From: Sasha Levin <Alexander.Levin@microsoft.com>
To: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"stable@vger.kernel.org" <stable@vger.kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>,
Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>,
Borislav Petkov <bp@alien8.de>, Brian Gerst <brgerst@gmail.com>,
"David S . Miller" <davem@davemloft.net>,
Denys Vlasenko <dvlasenk@redhat.com>,
"H . Peter Anvin" <hpa@zytor.com>,
Josh Poimboeuf <jpoimboe@redhat.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Peter Zijlstra <peterz@infradead.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ye Xiaolong <xiaolong.ye@intel.com>,
Ingo Molnar <mingo@kernel.org>,
Sasha Levin <Alexander.Levin@microsoft.com>
Subject: [PATCH AUTOSEL for 3.18 06/53] kprobes/x86: Set kprobes pages read-only
Date: Thu, 8 Mar 2018 05:03:08 +0000 [thread overview]
Message-ID: <20180308050230.8876-6-alexander.levin@microsoft.com> (raw)
In-Reply-To: <20180308050230.8876-1-alexander.levin@microsoft.com>
From: Masami Hiramatsu <mhiramat@kernel.org>
[ Upstream commit d0381c81c2f782fa2131178d11e0cfb23d50d631 ]
Set the pages which is used for kprobes' singlestep buffer
and optprobe's trampoline instruction buffer to readonly.
This can prevent unexpected (or unintended) instruction
modification.
This also passes rodata_test as below.
Without this patch, rodata_test shows a warning:
WARNING: CPU: 0 PID: 1 at arch/x86/mm/dump_pagetables.c:235 note_page+0x7a9/0xa20
x86/mm: Found insecure W+X mapping at address ffffffffa0000000/0xffffffffa0000000
With this fix, no W+X pages are found:
x86/mm: Checked W+X mappings: passed, no W+X pages found.
rodata_test: all tests were successful
Reported-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Ananth N Mavinakayanahalli <ananth@linux.vnet.ibm.com>
Cc: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: David S . Miller <davem@davemloft.net>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Ye Xiaolong <xiaolong.ye@intel.com>
Link: http://lkml.kernel.org/r/149076375592.22469.14174394514338612247.stgit@devbox
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
---
arch/x86/kernel/kprobes/core.c | 4 ++++
arch/x86/kernel/kprobes/opt.c | 3 +++
2 files changed, 7 insertions(+)
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 422b76ab0374..78f221ab8593 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -378,6 +378,8 @@ static int arch_copy_kprobe(struct kprobe *p)
{
int ret;
+ set_memory_rw((unsigned long)p->ainsn.insn & PAGE_MASK, 1);
+
/* Copy an instruction with recovering if other optprobe modifies it.*/
ret = __copy_instruction(p->ainsn.insn, p->addr);
if (!ret)
@@ -392,6 +394,8 @@ static int arch_copy_kprobe(struct kprobe *p)
else
p->ainsn.boostable = -1;
+ set_memory_ro((unsigned long)p->ainsn.insn & PAGE_MASK, 1);
+
/* Check whether the instruction modifies Interrupt Flag or not */
p->ainsn.if_modifier = is_IF_modifier(p->ainsn.insn);
diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c
index cdb672c3049b..aec5dfa8b7e1 100644
--- a/arch/x86/kernel/kprobes/opt.c
+++ b/arch/x86/kernel/kprobes/opt.c
@@ -344,6 +344,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
}
buf = (u8 *)op->optinsn.insn;
+ set_memory_rw((unsigned long)buf & PAGE_MASK, 1);
/* Copy instructions into the out-of-line buffer */
ret = copy_optimized_instructions(buf + TMPL_END_IDX, op->kp.addr);
@@ -366,6 +367,8 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op)
synthesize_reljump(buf + TMPL_END_IDX + op->optinsn.size,
(u8 *)op->kp.addr + op->optinsn.size);
+ set_memory_ro((unsigned long)buf & PAGE_MASK, 1);
+
flush_icache_range((unsigned long) buf,
(unsigned long) buf + TMPL_END_IDX +
op->optinsn.size + RELATIVEJUMP_SIZE);
--
2.14.1
next prev parent reply other threads:[~2018-03-08 5:18 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-08 5:03 [PATCH AUTOSEL for 3.18 01/53] usb: gadget: dummy_hcd: Fix wrong power status bit clear/reset in dummy_hub_control() Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 02/53] perf session: Don't rely on evlist in pipe mode Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 03/53] scsi: sg: check for valid direction before starting the request Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 04/53] scsi: sg: close race condition in sg_remove_sfp_usercontext() Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 05/53] kprobes/x86: Fix kprobe-booster not to boost far call instructions Sasha Levin
2018-03-08 5:03 ` Sasha Levin [this message]
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 07/53] wil6210: fix memory access violation in wil_memcpy_from/toio_32 Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 08/53] platform/x86: asus-nb-wmi: Add wapf4 quirk for the X302UA Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 09/53] x86: i8259: export legacy_pic symbol Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 10/53] Input: ar1021_i2c - fix too long name in driver's device table Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 11/53] ACPI/processor: Replace racy task affinity logic Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 12/53] cpufreq/sh: " Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 13/53] genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 14/53] i2c: i2c-scmi: add a MS HID Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 16/53] [media] media/dvb-core: Race condition when writing to CAM Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 15/53] net: ipv6: send unsolicited NA on admin up Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 17/53] spi: dw: Disable clock after unregistering the host Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 18/53] ath: Fix updating radar flags for coutry code India Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 20/53] KVM: PPC: Book3S PR: Exit KVM on failed mapping Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 21/53] tcp: remove poll() flakes with FastOpen Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 19/53] scsi: virtio_scsi: Always try to read VPD pages Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 22/53] e1000e: fix timing for 82579 Gigabit Ethernet controller Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 23/53] ALSA: hda - Fix headset microphone detection for ASUS N551 and N751 Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 25/53] HSI: ssi_protocol: double free in ssip_pn_xmit() Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 24/53] IB/ipoib: Update broadcast object if PKey value was changed in index 0 Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 27/53] mmc: host: omap_hsmmc: checking for NULL instead of IS_ERR() Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 26/53] Fix driver usage of 128B WQEs when WQ_CREATE is V1 Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 29/53] qlcnic: fix unchecked return value Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 28/53] wan: pc300too: abort path on failure Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 32/53] Btrfs: send, fix file hole not being preserved due to inline extent Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 31/53] rndis_wlan: add return value validation Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 30/53] scsi: mac_esp: Replace bogus memory barrier with spinlock Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 34/53] mfd: palmas: Reset the POWERHOLD mux during power off Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 33/53] mac80211: don't parse encrypted management frames in ieee80211_frame_acked Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 35/53] ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 36/53] ipmi/watchdog: fix wdog hang on panic waiting for ipmi response Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 37/53] bnx2x: Align RX buffers Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 38/53] power: supply: pda_power: move from timer to delayed_work Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 39/53] md/raid10: skip spare disk as 'first' disk Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 40/53] ia64: fix module loading for gcc-5.4 Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 42/53] sm501fb: don't return zero on failure path in sm501fb_start() Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 41/53] video: fbdev: udlfb: Fix buffer on stack Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 44/53] drm/msm: fix leak in failed get_pages Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 43/53] cifs: small underflow in cnvrtDosUnixTm() Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 46/53] media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 45/53] media: bt8xx: Fix err 'bt878_probe()' Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 48/53] IB/ipoib: Avoid memory leak if the SA returns a different DGID Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 47/53] mmc: avoid removing non-removable hosts during suspend Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 51/53] drm/omap: DMM: Check for DMM readiness after successful transaction commit Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 49/53] RDMA/cma: Use correct size when writing netlink stats Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 50/53] vgacon: Set VGA struct resource types Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 52/53] pinctrl: Really force states during suspend/resume Sasha Levin
2018-03-08 5:03 ` [PATCH AUTOSEL for 3.18 53/53] clk: si5351: Rename internal plls to avoid name collisions Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180308050230.8876-6-alexander.levin@microsoft.com \
--to=alexander.levin@microsoft.com \
--cc=ananth@linux.vnet.ibm.com \
--cc=anil.s.keshavamurthy@intel.com \
--cc=bp@alien8.de \
--cc=brgerst@gmail.com \
--cc=davem@davemloft.net \
--cc=dvlasenk@redhat.com \
--cc=hpa@zytor.com \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=xiaolong.ye@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).