[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[Philip Derrin]

Hi,

This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
merged in 3.19.

The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
sections to be read-only"), and another that moved the LPAE read-only bit into
a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
logic for LPAE").

The incorrect mappings were not apparent in the debugfs kernel_page_tables
dump because that was checking only the software RO bit, not the hardware RO
bit.

Regards,
Philip


Philip Derrin (2):
  ARM: mm: make STRICT_KERNEL_RWX effective for LPAE
  ARM: mm: dump: check hardware RO bit for LPAE

 arch/arm/mm/dump.c | 4 ++--
 arch/arm/mm/init.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

-- 
2.15.0

[PATCH 1/2] ARM: mm: make STRICT_KERNEL_RWX effective for LPAE

[Philip Derrin]

Currently, for ARM kernels with CONFIG_ARM_LPAE and
CONFIG_STRICT_KERNEL_RWX enabled, the 2MiB pages mapping the
kernel code and rodata are writable. They are marked read-only in
a software bit (L_PMD_SECT_RDONLY) but the hardware read-only bit
is not set (PMD_SECT_AP2).

For user mappings, the logic that propagates the software bit
to the hardware bit is in set_pmd_at(); but for the kernel,
section_update() writes the PMDs directly, skipping this logic.

The fix is to set PMD_SECT_AP2 for read-only sections in
section_update(), at the same time as L_PMD_SECT_RDONLY.

Fixes: 1e3479225acb ("ARM: 8275/1: mm: fix PMD_SECT_RDONLY undeclared compile error")
Signed-off-by: Philip Derrin <philip@cog.systems>
Reported-by: Neil Dick <neil@cog.systems>
Tested-by: Neil Dick <neil@cog.systems>
Tested-by: Laura Abbott <labbott@redhat.com>
Cc: stable@vger.kernel.org
---
 arch/arm/mm/init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index ad80548325fe..0f6d1537f330 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -639,8 +639,8 @@ static struct section_perm ro_perms[] = {
 		.start  = (unsigned long)_stext,
 		.end    = (unsigned long)__init_begin,
 #ifdef CONFIG_ARM_LPAE
-		.mask   = ~L_PMD_SECT_RDONLY,
-		.prot   = L_PMD_SECT_RDONLY,
+		.mask   = ~(L_PMD_SECT_RDONLY | PMD_SECT_AP2),
+		.prot   = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
 #else
 		.mask   = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
 		.prot   = PMD_SECT_APX | PMD_SECT_AP_WRITE,
-- 
2.15.0

[PATCH 1/2] ARM: mm: make STRICT_KERNEL_RWX effective for LPAE

[Philip Derrin]

Currently, for ARM kernels with CONFIG_ARM_LPAE and
CONFIG_STRICT_KERNEL_RWX enabled, the 2MiB pages mapping the
kernel code and rodata are writable. They are marked read-only in
a software bit (L_PMD_SECT_RDONLY) but the hardware read-only bit
is not set (PMD_SECT_AP2).

For user mappings, the logic that propagates the software bit
to the hardware bit is in set_pmd_at(); but for the kernel,
section_update() writes the PMDs directly, skipping this logic.

The fix is to set PMD_SECT_AP2 for read-only sections in
section_update(), at the same time as L_PMD_SECT_RDONLY.

Fixes: 1e3479225acb ("ARM: 8275/1: mm: fix PMD_SECT_RDONLY undeclared compile error")
Signed-off-by: Philip Derrin <philip@cog.systems>
Reported-by: Neil Dick <neil@cog.systems>
Tested-by: Neil Dick <neil@cog.systems>
Tested-by: Laura Abbott <labbott@redhat.com>
Cc: stable at vger.kernel.org
---
 arch/arm/mm/init.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index ad80548325fe..0f6d1537f330 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -639,8 +639,8 @@ static struct section_perm ro_perms[] = {
 		.start  = (unsigned long)_stext,
 		.end    = (unsigned long)__init_begin,
 #ifdef CONFIG_ARM_LPAE
-		.mask   = ~L_PMD_SECT_RDONLY,
-		.prot   = L_PMD_SECT_RDONLY,
+		.mask   = ~(L_PMD_SECT_RDONLY | PMD_SECT_AP2),
+		.prot   = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
 #else
 		.mask   = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
 		.prot   = PMD_SECT_APX | PMD_SECT_AP_WRITE,
-- 
2.15.0

[PATCH 2/2] ARM: mm: dump: check hardware RO bit for LPAE

When CONFIG_ARM_LPAE is set, the PMD dump relies on the software
read-only bit to determine whether a page is writable. This
concealed a bug which left the kernel text section writable
(AP2=0) while marked read-only in the software bit.

In a kernel with the AP2 bug, the dump looks like this:

    ---[ Kernel Mapping ]---
    0xc0000000-0xc0200000           2M RW NX SHD
    0xc0200000-0xc0600000           4M ro x  SHD
    0xc0600000-0xc0800000           2M ro NX SHD
    0xc0800000-0xc4800000          64M RW NX SHD

The fix is to check that the software and hardware bits are both
set before displaying "ro". The dump then shows the true perms:

    ---[ Kernel Mapping ]---
    0xc0000000-0xc0200000           2M RW NX SHD
    0xc0200000-0xc0600000           4M RW x  SHD
    0xc0600000-0xc0800000           2M RW NX SHD
    0xc0800000-0xc4800000          64M RW NX SHD

Fixes: ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write logic for LPAE")
Signed-off-by: Philip Derrin <philip@cog.systems>
Tested-by: Neil Dick <neil@cog.systems>
Cc: stable@vger.kernel.org
---
 arch/arm/mm/dump.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index 35ff45470dbf..fc3b44028cfb 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -129,8 +129,8 @@ static const struct prot_bits section_bits[] = {
 		.val	= PMD_SECT_USER,
 		.set	= "USR",
 	}, {
-		.mask	= L_PMD_SECT_RDONLY,
-		.val	= L_PMD_SECT_RDONLY,
+		.mask	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+		.val	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
 		.set	= "ro",
 		.clear	= "RW",
 #elif __LINUX_ARM_ARCH__ >= 6
-- 
2.15.0

[PATCH 2/2] ARM: mm: dump: check hardware RO bit for LPAE

[Philip Derrin]

When CONFIG_ARM_LPAE is set, the PMD dump relies on the software
read-only bit to determine whether a page is writable. This
concealed a bug which left the kernel text section writable
(AP2=0) while marked read-only in the software bit.

In a kernel with the AP2 bug, the dump looks like this:

    ---[ Kernel Mapping ]---
    0xc0000000-0xc0200000           2M RW NX SHD
    0xc0200000-0xc0600000           4M ro x  SHD
    0xc0600000-0xc0800000           2M ro NX SHD
    0xc0800000-0xc4800000          64M RW NX SHD

The fix is to check that the software and hardware bits are both
set before displaying "ro". The dump then shows the true perms:

    ---[ Kernel Mapping ]---
    0xc0000000-0xc0200000           2M RW NX SHD
    0xc0200000-0xc0600000           4M RW x  SHD
    0xc0600000-0xc0800000           2M RW NX SHD
    0xc0800000-0xc4800000          64M RW NX SHD

Fixes: ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write logic for LPAE")
Signed-off-by: Philip Derrin <philip@cog.systems>
Tested-by: Neil Dick <neil@cog.systems>
Cc: stable at vger.kernel.org
---
 arch/arm/mm/dump.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index 35ff45470dbf..fc3b44028cfb 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -129,8 +129,8 @@ static const struct prot_bits section_bits[] = {
 		.val	= PMD_SECT_USER,
 		.set	= "USR",
 	}, {
-		.mask	= L_PMD_SECT_RDONLY,
-		.val	= L_PMD_SECT_RDONLY,
+		.mask	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+		.val	= L_PMD_SECT_RDONLY | PMD_SECT_AP2,
 		.set	= "ro",
 		.clear	= "RW",
 #elif __LINUX_ARM_ARCH__ >= 6
-- 
2.15.0

[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[Kees Cook]

On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
> Hi,
>
> This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> merged in 3.19.
>
> The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> sections to be read-only"), and another that moved the LPAE read-only bit into
> a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> logic for LPAE").
>
> The incorrect mappings were not apparent in the debugfs kernel_page_tables
> dump because that was checking only the software RO bit, not the hardware RO
> bit.

Thanks for catching this! Please consider both patches:

Reviewed-by: Kees Cook <keescook@chromium.org>

-Kees

>
> Regards,
> Philip
>
>
> Philip Derrin (2):
>   ARM: mm: make STRICT_KERNEL_RWX effective for LPAE
>   ARM: mm: dump: check hardware RO bit for LPAE
>
>  arch/arm/mm/dump.c | 4 ++--
>  arch/arm/mm/init.c | 4 ++--
>  2 files changed, 4 insertions(+), 4 deletions(-)
>
> --
> 2.15.0
>



-- 
Kees Cook
Pixel Security

[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[Russell King - ARM Linux]

On Wed, Nov 08, 2017 at 05:23:43PM -0800, Kees Cook wrote:
> On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
> > Hi,
> >
> > This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> > when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> > mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> > merged in 3.19.
> >
> > The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> > mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> > implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> > sections to be read-only"), and another that moved the LPAE read-only bit into
> > a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> > logic for LPAE").
> >
> > The incorrect mappings were not apparent in the debugfs kernel_page_tables
> > dump because that was checking only the software RO bit, not the hardware RO
> > bit.
> 
> Thanks for catching this! Please consider both patches:
> 
> Reviewed-by: Kees Cook <keescook@chromium.org>

Where are these patches, and why weren't they copied to the arm kernel
list?

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up

[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[Baruch Siach]

Hi Russell,

On Thu, Nov 09, 2017 at 09:37:34AM +0000, Russell King - ARM Linux wrote:
> On Wed, Nov 08, 2017 at 05:23:43PM -0800, Kees Cook wrote:
> > On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
> > > Hi,
> > >
> > > This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> > > when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> > > mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> > > merged in 3.19.
> > >
> > > The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> > > mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> > > implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> > > sections to be read-only"), and another that moved the LPAE read-only bit into
> > > a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> > > logic for LPAE").
> > >
> > > The incorrect mappings were not apparent in the debugfs kernel_page_tables
> > > dump because that was checking only the software RO bit, not the hardware RO
> > > bit.
> > 
> > Thanks for catching this! Please consider both patches:
> > 
> > Reviewed-by: Kees Cook <keescook@chromium.org>
> 
> Where are these patches, and why weren't they copied to the arm kernel
> list?

I got the patches from the list.

  Cover:
  http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541532.html
  1/2:
  http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541531.html
  2/2:
  http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541533.html

baruch

-- 
     http://baruch.siach.name/blog/                  ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -

[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[Russell King - ARM Linux]

On Thu, Nov 09, 2017 at 11:49:20AM +0200, Baruch Siach wrote:
> Hi Russell,
> 
> On Thu, Nov 09, 2017 at 09:37:34AM +0000, Russell King - ARM Linux wrote:
> > On Wed, Nov 08, 2017 at 05:23:43PM -0800, Kees Cook wrote:
> > > On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
> > > > Hi,
> > > >
> > > > This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> > > > when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> > > > mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> > > > merged in 3.19.
> > > >
> > > > The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> > > > mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> > > > implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> > > > sections to be read-only"), and another that moved the LPAE read-only bit into
> > > > a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> > > > logic for LPAE").
> > > >
> > > > The incorrect mappings were not apparent in the debugfs kernel_page_tables
> > > > dump because that was checking only the software RO bit, not the hardware RO
> > > > bit.
> > > 
> > > Thanks for catching this! Please consider both patches:
> > > 
> > > Reviewed-by: Kees Cook <keescook@chromium.org>
> > 
> > Where are these patches, and why weren't they copied to the arm kernel
> > list?
> 
> I got the patches from the list.
> 
>   Cover:
>   http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541532.html
>   1/2:
>   http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541531.html
>   2/2:
>   http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541533.html

Ah, dspam decided they were spam, so they ended up in one of my junk
mailboxes.

-- 
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up

[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[Philip Derrin]

On 09/11/17 20:37, Russell King - ARM Linux wrote:
> On Wed, Nov 08, 2017 at 05:23:43PM -0800, Kees Cook wrote:
>> On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
>>> Hi,
>>>
>>> This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
>>> when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
>>> mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
>>> merged in 3.19.
>>>
>>> The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
>>> mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
>>> implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
>>> sections to be read-only"), and another that moved the LPAE read-only bit into
>>> a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
>>> logic for LPAE").
>>>
>>> The incorrect mappings were not apparent in the debugfs kernel_page_tables
>>> dump because that was checking only the software RO bit, not the hardware RO
>>> bit.
>> Thanks for catching this! Please consider both patches:
>>
>> Reviewed-by: Kees Cook <keescook@chromium.org>
> Where are these patches, and why weren't they copied to the arm kernel
> list?

I've added these to the patch tracker, as 8721/1 and 8722/1.

Thanks,
Philip

[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[Florian Fainelli]

On 11/08/2017 04:41 PM, Philip Derrin wrote:
> Hi,
> 
> This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> merged in 3.19.
> 
> The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> sections to be read-only"), and another that moved the LPAE read-only bit into
> a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> logic for LPAE").
> 
> The incorrect mappings were not apparent in the debugfs kernel_page_tables
> dump because that was checking only the software RO bit, not the hardware RO
> bit.

FWIW, on an ARCH_BRCMSTB system with ARM_LPAE=y:

Tested-by: Florian Fainelli <f.fainelli@gmail.com>
-- 
Florian

[PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y

[Kees Cook]

On Mon, Nov 20, 2017 at 10:45 AM, Florian Fainelli <f.fainelli@gmail.com> wrote:
> On 11/08/2017 04:41 PM, Philip Derrin wrote:
>> Hi,
>>
>> This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
>> when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
>> mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
>> merged in 3.19.
>>
>> The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
>> mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
>> implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
>> sections to be read-only"), and another that moved the LPAE read-only bit into
>> a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
>> logic for LPAE").
>>
>> The incorrect mappings were not apparent in the debugfs kernel_page_tables
>> dump because that was checking only the software RO bit, not the hardware RO
>> bit.
>
> FWIW, on an ARCH_BRCMSTB system with ARM_LPAE=y:
>
> Tested-by: Florian Fainelli <f.fainelli@gmail.com>

Russell, given this fixes an accidentally broken feature, is there any
hope for this series to land in v4.15?

Thanks!

-Kees

-- 
Kees Cook
Pixel Security