linux-kernel - Re: [PATCH v2 3/3] module: Make .static_call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <481a3ef9-6d4e-4e29-9d50-a6338604c873@csgroup.eu>
Date: Thu, 6 Mar 2025 18:28:58 +0100
From: Christophe Leroy <christophe.leroy@...roup.eu>
To: Petr Pavlu <petr.pavlu@...e.com>, Luis Chamberlain <mcgrof@...nel.org>,
 Peter Zijlstra <peterz@...radead.org>, Josh Poimboeuf <jpoimboe@...nel.org>,
 Jason Baron <jbaron@...mai.com>
Cc: Sami Tolvanen <samitolvanen@...gle.com>,
 Daniel Gomez <da.gomez@...sung.com>, Steven Rostedt <rostedt@...dmis.org>,
 Ard Biesheuvel <ardb@...nel.org>, linux-modules@...r.kernel.org,
 linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 3/3] module: Make .static_call_sites read-only after
 init



Le 06/03/2025 à 14:13, Petr Pavlu a écrit :
> Section .static_call_sites holds data structures that need to be sorted and
> processed only at module load time. This initial processing happens in
> static_call_add_module(), which is invoked as a callback to the
> MODULE_STATE_COMING notification from prepare_coming_module().
> 
> The section is never modified afterwards. Make it therefore read-only after
> module initialization to avoid any (non-)accidental modifications.

Maybe this suggestion is stupid, I didn't investigate the feasability 
but: why don't we group everything that is ro_after_init in a single 
section just like we do in vmlinux ? That would avoid having to add 
every new possible section in the C code.

Like we have in asm-generic/vmlinux.lds.h:

#define RO_AFTER_INIT_DATA						\
	. = ALIGN(8);							\
	__start_ro_after_init = .;					\
	*(.data..ro_after_init)						\
	JUMP_TABLE_DATA							\
	STATIC_CALL_DATA						\
	__end_ro_after_init = .;


> 
> Signed-off-by: Petr Pavlu <petr.pavlu@...e.com>
> ---
>   kernel/module/strict_rwx.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
> 
> diff --git a/kernel/module/strict_rwx.c b/kernel/module/strict_rwx.c
> index fa701dad4ed1..a3fc8d603750 100644
> --- a/kernel/module/strict_rwx.c
> +++ b/kernel/module/strict_rwx.c
> @@ -120,6 +120,15 @@ static const char *const ro_after_init[] = {
>   	 * section, which are marked as such at module load time.
>   	 */
>   	"__jump_table",
> +
> +#ifdef CONFIG_HAVE_STATIC_CALL_INLINE
> +	/*
> +	 * Section .static_call_sites holds data structures that need to be
> +	 * sorted and processed at module load time but are never modified
> +	 * afterwards.
> +	 */
> +	".static_call_sites",
> +#endif
>   };
>   
>   void module_mark_ro_after_init(const Elf_Ehdr *hdr, Elf_Shdr *sechdrs,