From patchwork Thu Sep 29 21:32:57 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Laura Abbott X-Patchwork-Id: 9357145 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 2BCE860757 for ; Thu, 29 Sep 2016 21:35:55 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1CC4229C64 for ; Thu, 29 Sep 2016 21:35:55 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 115EA29C68; Thu, 29 Sep 2016 21:35:55 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=unavailable version=3.3.1 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.9]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 989A829C64 for ; Thu, 29 Sep 2016 21:35:54 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.85_2 #1 (Red Hat Linux)) id 1bpiyW-0003fP-Tc; Thu, 29 Sep 2016 21:34:40 +0000 Received: from mail-pa0-f44.google.com ([209.85.220.44]) by bombadil.infradead.org with esmtps (Exim 4.85_2 #1 (Red Hat Linux)) id 1bpixj-0003FI-DS for linux-arm-kernel@lists.infradead.org; Thu, 29 Sep 2016 21:33:53 +0000 Received: by mail-pa0-f44.google.com with SMTP id qn7so31345389pac.3 for ; Thu, 29 Sep 2016 14:33:30 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=oNock8pfJ3YfiZn6NhbJw3GZHF9OWtufDmxoaLBinpo=; b=WQlBaF1jBBOWrL8KkzolpqxWuvad85ygKjNDle54kkuJahASJy0X88xHbhN8aGns5y EK9D1v0OIBYFfxv4yPnJckOzmsARWbU9NpDO5Lm2xRk2TCZC7z7Lqh1o/+lmoochsUgl dM2stw2po+gIFxuPbSmdh9Fd4uyP7wRDkYZuY1PvC5aXvDhq0IJysEnxmakTayE00Nxg JNtv81k9MeGq+yw5gB5u+mLIfayAcoKSylatv+aJdIsoEujLEBx11D1A5Gri9WUHTsAl ZH+HS2xVMaKlEFkAaGxH8rLw55t1pD7+pyZai7GQx8DXhIAp6vGf+/XL3MEiB3Hdbzdi 4Dvw== X-Gm-Message-State: AA6/9RkikXX3AqMEh0ysQ00+tuc9VNxsUh7VHnk31XFjm6cBs1dGfo2g7LNYeJDKJNgGJHmW X-Received: by 10.66.136.7 with SMTP id pw7mr5909972pab.87.1475184810491; Thu, 29 Sep 2016 14:33:30 -0700 (PDT) Received: from localhost.localdomain ([67.238.99.186]) by smtp.gmail.com with ESMTPSA id q8sm22463933pac.32.2016.09.29.14.33.23 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 29 Sep 2016 14:33:29 -0700 (PDT) From: Laura Abbott To: AKASHI Takahiro , Mark Rutland , Ard Biesheuvel , David Brown , Will Deacon , Catalin Marinas Subject: [PATCH 3/3] arm64: dump: Add checking for writable and exectuable pages Date: Thu, 29 Sep 2016 14:32:57 -0700 Message-Id: <20160929213257.30505-4-labbott@redhat.com> X-Mailer: git-send-email 2.10.0 In-Reply-To: <20160929213257.30505-1-labbott@redhat.com> References: <20160929213257.30505-1-labbott@redhat.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20160929_143351_651569_0B24C206 X-CRM114-Status: GOOD ( 18.94 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kernel-hardening@lists.openwall.com, Laura Abbott , linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Kees Cook MIME-Version: 1.0 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org X-Virus-Scanned: ClamAV using ClamSMTP Page mappings with full RWX permissions are a security risk. x86 has an option to walk the page tables and dump any bad pages. (See e1a58320a38d ("x86/mm: Warn on W^X mappings")). Add a similar implementation for arm64. Signed-off-by: Laura Abbott --- arch/arm64/Kconfig.debug | 28 ++++++++++++++++++++++++++++ arch/arm64/include/asm/ptdump.h | 10 ++++++++++ arch/arm64/mm/dump.c | 36 ++++++++++++++++++++++++++++++++++++ arch/arm64/mm/mmu.c | 2 ++ 4 files changed, 76 insertions(+) diff --git a/arch/arm64/Kconfig.debug b/arch/arm64/Kconfig.debug index 9015f02..037dba4 100644 --- a/arch/arm64/Kconfig.debug +++ b/arch/arm64/Kconfig.debug @@ -42,6 +42,34 @@ config ARM64_RANDOMIZE_TEXT_OFFSET of TEXT_OFFSET and platforms must not require a specific value. +config DEBUG_WX + bool "Warn on W+X mappings at boot" + select ARM64_PTDUMP_CORE + ---help--- + Generate a warning if any W+X mappings are found at boot. + + This is useful for discovering cases where the kernel is leaving + W+X mappings after applying NX, as such mappings are a security risk. + + Look for a message in dmesg output like this: + + arm64/mm: Checked W+X mappings: passed, no W+X pages found. + + or like this, if the check failed: + + arm64/mm: Checked W+X mappings: FAILED, W+X pages found. + + Note that even if the check fails, your kernel is possibly + still fine, as W+X mappings are not a security hole in + themselves, what they do is that they make the exploitation + of other unfixed kernel bugs easier. + + There is no runtime or memory usage effect of this option + once the kernel has booted up - it's a one time check. + + If in doubt, say "Y". + + config DEBUG_SET_MODULE_RONX bool "Set loadable kernel module data as NX and text as RO" depends on MODULES diff --git a/arch/arm64/include/asm/ptdump.h b/arch/arm64/include/asm/ptdump.h index b18a62c..e3c6bc0 100644 --- a/arch/arm64/include/asm/ptdump.h +++ b/arch/arm64/include/asm/ptdump.h @@ -20,6 +20,7 @@ #include #include +#include struct addr_marker { unsigned long start_address; @@ -31,6 +32,8 @@ struct ptdump_info { const struct addr_marker *markers; unsigned long base_addr; unsigned long max_addr; + /* Internal, do not touch */ + struct list_head node; }; int ptdump_register(struct ptdump_info *info, const char *name); @@ -44,6 +47,13 @@ static inline int ptdump_debugfs_create(struct ptdump_info *info, return 0; } #endif +void ptdump_check_wx(void); + +#ifdef CONFIG_DEBUG_WX +#define debug_checkwx() ptdump_check_wx() +#else +#define debug_checkwx() do { } while (0) +#endif #else static inline int ptdump_register(struct ptdump_info *info, const char *name) diff --git a/arch/arm64/mm/dump.c b/arch/arm64/mm/dump.c index e318f3d..b0b1dd6 100644 --- a/arch/arm64/mm/dump.c +++ b/arch/arm64/mm/dump.c @@ -29,6 +29,8 @@ #include #include +static LIST_HEAD(dump_info); + static const struct addr_marker address_markers[] = { #ifdef CONFIG_KASAN { KASAN_SHADOW_START, "Kasan shadow start" }, @@ -74,6 +76,8 @@ struct pg_state { unsigned long start_address; unsigned level; u64 current_prot; + bool check_wx; + unsigned long wx_pages; }; struct prot_bits { @@ -219,6 +223,15 @@ static void note_page(struct pg_state *st, unsigned long addr, unsigned level, unsigned long delta; if (st->current_prot) { + if (st->check_wx && + ((st->current_prot & PTE_RDONLY) != PTE_RDONLY) && + ((st->current_prot & PTE_PXN) != PTE_PXN)) { + WARN_ONCE(1, "arm64/mm: Found insecure W+X mapping at address %p/%pS\n", + (void *)st->start_address, + (void *)st->start_address); + st->wx_pages += (addr - st->start_address) / PAGE_SIZE; + } + pt_dump_seq_printf(st->seq, "0x%016lx-0x%016lx ", st->start_address, addr); @@ -341,6 +354,7 @@ static void ptdump_initialize(struct ptdump_info *info) int ptdump_register(struct ptdump_info *info, const char *name) { ptdump_initialize(info); + list_add(&info->node, &dump_info); return ptdump_debugfs_create(info, name); } @@ -350,6 +364,28 @@ static struct ptdump_info kernel_ptdump_info = { .base_addr = VA_START, }; +void ptdump_check_wx(void) +{ + struct ptdump_info *info; + + list_for_each_entry(info, &dump_info, node) { + struct pg_state st = { + .seq = NULL, + .marker = info->markers, + .check_wx = true, + }; + + __walk_pgd(&st, info->mm, info->base_addr); + note_page(&st, 0, 0, 0); + if (st.wx_pages) + pr_info("Checked W+X mappings (%p): FAILED, %lu W+X pages found\n", + info->mm, + st.wx_pages); + else + pr_info("Checked W+X mappings (%p): passed, no W+X pages found\n", info->mm); + } +} + static int ptdump_init(void) { return ptdump_register(&kernel_ptdump_info, "kernel_page_tables"); diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 4989948..1f036d2 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -41,6 +41,7 @@ #include #include #include +#include #include "mm.h" @@ -397,6 +398,7 @@ void mark_rodata_ro(void) section_size = (unsigned long)__init_begin - (unsigned long)__start_rodata; create_mapping_late(__pa(__start_rodata), (unsigned long)__start_rodata, section_size, PAGE_KERNEL_RO); + debug_checkwx(); } void fixup_init(void)