linux-kernel - [PATCH 4/4] arm64: dynamic enforcement of pmd-level PXNTable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 20 Feb 2024 14:32:56 -0600
From: Maxwell Bland <mbland@...orola.com>
To: linux-arm-kernel@...ts.infradead.org
Cc: gregkh@...uxfoundation.org, agordeev@...ux.ibm.com,
        akpm@...ux-foundation.org, andreyknvl@...il.com, andrii@...nel.org,
        aneesh.kumar@...nel.org, aou@...s.berkeley.edu, ardb@...nel.org,
        arnd@...db.de, ast@...nel.org, borntraeger@...ux.ibm.com,
        bpf@...r.kernel.org, brauner@...nel.org, catalin.marinas@....com,
        christophe.leroy@...roup.eu, cl@...ux.com, daniel@...earbox.net,
        dave.hansen@...ux.intel.com, david@...hat.com, dennis@...nel.org,
        dvyukov@...gle.com, glider@...gle.com, gor@...ux.ibm.com,
        guoren@...nel.org, haoluo@...gle.com, hca@...ux.ibm.com,
        hch@...radead.org, john.fastabend@...il.com, jolsa@...nel.org,
        kasan-dev@...glegroups.com, kpsingh@...nel.org,
        linux-arch@...r.kernel.org, linux@...linux.org.uk,
        linux-efi@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-mm@...ck.org, linuxppc-dev@...ts.ozlabs.org,
        linux-riscv@...ts.infradead.org, linux-s390@...r.kernel.org,
        lstoakes@...il.com, mark.rutland@....com, martin.lau@...ux.dev,
        meted@...ux.ibm.com, michael.christie@...cle.com, mjguzik@...il.com,
        mpe@...erman.id.au, mst@...hat.com, muchun.song@...ux.dev,
        naveen.n.rao@...ux.ibm.com, npiggin@...il.com, palmer@...belt.com,
        paul.walmsley@...ive.com, quic_nprakash@...cinc.com,
        quic_pkondeti@...cinc.com, rick.p.edgecombe@...el.com,
        ryabinin.a.a@...il.com, ryan.roberts@....com, samitolvanen@...gle.com,
        sdf@...gle.com, song@...nel.org, surenb@...gle.com,
        svens@...ux.ibm.com, tj@...nel.org, urezki@...il.com,
        vincenzo.frascino@....com, will@...nel.org, wuqiang.matt@...edance.com,
        yonghong.song@...ux.dev, zlim.lnx@...il.com, mbland@...orola.com,
        awheeler@...orola.com
Subject: [PATCH 4/4] arm64: dynamic enforcement of pmd-level PXNTable

In an attempt to protect against write-then-execute attacks wherein an
adversary stages malicious code into a data page and then later uses a
write gadget to mark the data page executable, arm64 enforces PXNTable
when allocating pmd descriptors during the init process. However, these
protections are not maintained for dynamic memory allocations, creating
an extensive threat surface to write-then-execute attacks targeting
pages allocated through the vmalloc interface.

Straightforward modifications to the pgalloc interface allow for the
dynamic enforcement of PXNTable, restricting writable and
privileged-executable code pages to known kernel text, bpf-allocated
programs, and kprobe-allocated pages, all of which have more extensive
verification interfaces than the generic vmalloc region.

This patch adds a preprocessor define to check whether a pmd is
allocated by vmalloc and exists outside of a known code region, and if
so, marks the pmd as PXNTable, protecting over 100 last-level page
tables from manipulation in the process.

Signed-off-by: Maxwell Bland <mbland@...orola.com>
---
 arch/arm64/include/asm/pgalloc.h | 11 +++++++++--
 arch/arm64/include/asm/vmalloc.h |  5 +++++
 arch/arm64/mm/trans_pgd.c        |  2 +-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/include/asm/pgalloc.h b/arch/arm64/include/asm/pgalloc.h
index 237224484d0f..5e9262241e8b 100644
--- a/arch/arm64/include/asm/pgalloc.h
+++ b/arch/arm64/include/asm/pgalloc.h
@@ -13,6 +13,7 @@
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
 
+#define __HAVE_ARCH_ADDR_COND_PMD
 #define __HAVE_ARCH_PGD_FREE
 #include <asm-generic/pgalloc.h>
 
@@ -74,10 +75,16 @@ static inline void __pmd_populate(pmd_t *pmdp, phys_addr_t ptep,
  * of the mm address space.
  */
 static inline void
-pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep)
+pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmdp, pte_t *ptep,
+			unsigned long address)
 {
+	pmdval_t pmd = PMD_TYPE_TABLE | PMD_TABLE_UXN;
 	VM_BUG_ON(mm && mm != &init_mm);
-	__pmd_populate(pmdp, __pa(ptep), PMD_TYPE_TABLE | PMD_TABLE_UXN);
+	if (IS_DATA_VMALLOC_ADDR(address) &&
+		IS_DATA_VMALLOC_ADDR(address + PMD_SIZE)) {
+		pmd |= PMD_TABLE_PXN;
+	}
+	__pmd_populate(pmdp, __pa(ptep), pmd);
 }
 
 static inline void
diff --git a/arch/arm64/include/asm/vmalloc.h b/arch/arm64/include/asm/vmalloc.h
index dbcf8ad20265..6f254ab83f4a 100644
--- a/arch/arm64/include/asm/vmalloc.h
+++ b/arch/arm64/include/asm/vmalloc.h
@@ -34,4 +34,9 @@ static inline pgprot_t arch_vmap_pgprot_tagged(pgprot_t prot)
 extern unsigned long code_region_start __ro_after_init;
 extern unsigned long code_region_end __ro_after_init;
 
+#define IS_DATA_VMALLOC_ADDR(vaddr) (((vaddr) < code_region_start || \
+				      (vaddr) > code_region_end) && \
+				      ((vaddr) >= VMALLOC_START && \
+				       (vaddr) < VMALLOC_END))
+
 #endif /* _ASM_ARM64_VMALLOC_H */
diff --git a/arch/arm64/mm/trans_pgd.c b/arch/arm64/mm/trans_pgd.c
index 7b14df3c6477..7f903c51e1eb 100644
--- a/arch/arm64/mm/trans_pgd.c
+++ b/arch/arm64/mm/trans_pgd.c
@@ -69,7 +69,7 @@ static int copy_pte(struct trans_pgd_info *info, pmd_t *dst_pmdp,
 	dst_ptep = trans_alloc(info);
 	if (!dst_ptep)
 		return -ENOMEM;
-	pmd_populate_kernel(NULL, dst_pmdp, dst_ptep);
+	pmd_populate_kernel_at(NULL, dst_pmdp, dst_ptep, addr);
 	dst_ptep = pte_offset_kernel(dst_pmdp, start);
 
 	src_ptep = pte_offset_kernel(src_pmdp, start);
-- 
2.39.2