From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andrew Morton Subject: + mm-add-debug_wx-support.patch added to -mm tree Date: Sat, 25 Apr 2020 18:06:00 -0700 Message-ID: <20200426010600.bYaJShBi_%akpm@linux-foundation.org> References: <20200420181310.c18b3c0aa4dc5b3e5ec1be10@linux-foundation.org> Reply-To: linux-kernel@vger.kernel.org Return-path: Received: from mail.kernel.org ([198.145.29.99]:41108 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725962AbgDZBGD (ORCPT ); Sat, 25 Apr 2020 21:06:03 -0400 In-Reply-To: <20200420181310.c18b3c0aa4dc5b3e5ec1be10@linux-foundation.org> Sender: mm-commits-owner@vger.kernel.org List-Id: mm-commits@vger.kernel.org To: bp@alien8.de, catalin.marinas@arm.com, hpa@zytor.com, mingo@redhat.com, mm-commits@vger.kernel.org, palmer@dabbelt.com, paul.walmsley@sifive.com, tglx@linutronix.de, will@kernel.org, zong.li@sifive.com The patch titled Subject: mm: add DEBUG_WX support has been added to the -mm tree. Its filename is mm-add-debug_wx-support.patch This patch should soon appear at http://ozlabs.org/~akpm/mmots/broken-out/mm-add-debug_wx-support.patch and later at http://ozlabs.org/~akpm/mmotm/broken-out/mm-add-debug_wx-support.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next and is updated there every 3-4 working days ------------------------------------------------------ From: Zong Li Subject: mm: add DEBUG_WX support Patch series "Extract DEBUG_WX to shared use". Some architectures support DEBUG_WX function, it's verbatim from each others, so extract to mm/Kconfig.debug for shared use. PPC and ARM ports don't support generic page dumper yet, so we only refine x86 and arm64 port in this patch series. For RISC-V port, the DEBUG_WX support depends on other patches which be merged already: - RISC-V page table dumper - Support strict kernel memory permissions for security This patch (of 4): Some architectures support DEBUG_WX function, it's verbatim from each others. Extract to mm/Kconfig.debug for shared use. Link: http://lkml.kernel.org/r/cover.1587455584.git.zong.li@sifive.com Link: http://lkml.kernel.org/r/23980cd0f0e5d79e24a92169116407c75bcc650d.1587455584.git.zong.li@sifive.com Signed-off-by: Zong Li Suggested-by: Palmer Dabbelt Cc: Paul Walmsley Cc: Thomas Gleixner Cc: Ingo Molnar Cc: Borislav Petkov Cc: "H. Peter Anvin" Cc: Catalin Marinas Cc: Will Deacon Signed-off-by: Andrew Morton --- mm/Kconfig.debug | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) --- a/mm/Kconfig.debug~mm-add-debug_wx-support +++ a/mm/Kconfig.debug @@ -118,6 +118,39 @@ config DEBUG_RODATA_TEST ---help--- This option enables a testcase for the setting rodata read-only. +config ARCH_HAS_DEBUG_WX + bool + +config DEBUG_WX + bool "Warn on W+X mappings at boot" + depends on ARCH_HAS_DEBUG_WX + select PTDUMP_CORE + help + Generate a warning if any W+X mappings are found at boot. + + This is useful for discovering cases where the kernel is leaving + W+X mappings after applying NX, as such mappings are a security risk. + This check also includes UXN, which should be set on all kernel + mappings. + + Look for a message in dmesg output like this: + + /mm: Checked W+X mappings: passed, no W+X pages found. + + or like this, if the check failed: + + /mm: Checked W+X mappings: failed, W+X pages found. + + Note that even if the check fails, your kernel is possibly + still fine, as W+X mappings are not a security hole in + themselves, what they do is that they make the exploitation + of other unfixed kernel bugs easier. + + There is no runtime or memory usage effect of this option + once the kernel has booted up - it's a one time check. + + If in doubt, say "Y". + config GENERIC_PTDUMP bool _ Patches currently in -mm which might be from zong.li@sifive.com are mm-add-debug_wx-support.patch riscv-support-debug_wx.patch x86-mm-use-arch_has_debug_wx-instead-of-arch-defined.patch arm64-mm-use-arch_has_debug_wx-instead-of-arch-defined.patch