linux-kernel - [PATCH] x86/Kconfig: enable ROX cache in execmem when STRICT_KERNEL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250716075410.82578-1-rppt@kernel.org>
Date: Wed, 16 Jul 2025 10:54:10 +0300
From: Mike Rapoport <rppt@...nel.org>
To: Peter Zijlstra <peterz@...radead.org>
Cc: Borislav Petkov <bp@...en8.de>,
	Dan Moulding <dan@...m.net>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	Ingo Molnar <mingo@...hat.com>,
	Mike Rapoport <rppt@...nel.org>,
	"H. Peter Anvin" <hpa@...or.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	linux-kernel@...r.kernel.org,
	linux-mm@...ck.org,
	x86@...nel.org
Subject: [PATCH] x86/Kconfig: enable ROX cache in execmem when STRICT_KERNEL_RWX is set

From: "Mike Rapoport (Microsoft)" <rppt@...nel.org>

Dan Moulding reported that kernel configured without modules produces
"Found insecure W+X mapping at address 0xffffffffc0247000" warining:

[    6.022847] ------------[ cut here ]------------
[    6.023020] x86/mm: Found insecure W+X mapping at address 0xffffffffc0247000
[    6.023200] WARNING: CPU: 5 PID: 1 at arch/x86/mm/dump_pagetables.c:246 note_page+0x6ec/0x790
[    6.023381] CPU: 5 UID: 0 PID: 1 Comm: swapper/0 Tainted: G                T   6.16.0-rc6 #1 PREEMPT
[    6.023558] Tainted: [T]=RANDSTRUCT
...
[    6.031153] x86/mm: Checked W+X mappings: FAILED, 10 W+X pages found.

The 10 W+X pages are the pages allocated for ITS thunks. With
CONFIG_MODULES disabled, CONFIG_STRICT_MODULE_RWX does not exist and ROX
cache in execmem is not enabled so execmem_restore_rox() becomes an empty
stub.

Enabling ROX cache when CONFIG_STRICT_KERNEL_RWX is set solves the issue and
makes ITS thunks memory properly protected.

It also ensures that memory containing ITS thunks is mapped with 2M pages
for kernels compiled without modules.

Reported-by: Dan Moulding <dan@...m.net>
Signed-off-by: Mike Rapoport (Microsoft) <rppt@...nel.org>
---
 arch/x86/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 8bed9030ad47..d6d8050683ae 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -89,7 +89,7 @@ config X86
 	select ARCH_HAS_DMA_OPS			if GART_IOMMU || XEN
 	select ARCH_HAS_EARLY_DEBUG		if KGDB
 	select ARCH_HAS_ELF_RANDOMIZE
-	select ARCH_HAS_EXECMEM_ROX		if X86_64 && STRICT_MODULE_RWX
+	select ARCH_HAS_EXECMEM_ROX		if X86_64 && (STRICT_KERNEL_RWX || STRICT_MODULE_RWX)
 	select ARCH_HAS_FAST_MULTIPLIER
 	select ARCH_HAS_FORTIFY_SOURCE
 	select ARCH_HAS_GCOV_PROFILE_ALL

base-commit: 347e9f5043c89695b01e66b3ed111755afcf1911
-- 
2.47.2