linux-kernel - Re: [PATCH] arm64/module: set trampoline section flags regardless of CONFIG_DYNAMIC

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 2 Sep 2020 09:01:12 +0300
From:   Ard Biesheuvel <ardb@...nel.org>
To:     Jessica Yu <jeyu@...nel.org>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Will Deacon <will@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Szabolcs Nagy <szabolcs.nagy@....com>,
        Catalin Marinas <catalin.marinas@....com>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Mauro Carvalho Chehab <mchehab+huawei@...nel.org>,
        Linux ARM <linux-arm-kernel@...ts.infradead.org>
Subject: Re: [PATCH] arm64/module: set trampoline section flags regardless of CONFIG_DYNAMIC_FTRACE

On Tue, 1 Sep 2020 at 19:00, Jessica Yu <jeyu@...nel.org> wrote:
>
> In the arm64 module linker script, the section .text.ftrace_trampoline
> is specified unconditionally regardless of whether CONFIG_DYNAMIC_FTRACE
> is enabled (this is simply due to the limitation that module linker
> scripts are not preprocessed like the vmlinux one).
>
> Normally, for .plt and .text.ftrace_trampoline, the section flags
> present in the module binary wouldn't matter since module_frob_arch_sections()
> would assign them manually anyway. However, the arm64 module loader only
> sets the section flags for .text.ftrace_trampoline when CONFIG_DYNAMIC_FTRACE=y.
> That's only become problematic recently due to a recent change in
> binutils-2.35, where the .text.ftrace_trampoline section (along with the
> .plt section) is now marked writable and executable (WAX).
>
> We no longer allow writable and executable sections to be loaded due to
> commit 5c3a7db0c7ec ("module: Harden STRICT_MODULE_RWX"), so this is
> causing all modules linked with binutils-2.35 to be rejected under arm64.
> Drop the IS_ENABLED(CONFIG_DYNAMIC_FTRACE) check in module_frob_arch_sections()
> so that the section flags for .text.ftrace_trampoline get properly set to
> SHF_EXECINSTR|SHF_ALLOC, without SHF_WRITE.
>
> Link: http://lore.kernel.org/r/20200831094651.GA16385@linux-8ccs
> Acked-by: Will Deacon <will@...nel.org>
> Signed-off-by: Jessica Yu <jeyu@...nel.org>

Acked-by: Ard Biesheuvel <ardb@...nel.org>

> ---
>  arch/arm64/kernel/module-plts.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c
> index 0ce3a28e3347..2e224435c024 100644
> --- a/arch/arm64/kernel/module-plts.c
> +++ b/arch/arm64/kernel/module-plts.c
> @@ -305,8 +305,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
>                         mod->arch.core.plt_shndx = i;
>                 else if (!strcmp(secstrings + sechdrs[i].sh_name, ".init.plt"))
>                         mod->arch.init.plt_shndx = i;
> -               else if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
> -                        !strcmp(secstrings + sechdrs[i].sh_name,
> +               else if (!strcmp(secstrings + sechdrs[i].sh_name,
>                                  ".text.ftrace_trampoline"))
>                         tramp = sechdrs + i;
>                 else if (sechdrs[i].sh_type == SHT_SYMTAB)
> --
> 2.16.4
>