From patchwork Mon Apr 30 15:59:06 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeffrey Hugo X-Patchwork-Id: 10372019 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3BD6060384 for ; Mon, 30 Apr 2018 15:59:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2987A28B58 for ; Mon, 30 Apr 2018 15:59:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1D5BB28B5B; Mon, 30 Apr 2018 15:59:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,MAILING_LIST_MULTI autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 1AEDE28B58 for ; Mon, 30 Apr 2018 15:59:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:MIME-Version:Cc:List-Subscribe: List-Help:List-Post:List-Archive:List-Unsubscribe:List-Id:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To: References:List-Owner; bh=DeXlhwH3ubcaG766huz4R7OKhky66i19dWBGn1qDewA=; b=s/6 oTBuqlfoyMpJHT6XbNsrlHKc962/LxU1oPE9KRrOD/cNeF0TaROtlXZ2lM+IbqYKIL+bk1OZrIE6s CG8dxTpc9riR9K08oTz4VHMf7ZLSX3q79nsJEfai32GwrhpyXGKUU00LEbGF1QzOXMdOioDypzTua XXNExPIxc4ioMSiEUKvIh4LvlDVgxnSlSjPC+cerzQlxeWkWPhKQ11bqNpYKmVh1US/fgBqaP2ZCS QIDoHxC623U5RLjGShljnFb7+AoRgAyrPwdIJGWIr2szxUqHnY05eNdon0b3WmfX1CgpMVMXinD7z lgmFQwkp8g+hEH6dN0HeteJd4kvojsA==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.90_1 #2 (Red Hat Linux)) id 1fDBDK-0004UI-7w; Mon, 30 Apr 2018 15:59:42 +0000 Received: from smtp.codeaurora.org ([198.145.29.96]) by bombadil.infradead.org with esmtps (Exim 4.90_1 #2 (Red Hat Linux)) id 1fDBDC-0004KD-LY for linux-arm-kernel@lists.infradead.org; Mon, 30 Apr 2018 15:59:36 +0000 Received: by smtp.codeaurora.org (Postfix, from userid 1000) id 7A70F607CF; Mon, 30 Apr 2018 15:59:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1525103962; bh=7XxLOxQieNW4KYNtXfy4PdaxPA0eyJHWU6d03YHBE+4=; h=From:To:Cc:Subject:Date:From; b=o4Jk464IrM8WKzNC5Iph0Tjvq6x84266frgvsblA3nLlaTMEyw/7vd9fXbd/DDjXD uffiHDZaUmjXhmn9bXIGoYrvJdlr/SwN22VO9ycAbulfnldxYhXjOYn8+KYkc8aONQ opRLMr6LEYIeaJLOMwiBFKiq/7t1oDYZw6GftFKU= Received: from jhugo-perf-lnx.qualcomm.com (i-global254.qualcomm.com [199.106.103.254]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: jhugo@smtp.codeaurora.org) by smtp.codeaurora.org (Postfix) with ESMTPSA id 174BB60271; Mon, 30 Apr 2018 15:59:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=codeaurora.org; s=default; t=1525103961; bh=7XxLOxQieNW4KYNtXfy4PdaxPA0eyJHWU6d03YHBE+4=; h=From:To:Cc:Subject:Date:From; b=JX1mPTeh4FiRqZTjtyMHwlB446hL67PGrtPZcpMqMxbr0qdk6vmrLwZ0PKZIC8LWp Z0olaLkR3f4RV8Vv9u3psIFfDVf6Cw5p0+wXeANVFJQyihBD21XfkJCXFufDEMvVFN md8whNP6lAcbTCuEgqTqezzQ6Wch/mTbpbdrczKI= DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 174BB60271 Authentication-Results: pdx-caf-mail.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: pdx-caf-mail.web.codeaurora.org; spf=none smtp.mailfrom=jhugo@codeaurora.org From: Jeffrey Hugo To: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v3] init: Fix false positives in W+X checking Date: Mon, 30 Apr 2018 09:59:06 -0600 Message-Id: <1525103946-29526-1-git-send-email-jhugo@codeaurora.org> X-Mailer: git-send-email 1.9.1 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20180430_085934_799639_9BDB898A X-CRM114-Status: GOOD ( 13.79 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , Kees Cook , Ard Biesheuvel , Peter Zijlstra , Catalin Marinas , Timur Tabi , Will Deacon , Jan Glauber , Jeffrey Hugo , Thomas Gleixner , Andrew Morton , Laura Abbott , Stephen Smalley , Ingo Molnar MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP load_module() creates W+X mappings via __vmalloc_node_range() (from layout_and_allocate()->move_module()->module_alloc()) by using PAGE_KERNEL_EXEC. These mappings are later cleaned up via "call_rcu_sched(&freeinit->rcu, do_free_init)" from do_init_module(). This is a problem because call_rcu_sched() queues work, which can be run after debug_checkwx() is run, resulting in a race condition. If hit, the race results in a nasty splat about insecure W+X mappings, which results in a poor user experience as these are not the mappings that debug_checkwx() is intended to catch. This issue is observed on multiple arm64 platforms, and has been artificially triggered on an x86 platform. Address the race by flushing the queued work before running the arch-defined mark_rodata_ro() which then calls debug_checkwx(). Reported-by: Timur Tabi Reported-by: Jan Glauber Fixes: e1a58320a38d ("x86/mm: Warn on W^X mappings") Signed-off-by: Jeffrey Hugo Acked-by: Kees Cook Acked-by: Ingo Molnar Acked-by: Will Deacon Acked-by: Laura Abbott --- v3: -added comment to module code to establish matching connection -added acks by Kees, Ingo, and Will v2: -was "arm64: mm: Fix false positives in W+X checking" (see [1]) -moved to common code based on review and confirmation of issue on x86 [1] http://lists.infradead.org/pipermail/linux-arm-kernel/2018-April/573776.html init/main.c | 7 +++++++ kernel/module.c | 5 +++++ 2 files changed, 12 insertions(+) diff --git a/init/main.c b/init/main.c index b795aa3..499d957 100644 --- a/init/main.c +++ b/init/main.c @@ -1034,6 +1034,13 @@ static int __init set_debug_rodata(char *str) static void mark_readonly(void) { if (rodata_enabled) { + /* + * load_module() results in W+X mappings, which are cleaned up + * with call_rcu_sched(). Let's make sure that queued work is + * flushed so that we don't hit false positives looking for + * insecure pages which are W+X. + */ + rcu_barrier_sched(); mark_rodata_ro(); rodata_test(); } else diff --git a/kernel/module.c b/kernel/module.c index a6e43a5..7b71c3c 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3516,6 +3516,11 @@ static noinline int do_init_module(struct module *mod) * walking this with preempt disabled. In all the failure paths, we * call synchronize_sched(), but we don't want to slow down the success * path, so use actual RCU here. + * Note that module_alloc() on most architectures creates W+X page + * mappings which won't be cleaned up until do_free_init() runs. Any + * code such as mark_rodata_ro() which depends on those mappings to + * be cleaned up needs to sync with the queued work - ie + * rcu_barrier_sched() */ call_rcu_sched(&freeinit->rcu, do_free_init); mutex_unlock(&module_mutex);