śr., 24 lip 2019 o 17:02 Jessica Yu <[email protected]> napisał(a): > > Some arches (e.g., arm64, x86) have moved towards non-executable > module_alloc() allocations for security hardening reasons. That means > that the module loader will need to set the text section of a module to > executable, regardless of whether or not CONFIG_STRICT_MODULE_RWX is set. > > When CONFIG_STRICT_MODULE_RWX=y, module section allocations are always > page-aligned to handle memory rwx permissions. On some arches with > CONFIG_STRICT_MODULE_RWX=n however, when setting the module text to > executable, the BUG_ON() in frob_text() gets triggered since module > section allocations are not page-aligned when CONFIG_STRICT_MODULE_RWX=n. > Since the set_memory_* API works with pages, and since we need to call > set_memory_x() regardless of whether CONFIG_STRICT_MODULE_RWX is set, we > might as well page-align all module section allocations for ease of > managing rwx permissions of module sections (text, rodata, etc). > > Fixes: 2eef1399a866 ("modules: fix BUG when load module with rodata=n") > Reported-by: Martin Kaiser <[email protected]> > Reported-by: Bartosz Golaszewski <[email protected]> > Tested-by: David Lechner <[email protected]> > Tested-by: Martin Kaiser <[email protected]> > Signed-off-by: Jessica Yu <[email protected]> > --- > kernel/module.c | 7 +------ > 1 file changed, 1 insertion(+), 6 deletions(-) > > diff --git a/kernel/module.c b/kernel/module.c > index 5933395af9a0..cd8df516666d 100644 > --- a/kernel/module.c > +++ b/kernel/module.c > @@ -64,14 +64,9 @@ > > /* > * Modules' sections will be aligned on page boundaries > - * to ensure complete separation of code and data, but > - * only when CONFIG_STRICT_MODULE_RWX=y > + * to ensure complete separation of code and data > */ > -#ifdef CONFIG_STRICT_MODULE_RWX > # define debug_align(X) ALIGN(X, PAGE_SIZE) > -#else > -# define debug_align(X) (X) > -#endif > > /* If this is set, the section belongs in the init part of the module */ > #define INIT_OFFSET_MASK (1UL << (BITS_PER_LONG-1)) > -- > 2.16.4 >
Tested-by: Bartosz Golaszewski <[email protected]>
