From patchwork Wed Apr 10 19:57:06 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joel Fernandes X-Patchwork-Id: 10894623 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id AC37F139A for ; Wed, 10 Apr 2019 19:57:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 96B4928ADC for ; Wed, 10 Apr 2019 19:57:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8A4F128B26; Wed, 10 Apr 2019 19:57:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 7A95E28ADC for ; Wed, 10 Apr 2019 19:57:40 +0000 (UTC) Received: (qmail 5463 invoked by uid 550); 10 Apr 2019 19:57:39 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 5432 invoked from network); 10 Apr 2019 19:57:38 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=joelfernandes.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=T6Rg88aOAsFuASkW0lngbtXxdztNb7Uj9gIPChv2xDg=; b=nAn+V0M7OY8g5dMyOPn2KXwLUWbVvngXjTZPfTTw/OhT+KFSM+gOxxgAWsYZGEFP1D 8ppImtf7O9RckICqlzErXj0E83HGy3uNv7TDeGZHmSuJMKZhCQVld02N4VDxYx8IdYVw YVZATb+BlZAzUOBrC+GHiiNniV2bBuTQD784I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=T6Rg88aOAsFuASkW0lngbtXxdztNb7Uj9gIPChv2xDg=; b=OIiN0Dt3MtkIALO31w7noQDfZ7ivvApLW85t4AFJJQpBmJcJexQlTD/F9YPw0o4DX9 npAbPRzIiIUbuwdccKzZc0MqIc9x7NTJ+ilVw1AEtMcP3r+E6GiDjLc27QNnvarzaGYD llTzQN1Z1pDykmrpNXZb6c4K4dzQezmhI3pBgk/2oYu7rEi8AWvfj0cAF2wr8HIcYJUp Q4nXtLryerUSvddLdALYZsmJ6c2OdKpHiWZtAbdWIBJFGG8DNbA/c5WcGnnBlF5Q556v WGZhjnLRBvZmjsmPlgJmvhbERMfCuyDEspZa49FsTJBhMym79JQw+iUifKU9bnnQIqCJ 975A== X-Gm-Message-State: APjAAAXb8UA0XHaTOSAXstRQHq8n5TYLbedkUngI3/Psl+tFfrBrJajZ eegQlb65+/EzSX+1TJX2nXeEWR9WVj4= X-Google-Smtp-Source: APXvYqwEGOZh3DKCeXW9Mrc2BfiT6pVyeSVviNSCnQ5uqobOWsQrmxEkf741BqO8AzuTS7XkBu0KLQ== X-Received: by 2002:a17:902:a9c7:: with SMTP id b7mr43911944plr.145.1554926246076; Wed, 10 Apr 2019 12:57:26 -0700 (PDT) From: "Joel Fernandes (Google)" To: linux-kernel@vger.kernel.org Cc: "Joel Fernandes (Google)" , paulmck@linux.vnet.ibm.com, rostedt@goodmis.org, mathieu.desnoyers@efficios.com, rcu@vger.kernel.org, kernel-hardening@lists.openwall.com, kernel-team@android.com, keescook@chromium.org, Jessica Yu Subject: [PATCH v3 1/3] module: Prepare for addition of new ro_after_init sections Date: Wed, 10 Apr 2019 15:57:06 -0400 Message-Id: <20190410195708.162185-1-joel@joelfernandes.org> X-Mailer: git-send-email 2.21.0.392.gf8f6787159e-goog MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP For the purposes of hardening modules by adding sections to ro_after_init sections, prepare for addition of new ro_after_init entries which we do in future patches. Create a table to which new entries could be added later. This makes it less error prone and reduce code duplication. Cc: paulmck@linux.vnet.ibm.com Cc: rostedt@goodmis.org Cc: mathieu.desnoyers@efficios.com Cc: rcu@vger.kernel.org Cc: kernel-hardening@lists.openwall.com Cc: kernel-team@android.com Suggested-by: keescook@chromium.org Reviewed-by: keescook@chromium.org Acked-by: rostedt@goodmis.org Signed-off-by: Joel Fernandes (Google) Reviewed-by: Miroslav Benes --- kernel/module.c | 41 +++++++++++++++++++++++------------------ 1 file changed, 23 insertions(+), 18 deletions(-) diff --git a/kernel/module.c b/kernel/module.c index 524da609c884..42e4e289d6c7 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3300,11 +3300,27 @@ static bool blacklisted(const char *module_name) } core_param(module_blacklist, module_blacklist, charp, 0400); +/* + * Mark ro_after_init section with SHF_RO_AFTER_INIT so that + * layout_sections() can put it in the right place. + * Note: ro_after_init sections also have SHF_{WRITE,ALLOC} set. + */ +static const char * const ro_after_init_sections[] = { + ".data..ro_after_init", + + /* + * __jump_table structures are never modified, with the exception of + * entries that refer to code in the __init section, which are + * annotated as such at module load time. + */ + "__jump_table", +}; + static struct module *layout_and_allocate(struct load_info *info, int flags) { struct module *mod; unsigned int ndx; - int err; + int err, i; err = check_modinfo(info->mod, info, flags); if (err) @@ -3319,23 +3335,12 @@ static struct module *layout_and_allocate(struct load_info *info, int flags) /* We will do a special allocation for per-cpu sections later. */ info->sechdrs[info->index.pcpu].sh_flags &= ~(unsigned long)SHF_ALLOC; - /* - * Mark ro_after_init section with SHF_RO_AFTER_INIT so that - * layout_sections() can put it in the right place. - * Note: ro_after_init sections also have SHF_{WRITE,ALLOC} set. - */ - ndx = find_sec(info, ".data..ro_after_init"); - if (ndx) - info->sechdrs[ndx].sh_flags |= SHF_RO_AFTER_INIT; - /* - * Mark the __jump_table section as ro_after_init as well: these data - * structures are never modified, with the exception of entries that - * refer to code in the __init section, which are annotated as such - * at module load time. - */ - ndx = find_sec(info, "__jump_table"); - if (ndx) - info->sechdrs[ndx].sh_flags |= SHF_RO_AFTER_INIT; + /* Set sh_flags for read-only after init sections */ + for (i = 0; i < ARRAY_SIZE(ro_after_init_sections); i++) { + ndx = find_sec(info, ro_after_init_sections[i]); + if (ndx) + info->sechdrs[ndx].sh_flags |= SHF_RO_AFTER_INIT; + } /* Determine total sizes, and put offsets in sh_entsize. For now this is done generically; there doesn't appear to be any From patchwork Wed Apr 10 19:57:07 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joel Fernandes X-Patchwork-Id: 10894625 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BBAF4139A for ; Wed, 10 Apr 2019 19:57:48 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id A794D289EA for ; Wed, 10 Apr 2019 19:57:48 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9B33F28AF2; Wed, 10 Apr 2019 19:57:48 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id D2F7B289EA for ; Wed, 10 Apr 2019 19:57:47 +0000 (UTC) Received: (qmail 5732 invoked by uid 550); 10 Apr 2019 19:57:41 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 5598 invoked from network); 10 Apr 2019 19:57:40 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=joelfernandes.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=s1KvMENHKJ+ARGp1Ak4XYk6a1UqyuJod6EXXmWFSMt8=; b=gCuYSH03rd2bfZfsXnJ+sf8RlAg6S8HoJ5JjqU+Zl/5+O0UlykXyfQCOeNcTUCaSR7 6KNEjmqFrBVBBTO/0d485a41D1MP58vlbCrmYQincc9PoLW9MTuRfAdx7OyNyTQEbmh0 smzNx1G68PwHw5YZpbUN3UtxvRAc4eRBOPJFI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=s1KvMENHKJ+ARGp1Ak4XYk6a1UqyuJod6EXXmWFSMt8=; b=si4RTRirO+craE2Zx9nuD23IlniQujGgfYLiP2cQusIJ1uq/89yQ66HKa4odFV8Kcg /huPEL4hRJLsn/EuQ0pREXUHFtu7IZynw02XqXd/8pCRzY7+YFejrLbEvuwARJ1nFNhU YHe9C2Z0ALn+1+izpNd3lZjgdMxx/CtCeXux8ORKBUViW0j56A8w6gdNGzfGVgKz31yz mjPTx5WFf3AOPzK/AWa5hSUXH+HDiD/CPogmiOLhxh/ogYzIbzyyY5girUZt9olSg2x9 wS2LNmB0YcyRVwRQxSEzGBMjXpYx67OK4lI8EwJY1u1zJaa67covzHfJGfzNB7b9HkRF JN3A== X-Gm-Message-State: APjAAAUwgjELpeS3LLkxMwy6KlGycCtCNctut8sJc5lmwFZEBa4B3TQy mjgBCDB6CpgNiLKTi0YZn74Fxg== X-Google-Smtp-Source: APXvYqx4UxF9E1rsmi7wYsghu/PXp1ymRPB3Mm4BYcwhDNZS9gsM2QmW9kWzaEw/StarCjaCmGV6RA== X-Received: by 2002:a17:902:32b:: with SMTP id 40mr23706308pld.204.1554926248212; Wed, 10 Apr 2019 12:57:28 -0700 (PDT) From: "Joel Fernandes (Google)" To: linux-kernel@vger.kernel.org Cc: "Joel Fernandes (Google)" , paulmck@linux.vnet.ibm.com, keescook@chromium.org, Jessica Yu , kernel-hardening@lists.openwall.com, kernel-team@android.com, mathieu.desnoyers@efficios.com, rcu@vger.kernel.org, rostedt@goodmis.org Subject: [PATCH v3 2/3] module: Make srcu_struct ptr array as read-only post init Date: Wed, 10 Apr 2019 15:57:07 -0400 Message-Id: <20190410195708.162185-2-joel@joelfernandes.org> X-Mailer: git-send-email 2.21.0.392.gf8f6787159e-goog In-Reply-To: <20190410195708.162185-1-joel@joelfernandes.org> References: <20190410195708.162185-1-joel@joelfernandes.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP Since commit title ("srcu: Allocate per-CPU data for DEFINE_SRCU() in modules"), modules that call DEFINE_{STATIC,}SRCU will have a new array of srcu_struct pointers which is used by srcu code to initialize and clean up these structures. There is no reason for this array of pointers to be writable, and can cause security or other hidden bugs. Mark these are read-only after the module init has completed. Suggested-by: paulmck@linux.vnet.ibm.com Suggested-by: keescook@chromium.org Acked-by: keescook@chromium.org Signed-off-by: Joel Fernandes (Google) --- kernel/module.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index 42e4e289d6c7..8b9631e789f0 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3314,6 +3314,12 @@ static const char * const ro_after_init_sections[] = { * annotated as such at module load time. */ "__jump_table", + + /* + * Used for SRCU structures which need to be initialized/cleaned up + * by the SRCU notifiers + */ + "___srcu_struct_ptrs", }; static struct module *layout_and_allocate(struct load_info *info, int flags) From patchwork Wed Apr 10 19:57:08 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Joel Fernandes X-Patchwork-Id: 10894627 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 665DD139A for ; Wed, 10 Apr 2019 19:57:57 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 55440289EA for ; Wed, 10 Apr 2019 19:57:57 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 45EBF28AF2; Wed, 10 Apr 2019 19:57:57 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id B9C0C289EA for ; Wed, 10 Apr 2019 19:57:55 +0000 (UTC) Received: (qmail 5928 invoked by uid 550); 10 Apr 2019 19:57:43 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 5839 invoked from network); 10 Apr 2019 19:57:42 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=joelfernandes.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=+zEMNc7324kqJ6udI8dxNG1UczLiZYFItO/G9LMbCUw=; b=j912k9RYViXXynkk1wOlbiUqGi5gVmM5St7S1BlBPu6+q2P3DgjDl+YznzwZDpy/hl gWY+3dwgbt6IfhjgUbx9m6jOM/d7OOe5psxO/7GbxrHFz+xE7v4Tf7xvwqhp0mhKs5VV MpzN1h19egcEapYxtfT1as9eY9rguCD4TJaF4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=+zEMNc7324kqJ6udI8dxNG1UczLiZYFItO/G9LMbCUw=; b=BipDybouQ/amG88zCPKi0Homc+A9SciFWYteq4IYGF42BInTNdpWlqK+7eCJirIex6 Qi96UW/MyRIg55M9cJjz1TZXaWOS8Ut5ln+mW/6KPG04ar1i/0H5BImqLL6P0My5khOV pM6NubLUCdwuXQEVzo4xSPdskRfQnmaXK3Rx6apdWDBf54NiDnz+x2NOMl5G9blWen29 W5UVKScODlzUguxnHUKzeM4e1gp1XAv6VoqNDc1pV00R80oqd4bpwH3RkPSVLbi2fyva 4mso8gTrxZK9GJT8DwPSUW9aSSlil7cnCWs5X6Fb/68qy0o5LAc24P8d9KMPAY8mF5qK vCig== X-Gm-Message-State: APjAAAV1m3ViSdeXvj8nW0IbQsbL0yFk4iZ7J+u7VtGTv9uzhIh+xOj0 FlSQeSTkBOI2YVy1WLfd0grkBA== X-Google-Smtp-Source: APXvYqxQvO0IbvL2miFcuCBLyOB0UE4xHrZeT7OhWqKm2iqMVPmm+uND50fcJC2SGWrV9EYsD8MM5Q== X-Received: by 2002:a62:ee17:: with SMTP id e23mr45292744pfi.80.1554926250235; Wed, 10 Apr 2019 12:57:30 -0700 (PDT) From: "Joel Fernandes (Google)" To: linux-kernel@vger.kernel.org Cc: "Joel Fernandes (Google)" , paulmck@linux.vnet.ibm.com, keescook@chromium.org, mathieu.desnoyers@efficios.com, rostedt@goodmis.org, Jessica Yu , kernel-hardening@lists.openwall.com, kernel-team@android.com, rcu@vger.kernel.org Subject: [PATCH v3 3/3] module: Make __tracepoints_ptrs as read-only Date: Wed, 10 Apr 2019 15:57:08 -0400 Message-Id: <20190410195708.162185-3-joel@joelfernandes.org> X-Mailer: git-send-email 2.21.0.392.gf8f6787159e-goog In-Reply-To: <20190410195708.162185-1-joel@joelfernandes.org> References: <20190410195708.162185-1-joel@joelfernandes.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP This series hardens the tracepoints in modules by making the array of pointers referring to the tracepoints as read-only. This array is needed during module unloading to verify that the tracepoint is quiescent. There is no reason for the array to be to be writable after init, and can cause security or other hidden bugs. Mark these as ro_after_init. Suggested-by: paulmck@linux.vnet.ibm.com Suggested-by: keescook@chromium.org Suggested-by: mathieu.desnoyers@efficios.com Cc: rostedt@goodmis.org Signed-off-by: Joel Fernandes (Google) --- kernel/module.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index 8b9631e789f0..be980aaa8804 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -3320,6 +3320,12 @@ static const char * const ro_after_init_sections[] = { * by the SRCU notifiers */ "___srcu_struct_ptrs", + + /* + * Array of tracepoint pointers used for checking if tracepoints are + * quiescent during unloading. + */ + "__tracepoints_ptrs", }; static struct module *layout_and_allocate(struct load_info *info, int flags)