linux-kernel - Re: [PATCH] module: Make srcu_struct ptr array as read-only

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190411213155.GD14111@linux.ibm.com>
Date:   Thu, 11 Apr 2019 14:31:55 -0700
From:   "Paul E. McKenney" <paulmck@...ux.ibm.com>
To:     "Joel Fernandes (Google)" <joel@...lfernandes.org>
Cc:     linux-kernel@...r.kernel.org,
        Rasmus Villemoes <linux@...musvillemoes.dk>,
        rostedt@...dmis.org, mathieu.desnoyers@...icios.com,
        rcu@...r.kernel.org, kernel-hardening@...ts.openwall.com,
        kernel-team@...roid.com, Josh Triplett <josh@...htriplett.org>,
        Lai Jiangshan <jiangshanlai@...il.com>
Subject: Re: [PATCH] module: Make srcu_struct ptr array as read-only

On Thu, Apr 11, 2019 at 04:24:21PM -0400, Joel Fernandes (Google) wrote:
> Since commit title ("srcu: Allocate per-CPU data for DEFINE_SRCU() in
> modules"), modules that call DEFINE_{STATIC,}SRCU will have a new array
> of srcu_struct pointers, which is used by srcu code to initialize and
> clean up these structures and save valuable per-cpu reserved space.
> 
> There is no reason for this array of pointers to be writable, and can
> cause security or other hidden bugs. Mark these are read-only after the
> module init has completed.
> 
> Tested with the following diff to ensure array not writable:
> 
> (diff is a bit reduced to avoid patch command getting confused)
>  a/kernel/module.c
>  b/kernel/module.c
>   -3506,6 +3506,14  static noinline int do_init_module [snip]
>  	rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);
>  #endif
>  	module_enable_ro(mod, true);
> +
> +	if (mod->srcu_struct_ptrs) {
> +		// Check if srcu_struct_ptrs access is possible
> +		char x = *(char *)mod->srcu_struct_ptrs;
> +		*(char *)mod->srcu_struct_ptrs = 0;
> +		*(char *)mod->srcu_struct_ptrs = x;
> +	}
> +
>  	mod_tree_remove_init(mod);
>  	disable_ro_nx(&mod->init_layout);
>  	module_arch_freeing_init(mod);
> 
> Cc: Rasmus Villemoes <linux@...musvillemoes.dk>
> Cc: paulmck@...ux.vnet.ibm.com
> Cc: rostedt@...dmis.org
> Cc: mathieu.desnoyers@...icios.com
> Cc: rcu@...r.kernel.org
> Cc: kernel-hardening@...ts.openwall.com
> Cc: kernel-team@...roid.com
> Signed-off-by: Joel Fernandes (Google) <joel@...lfernandes.org>

Queued for testing and further review, thank you, Joel!

							Thanx, Paul

> ---
> This single patch superceded the patches at:
> https://lore.kernel.org/patchwork/patch/1060298/
> https://lore.kernel.org/patchwork/patch/1060298/
> 
>  include/linux/srcutree.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/linux/srcutree.h b/include/linux/srcutree.h
> index 8af1824c46a8..9cfcc8a756ae 100644
> --- a/include/linux/srcutree.h
> +++ b/include/linux/srcutree.h
> @@ -123,7 +123,7 @@ struct srcu_struct {
>  #ifdef MODULE
>  # define __DEFINE_SRCU(name, is_static)					\
>  	is_static struct srcu_struct name;				\
> -	struct srcu_struct *__srcu_struct_##name			\
> +	struct srcu_struct * const __srcu_struct_##name			\
>  		__section("___srcu_struct_ptrs") = &name
>  #else
>  # define __DEFINE_SRCU(name, is_static)					\
> -- 
> 2.21.0.392.gf8f6787159e-goog
>