From: Mike Rapoport <rppt@kernel.org>
To: Atish Patra <atish.patra@wdc.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>,
Kees Cook <keescook@chromium.org>,
Anup Patel <anup@brainfault.org>,
linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org,
Palmer Dabbelt <palmer@dabbelt.com>, Zong Li <zong.li@sifive.com>,
Paul Walmsley <paul.walmsley@sifive.com>,
Greentime Hu <greentime.hu@sifive.com>,
Andrew Morton <akpm@linux-foundation.org>,
Borislav Petkov <bp@suse.de>,
Michel Lespinasse <walken@google.com>,
Ard Biesheuvel <ardb@kernel.org>
Subject: Re: [PATCH v2 3/6] RISC-V: Enforce protections for kernel sections early
Date: Tue, 27 Oct 2020 12:00:40 +0200 [thread overview]
Message-ID: <20201027100040.GK1154158@kernel.org> (raw)
In-Reply-To: <20201026230254.911912-4-atish.patra@wdc.com>
On Mon, Oct 26, 2020 at 04:02:51PM -0700, Atish Patra wrote:
> Currently, all memblocks are mapped with PAGE_KERNEL_EXEC and the strict
> permissions are only enforced after /init starts. This leaves the kernel
> vulnerable from possible buggy built-in modules.
>
> Apply permissions to individual sections as early as possible.
>
> Signed-off-by: Atish Patra <atish.patra@wdc.com>
> ---
> arch/riscv/include/asm/set_memory.h | 2 ++
> arch/riscv/kernel/setup.c | 2 ++
> arch/riscv/mm/init.c | 11 +++++++++--
> 3 files changed, 13 insertions(+), 2 deletions(-)
>
> diff --git a/arch/riscv/include/asm/set_memory.h b/arch/riscv/include/asm/set_memory.h
> index 4c5bae7ca01c..4cc3a4e2afd3 100644
> --- a/arch/riscv/include/asm/set_memory.h
> +++ b/arch/riscv/include/asm/set_memory.h
> @@ -15,11 +15,13 @@ int set_memory_ro(unsigned long addr, int numpages);
> int set_memory_rw(unsigned long addr, int numpages);
> int set_memory_x(unsigned long addr, int numpages);
> int set_memory_nx(unsigned long addr, int numpages);
> +void protect_kernel_text_data(void);
> #else
> static inline int set_memory_ro(unsigned long addr, int numpages) { return 0; }
> static inline int set_memory_rw(unsigned long addr, int numpages) { return 0; }
> static inline int set_memory_x(unsigned long addr, int numpages) { return 0; }
> static inline int set_memory_nx(unsigned long addr, int numpages) { return 0; }
> +static inline void protect_kernel_text_data(void) {};
> #endif
>
> int set_direct_map_invalid_noflush(struct page *page);
> diff --git a/arch/riscv/kernel/setup.c b/arch/riscv/kernel/setup.c
> index 7d6a04ae3929..b722c5bf892c 100644
> --- a/arch/riscv/kernel/setup.c
> +++ b/arch/riscv/kernel/setup.c
> @@ -22,6 +22,7 @@
> #include <asm/cpu_ops.h>
> #include <asm/early_ioremap.h>
> #include <asm/setup.h>
> +#include <asm/set_memory.h>
> #include <asm/sections.h>
> #include <asm/sbi.h>
> #include <asm/tlbflush.h>
> @@ -92,6 +93,7 @@ void __init setup_arch(char **cmdline_p)
> #if IS_ENABLED(CONFIG_RISCV_SBI)
> sbi_init();
> #endif
> + protect_kernel_text_data();
> #ifdef CONFIG_SWIOTLB
> swiotlb_init(1);
> #endif
> diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
> index ea933b789a88..5f196f8158d4 100644
> --- a/arch/riscv/mm/init.c
> +++ b/arch/riscv/mm/init.c
> @@ -608,7 +608,7 @@ static inline void setup_vm_final(void)
> #endif /* CONFIG_MMU */
>
> #ifdef CONFIG_STRICT_KERNEL_RWX
> -void mark_rodata_ro(void)
> +void protect_kernel_text_data(void)
> {
> unsigned long text_start = (unsigned long)_text;
> unsigned long text_end = (unsigned long)_etext;
> @@ -617,9 +617,16 @@ void mark_rodata_ro(void)
> unsigned long max_low = (unsigned long)(__va(PFN_PHYS(max_low_pfn)));
>
A comment about that rodata permissions are set later would be nice
here.
> set_memory_ro(text_start, (text_end - text_start) >> PAGE_SHIFT);
> - set_memory_ro(rodata_start, (data_start - rodata_start) >> PAGE_SHIFT);
> set_memory_nx(rodata_start, (data_start - rodata_start) >> PAGE_SHIFT);
> set_memory_nx(data_start, (max_low - data_start) >> PAGE_SHIFT);
> +}
> +
> +void mark_rodata_ro(void)
> +{
> + unsigned long rodata_start = (unsigned long)__start_rodata;
> + unsigned long data_start = (unsigned long)_data;
> +
> + set_memory_ro(rodata_start, (data_start - rodata_start) >> PAGE_SHIFT);
>
> debug_checkwx();
> }
> --
> 2.25.1
>
--
Sincerely yours,
Mike.
_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv
next prev parent reply other threads:[~2020-10-27 10:01 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-26 23:02 [PATCH v2 0/6] Improve kernel section protections Atish Patra
2020-10-26 23:02 ` [PATCH v2 1/6] RISC-V: Move __start_kernel to .head.text Atish Patra
2020-10-26 23:02 ` [PATCH v2 2/6] RISC-V: Initialize SBI early Atish Patra
2020-10-27 10:04 ` Mike Rapoport
2020-10-27 18:38 ` Atish Patra
2020-10-26 23:02 ` [PATCH v2 3/6] RISC-V: Enforce protections for kernel sections early Atish Patra
2020-10-27 10:00 ` Mike Rapoport [this message]
2020-10-27 18:38 ` Atish Patra
2020-10-26 23:02 ` [PATCH v2 4/6] RISC-V: Align the .init.text section Atish Patra
2020-10-26 23:02 ` [PATCH v2 5/6] RISC-V: Protect .init.text & .init.data Atish Patra
2020-10-27 10:45 ` Mike Rapoport
2020-10-29 19:21 ` Atish Patra
2020-10-30 8:49 ` Mike Rapoport
2020-10-30 20:29 ` Atish Patra
2020-10-26 23:02 ` [PATCH v2 6/6] RISC-V: Move dynamic relocation section under __init Atish Patra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201027100040.GK1154158@kernel.org \
--to=rppt@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=anup@brainfault.org \
--cc=aou@eecs.berkeley.edu \
--cc=ardb@kernel.org \
--cc=atish.patra@wdc.com \
--cc=bp@suse.de \
--cc=greentime.hu@sifive.com \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-riscv@lists.infradead.org \
--cc=palmer@dabbelt.com \
--cc=paul.walmsley@sifive.com \
--cc=walken@google.com \
--cc=zong.li@sifive.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).