTIONS, NULL },
> .mismatch = TEXT_TO_ANY_EXIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> },
> {
> .fromsec = { DATA_SECTIONS, NULL },
> - .tosec = { ALL_EXIT_SECTIONS, NULL },
> + .bad_tosec = { ALL_EXIT_SECTIONS, NULL },
> .mismatch = DATA_TO_ANY_EXIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> },
> /* Do not reference init code/data from meminit code/data */
> {
> .fromsec = { ALL_XXXINIT_SECTIONS, NULL },
> - .tosec = { INIT_SECTIONS, NULL },
> + .bad_tosec = { INIT_SECTIONS, NULL },
> .mismatch = XXXINIT_TO_SOME_INIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> },
> /* Do not reference exit code/data from memexit code/data */
> {
> .fromsec = { ALL_XXXEXIT_SECTIONS, NULL },
> - .tosec = { EXIT_SECTIONS, NULL },
> + .bad_tosec = { EXIT_SECTIONS, NULL },
> .mismatch = XXXEXIT_TO_SOME_EXIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> },
> /* Do not use exit code/data from init code */
> {
> .fromsec = { ALL_INIT_SECTIONS, NULL },
> - .tosec = { ALL_EXIT_SECTIONS, NULL },
> + .bad_tosec = { ALL_EXIT_SECTIONS, NULL },
> .mismatch = ANY_INIT_TO_ANY_EXIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> },
> /* Do not use init code/data from exit code */
> {
> .fromsec = { ALL_EXIT_SECTIONS, NULL },
> - .tosec = { ALL_INIT_SECTIONS, NULL },
> + .bad_tosec = { ALL_INIT_SECTIONS, NULL },
> .mismatch = ANY_EXIT_TO_ANY_INIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> },
> {
> .fromsec = { ALL_PCI_INIT_SECTIONS, NULL },
> - .tosec = { INIT_SECTIONS, NULL },
> + .bad_tosec = { INIT_SECTIONS, NULL },
> .mismatch = ANY_INIT_TO_ANY_EXIT,
> .symbol_white_list = { NULL },
> },
> /* Do not export init/exit functions or data */
> {
> .fromsec = { "__ksymtab*", NULL },
> - .tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
> + .bad_tosec = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
> .mismatch = EXPORT_TO_INIT_EXIT,
> .symbol_white_list = { DEFAULT_SYMBOL_WHITE_LIST, NULL },
> }
> @@ -1018,9 +1019,12 @@ static const struct sectioncheck *section_mismatch(
> const struct sectioncheck *check = §ioncheck[0];
>
> for (i = 0; i < elems; i++) {
> - if (match(fromsec, check->fromsec) &&
> - match(tosec, check->tosec))
> - return check;
> + if (match(fromsec, check->fromsec)) {
> + if (check->bad_tosec[0] && match(tosec, check->bad_tosec))
> + return check;
> + if (check->good_tosec[0] && !match(tosec, check->good_tosec))
> + return check;
> + }
> check++;
> }
> return NULL;
> --
> 2.0.5
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@...r.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists