All of lore.kernel.org
 help / color / mirror / Atom feed
From: Rick Edgecombe <rick.p.edgecombe@intel.com>
To: Borislav Petkov <bp@alien8.de>, Andy Lutomirski <luto@kernel.org>,
	Ingo Molnar <mingo@redhat.com>
Cc: linux-kernel@vger.kernel.org, x86@kernel.org, hpa@zytor.com,
	Thomas Gleixner <tglx@linutronix.de>,
	Nadav Amit <nadav.amit@gmail.com>,
	Dave Hansen <dave.hansen@linux.intel.com>,
	Peter Zijlstra <peterz@infradead.org>,
	linux_dti@icloud.com, linux-integrity@vger.kernel.org,
	linux-security-module@vger.kernel.org, akpm@linux-foundation.org,
	kernel-hardening@lists.openwall.com, linux-mm@kvack.org,
	will.deacon@arm.com, ard.biesheuvel@linaro.org,
	kristen@linux.intel.com, deneen.t.dock@intel.com,
	Nadav Amit <namit@vmware.com>,
	Rick Edgecombe <rick.p.edgecombe@intel.com>
Subject: [PATCH v4 09/23] x86/ftrace: Set trampoline pages as executable
Date: Mon, 22 Apr 2019 11:57:51 -0700	[thread overview]
Message-ID: <20190422185805.1169-10-rick.p.edgecombe@intel.com> (raw)
In-Reply-To: <20190422185805.1169-1-rick.p.edgecombe@intel.com>

From: Nadav Amit <namit@vmware.com>

Since alloc_module() will not set the pages as executable soon, set
ftrace trampoline pages as executable after they are allocated.

For the time being, do not change ftrace to use the text_poke()
interface. As a result, ftrace still breaks W^X.

Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Nadav Amit <namit@vmware.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
---
 arch/x86/kernel/ftrace.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index ef49517f6bb2..53ba1aa3a01f 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -730,6 +730,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
 	unsigned long end_offset;
 	unsigned long op_offset;
 	unsigned long offset;
+	unsigned long npages;
 	unsigned long size;
 	unsigned long retq;
 	unsigned long *ptr;
@@ -762,6 +763,7 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
 		return 0;
 
 	*tramp_size = size + RET_SIZE + sizeof(void *);
+	npages = DIV_ROUND_UP(*tramp_size, PAGE_SIZE);
 
 	/* Copy ftrace_caller onto the trampoline memory */
 	ret = probe_kernel_read(trampoline, (void *)start_offset, size);
@@ -806,6 +808,12 @@ create_trampoline(struct ftrace_ops *ops, unsigned int *tramp_size)
 	/* ALLOC_TRAMP flags lets us know we created it */
 	ops->flags |= FTRACE_OPS_FL_ALLOC_TRAMP;
 
+	/*
+	 * Module allocation needs to be completed by making the page
+	 * executable. The page is still writable, which is a security hazard,
+	 * but anyhow ftrace breaks W^X completely.
+	 */
+	set_memory_x((unsigned long)trampoline, npages);
 	return (unsigned long)trampoline;
 fail:
 	tramp_free(trampoline, *tramp_size);
-- 
2.17.1


  parent reply	other threads:[~2019-04-22 19:00 UTC|newest]

Thread overview: 38+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-04-22 18:57 [PATCH v4 00/23] Merge text_poke fixes and executable lockdowns Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 01/23] Fix "x86/alternatives: Lockdep-enforce text_mutex in text_poke*()" Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 02/23] x86/jump_label: Use text_poke_early() during early init Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 03/23] x86/mm: Introduce temporary mm structs Rick Edgecombe
2019-04-25 16:26   ` Borislav Petkov
2019-04-25 17:37     ` Nadav Amit
2019-04-25 17:49       ` Andy Lutomirski
2019-04-25 17:49         ` Andy Lutomirski
2019-04-22 18:57 ` [PATCH v4 04/23] x86/mm: Save DRs when loading a temporary mm Rick Edgecombe
2019-04-25 16:36   ` Borislav Petkov
2019-04-25 18:17   ` Peter Zijlstra
2019-04-22 18:57 ` [PATCH v4 05/23] fork: Provide a function for copying init_mm Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 06/23] x86/alternative: Initialize temporary mm for patching Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 07/23] x86/alternative: Use temporary mm for text poking Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 08/23] x86/kgdb: Avoid redundant comparison of patched code Rick Edgecombe
2019-04-22 18:57 ` Rick Edgecombe [this message]
2019-04-22 18:57 ` [PATCH v4 10/23] x86/kprobes: Set instruction page as executable Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 11/23] x86/module: Avoid breaking W^X while loading modules Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 12/23] x86/jump-label: Remove support for custom poker Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 13/23] x86/alternative: Remove the return value of text_poke_*() Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 14/23] x86/mm/cpa: Add set_direct_map_ functions Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 15/23] mm: Make hibernate handle unmapped pages Rick Edgecombe
2019-04-22 18:57 ` [PATCH v4 16/23] vmalloc: Add flag for free of special permsissions Rick Edgecombe
2019-04-25 20:38   ` Peter Zijlstra
2019-04-25 21:22     ` Edgecombe, Rick P
2019-04-25 21:22       ` Edgecombe, Rick P
2019-04-22 18:57 ` [PATCH v4 17/23] modules: Use vmalloc special flag Rick Edgecombe
2019-04-22 18:58 ` [PATCH v4 18/23] bpf: " Rick Edgecombe
2019-04-22 18:58 ` [PATCH v4 19/23] x86/ftrace: " Rick Edgecombe
2019-04-25 18:28   ` Steven Rostedt
2019-04-25 19:19     ` Edgecombe, Rick P
2019-04-25 19:19       ` Edgecombe, Rick P
2019-04-22 18:58 ` [PATCH v4 20/23] x86/kprobes: " Rick Edgecombe
2019-04-22 18:58 ` [PATCH v4 21/23] x86/alternative: Comment about module removal races Rick Edgecombe
2019-04-22 18:58 ` [PATCH v4 22/23] tlb: provide default nmi_uaccess_okay() Rick Edgecombe
2019-04-22 18:58 ` [PATCH v4 23/23] bpf: Fail bpf_probe_write_user() while mm is switched Rick Edgecombe
2019-04-25 20:48 ` [PATCH v4 00/23] Merge text_poke fixes and executable lockdowns Peter Zijlstra
2019-04-25 20:49   ` Peter Zijlstra

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190422185805.1169-10-rick.p.edgecombe@intel.com \
    --to=rick.p.edgecombe@intel.com \
    --cc=akpm@linux-foundation.org \
    --cc=ard.biesheuvel@linaro.org \
    --cc=bp@alien8.de \
    --cc=dave.hansen@linux.intel.com \
    --cc=deneen.t.dock@intel.com \
    --cc=hpa@zytor.com \
    --cc=kernel-hardening@lists.openwall.com \
    --cc=kristen@linux.intel.com \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mm@kvack.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=linux_dti@icloud.com \
    --cc=luto@kernel.org \
    --cc=mingo@redhat.com \
    --cc=nadav.amit@gmail.com \
    --cc=namit@vmware.com \
    --cc=peterz@infradead.org \
    --cc=tglx@linutronix.de \
    --cc=will.deacon@arm.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.