linux-kernel - Re: [PATCH 1/2] ARM: mm: DEBUG_RODATA makes no sense with XIP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5jJ84FupuH2Zq8TVKNTS3zMTYZiBaSbjWZWWZ1ApBzBtwg@mail.gmail.com>
Date:	Tue, 16 Feb 2016 10:41:09 -0800
From:	Kees Cook <keescook@...omium.org>
To:	Arnd Bergmann <arnd@...db.de>
Cc:	Russell King <linux@....linux.org.uk>,
	"linux-arm-kernel@...ts.infradead.org" 
	<linux-arm-kernel@...ts.infradead.org>,
	Laura Abbott <labbott@...oraproject.org>,
	Ard Biesheuvel <ard.biesheuvel@...aro.org>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/2] ARM: mm: DEBUG_RODATA makes no sense with XIP_KERNEL

On Tue, Feb 16, 2016 at 8:03 AM, Arnd Bergmann <arnd@...db.de> wrote:
> When CONFIG_DEBUG_ALIGN_RODATA is set, we get a link error:
>
> arch/arm/mm/built-in.o:(.data+0x4bc): undefined reference to `__start_rodata_section_aligned'
>
> However, this combination is useless, as XIP_KERNEL implies that all the
> RODATA is already marked readonly, so both CONFIG_DEBUG_RODATA and
> CONFIG_DEBUG_ALIGN_RODATA (which depends on the other) are not
> needed with XIP_KERNEL, and this patches enforces that using a Kconfig
> dependency.
>
> Signed-off-by: Arnd Bergmann <arnd@...db.de>
> Fixes: 25362dc496ed ("ARM: 8501/1: mm: flip priority of CONFIG_DEBUG_RODATA")

Oh, hm, I didn't see this before sending my fix for the rodata start issue.

> ---
>  arch/arm/mm/Kconfig | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/arm/mm/Kconfig b/arch/arm/mm/Kconfig
> index fbf2296388ce..8894045caba9 100644
> --- a/arch/arm/mm/Kconfig
> +++ b/arch/arm/mm/Kconfig
> @@ -1039,7 +1039,7 @@ config ARCH_SUPPORTS_BIG_ENDIAN
>
>  config DEBUG_RODATA
>         bool "Make kernel text and rodata read-only"
> -       depends on MMU
> +       depends on MMU && !XIP_KERNEL

If we do this, we need to probably clean up the xip linker script to
remove all the references to DEBUG_*RODATA too.

-Kees

>         default y if CPU_V7
>         help
>           If this is set, kernel text and rodata memory will be made
> --
> 2.7.0
>



-- 
Kees Cook
Chrome OS & Brillo Security