linux-kernel - [tip: x86/mm] x86/mm/32: Fix W^X detection when page tables do not support NX

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 21 Sep 2022 07:41:25 -0000
From:   "tip-bot2 for Dave Hansen" <tip-bot2@...utronix.de>
To:     linux-tip-commits@...r.kernel.org
Cc:     kernel test robot <yujie.liu@...el.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Ingo Molnar <mingo@...nel.org>, x86@...nel.org,
        linux-kernel@...r.kernel.org
Subject: [tip: x86/mm] x86/mm/32: Fix W^X detection when page tables do not support NX

The following commit has been merged into the x86/mm branch of tip:

Commit-ID:     9377ad7b61bff3abfb375d307770d6aa454bc516
Gitweb:        https://git.kernel.org/tip/9377ad7b61bff3abfb375d307770d6aa454bc516
Author:        Dave Hansen <dave.hansen@...el.com>
AuthorDate:    Tue, 20 Sep 2022 11:54:54 -07:00
Committer:     Ingo Molnar <mingo@...nel.org>
CommitterDate: Wed, 21 Sep 2022 09:32:55 +02:00

x86/mm/32: Fix W^X detection when page tables do not support NX

The x86 MM code now actively refuses to create writable+executable mappings,
and warns when there is an attempt to create one.

The 0day test robot ran across a warning triggered by module unloading on
32-bit kernels.  This was only seen on CPUs with NX support, but where a
32-bit kernel was built without PAE support.

On those systems, there is no room for the NX bit in the page
tables and _PAGE_NX is #defined to 0, breaking some of the W^X
detection logic in verify_rwx().  The X86_FEATURE_NX check in
there does not do any good here because the CPU itself supports
NX.

Fix it by checking for _PAGE_NX support directly instead of
checking CPU support for NX.

Note that since _PAGE_NX is actually defined to be 0 at
compile-time this fix should also end up letting the compiler
optimize away most of verify_rwx() on non-PAE kernels.

Fixes: 652c5bf380ad ("x86/mm: Refuse W^X violations")
Reported-by: kernel test robot <yujie.liu@...el.com>
Signed-off-by: Dave Hansen <dave.hansen@...ux.intel.com>
Signed-off-by: Ingo Molnar <mingo@...nel.org>
Link: https://lore.kernel.org/all/fcf89147-440b-e478-40c9-228c9fe56691@intel.com/
---
 arch/x86/mm/pat/set_memory.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 1a2d637..20b1e24 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -587,7 +587,8 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
 {
 	unsigned long end;

-	if (!cpu_feature_enabled(X86_FEATURE_NX))
+	/* Only enforce when NX is supported: */
+	if (!(__supported_pte_mask & _PAGE_NX))
 		return new;

 	if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))