• Nadav Amit's avatar
    x86/modules: Avoid breaking W^X while loading modules · f2c65fb3
    Nadav Amit authored
    When modules and BPF filters are loaded, there is a time window in
    which some memory is both writable and executable. An attacker that has
    already found another vulnerability (e.g., a dangling pointer) might be
    able to exploit this behavior to overwrite kernel code. Prevent having
    writable executable PTEs in this stage.
    
    In addition, avoiding having W+X mappings can also slightly simplify the
    patching of modules code on initialization (e.g., by alternatives and
    static-key), as would be done in the next patch. This was actually the
    main motivation for this patch.
    
    To avoid having W+X mappings, set them initially as RW (NX) and after
    they are set as RO set them as X as well. Setting them as executable is
    done as a separate step to avoid one core in which the old PTE is cached
    (hence writable), and another which sees the updated PTE (executable),
    which would break the W^X protection.
    Suggested-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Suggested-by: default avatarAndy Lutomirski <luto@amacapital.net>
    Signed-off-by: default avatarNadav Amit <namit@vmware.com>
    Signed-off-by: default avatarRick Edgecombe <rick.p.edgecombe@intel.com>
    Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
    Cc: <akpm@linux-foundation.org>
    Cc: <ard.biesheuvel@linaro.org>
    Cc: <deneen.t.dock@intel.com>
    Cc: <kernel-hardening@lists.openwall.com>
    Cc: <kristen@linux.intel.com>
    Cc: <linux_dti@icloud.com>
    Cc: <will.deacon@arm.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Dave Hansen <dave.hansen@intel.com>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Jessica Yu <jeyu@kernel.org>
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Cc: Masami Hiramatsu <mhiramat@kernel.org>
    Cc: Rik van Riel <riel@surriel.com>
    Link: https://lkml.kernel.org/r/20190426001143.4983-12-namit@vmware.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
    f2c65fb3
alternative.c 23.1 KB