linux-kernel - Re: [RFC PATCH 1/3] module: Split module_enable_rodata

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <D5HZVZY3ZW6B.3MM2Y4NBQ51MC@samsung.com>
Date: Sat, 9 Nov 2024 23:18:27 +0100
From: Daniel Gomez <da.gomez@...sung.com>
To: Christophe Leroy <christophe.leroy@...roup.eu>, Luis Chamberlain
	<mcgrof@...nel.org>, Petr Pavlu <petr.pavlu@...e.com>, Sami Tolvanen
	<samitolvanen@...gle.com>, Kees Cook <kees@...nel.org>,
	<linux-modules@...r.kernel.org>
CC: <linux-kernel@...r.kernel.org>, Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [RFC PATCH 1/3] module: Split module_enable_rodata_ro()

On Sat Nov 9, 2024 at 11:35 AM CET, Christophe Leroy wrote:
> module_enable_rodata_ro() is called twice, once before module init
> to set rodata sections readonly and once after module init to set
> rodata_after_init section readonly.
>
> The second time, only the rodata_after_init section needs to be
> set to read-only, no need to re-apply it to already set rodata.
>
> Split module_enable_rodata_ro() in two.
>
> Signed-off-by: Christophe Leroy <christophe.leroy@...roup.eu>

Tested-by: Daniel Gomez <da.gomez@...sung.com>

> ---
>  kernel/module/internal.h   |  3 ++-
>  kernel/module/main.c       |  4 ++--
>  kernel/module/strict_rwx.c | 13 +++++++++----
>  3 files changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/kernel/module/internal.h b/kernel/module/internal.h
> index 2ebece8a789f..994f35a779dc 100644
> --- a/kernel/module/internal.h
> +++ b/kernel/module/internal.h
> @@ -322,7 +322,8 @@ static inline struct module *mod_find(unsigned long addr, struct mod_tree_root *
>  }
>  #endif /* CONFIG_MODULES_TREE_LOOKUP */
>  
> -int module_enable_rodata_ro(const struct module *mod, bool after_init);
> +int module_enable_rodata_ro(const struct module *mod);
> +int module_enable_rodata_ro_after_init(const struct module *mod);
>  int module_enable_data_nx(const struct module *mod);
>  int module_enable_text_rox(const struct module *mod);
>  int module_enforce_rwx_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index 49b9bca9de12..2de4ad7af335 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -2581,7 +2581,7 @@ static noinline int do_init_module(struct module *mod)
>  	/* Switch to core kallsyms now init is done: kallsyms may be walking! */
>  	rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);
>  #endif
> -	ret = module_enable_rodata_ro(mod, true);
> +	ret = module_enable_rodata_ro_after_init(mod);
>  	if (ret)
>  		goto fail_mutex_unlock;
>  	mod_tree_remove_init(mod);
> @@ -2751,7 +2751,7 @@ static int complete_formation(struct module *mod, struct load_info *info)
>  	module_bug_finalize(info->hdr, info->sechdrs, mod);
>  	module_cfi_finalize(info->hdr, info->sechdrs, mod);
>  
> -	err = module_enable_rodata_ro(mod, false);
> +	err = module_enable_rodata_ro(mod);
>  	if (err)
>  		goto out_strict_rwx;
>  	err = module_enable_data_nx(mod);
> diff --git a/kernel/module/strict_rwx.c b/kernel/module/strict_rwx.c
> index c45caa4690e5..f68c59974ae2 100644
> --- a/kernel/module/strict_rwx.c
> +++ b/kernel/module/strict_rwx.c
> @@ -44,7 +44,7 @@ int module_enable_text_rox(const struct module *mod)
>  	return 0;
>  }
>  
> -int module_enable_rodata_ro(const struct module *mod, bool after_init)
> +int module_enable_rodata_ro(const struct module *mod)
>  {
>  	int ret;
>  
> @@ -58,12 +58,17 @@ int module_enable_rodata_ro(const struct module *mod, bool after_init)
>  	if (ret)
>  		return ret;
>  
> -	if (after_init)
> -		return module_set_memory(mod, MOD_RO_AFTER_INIT, set_memory_ro);
> -
>  	return 0;
>  }
>  
> +int module_enable_rodata_ro_after_init(const struct module *mod)
> +{
> +	if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX) || !rodata_enabled)
> +		return 0;
> +
> +	return module_set_memory(mod, MOD_RO_AFTER_INIT, set_memory_ro);
> +}
> +
>  int module_enable_data_nx(const struct module *mod)
>  {
>  	if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX))