linux-kernel - Re: [PATCH 5.15 00/59] 5.15.184-rc1 review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250521212103.gpdkplv77acgsdsb@desk>
Date: Wed, 21 May 2025 14:25:56 -0700
From: Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
To: Alexandre Chartre <alexandre.chartre@...cle.com>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, stable@...r.kernel.org,
	patches@...ts.linux.dev, linux-kernel@...r.kernel.org,
	torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
	linux@...ck-us.net, shuah@...nel.org, patches@...nelci.org,
	lkft-triage@...ts.linaro.org, pavel@...x.de, jonathanh@...dia.com,
	f.fainelli@...il.com, sudipm.mukherjee@...il.com,
	srw@...dewatkins.net, rwarsow@....de, conor@...nel.org,
	hargar@...rosoft.com, broonie@...nel.org,
	Salvatore Bonaccorso <carnil@...ian.org>,
	Moritz Mühlenhoff <mmuhlenhoff@...imedia.org>
Subject: Re: [PATCH 5.15 00/59] 5.15.184-rc1 review

On Wed, May 21, 2025 at 09:10:58PM +0200, Alexandre Chartre wrote:
> It looks the problem comes from pages allocated for dynamic thunks for modules, and
> this patch appears to fix the problem:
> 
> diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
> index 43ec73da66d8b..9ca6973e56547 100644
> --- a/arch/x86/kernel/alternative.c
> +++ b/arch/x86/kernel/alternative.c
> @@ -460,6 +460,8 @@ void its_free_mod(struct module *mod)
>         for (i = 0; i < mod->its_num_pages; i++) {
>                 void *page = mod->its_page_array[i];
> +               set_memory_nx((unsigned long)page, 1);
> +               set_memory_rw((unsigned long)page, 1);
>                 module_memfree(page);
>         }
>         kfree(mod->its_page_array);
> 
> I don't know the exact underlying issue but I suspect that the kernel doesn't
> correctly handle pages freed without the write permission, and restoring page
> permissions to rw (instead of rox) before freeing prevent the problem.

Your analysis aligns with the proposed fix to backport below patch as well:

x86/modules: Set VM_FLUSH_RESET_PERMS in module_alloc()
https://lore.kernel.org/stable/20250521171635.848656-1-pchelkin@ispras.ru/