* Kees Cook <keesc...@chromium.org> wrote: > On Thu, Oct 1, 2015 at 2:12 AM, Ingo Molnar <mi...@kernel.org> wrote: > > > > * Thomas Gleixner <t...@linutronix.de> wrote: > > > >> On Mon, 28 Sep 2015, Kees Cook wrote: > >> > > --- a/arch/x86/mm/init_64.c > >> > > +++ b/arch/x86/mm/init_64.c > >> > > @@ -1132,7 +1132,7 @@ void mark_rodata_ro(void) > >> > > * has been zapped already via cleanup_highmem(). > >> > > */ > >> > > all_end = roundup((unsigned long)_brk_end, PMD_SIZE); > >> > > - set_memory_nx(rodata_start, (all_end - rodata_start) >> > >> > > PAGE_SHIFT); > >> > > + set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT); > >> > > > >> > > rodata_test(); > >> > > > >> > > > >> > > >> > That should work, yeah. I'd still like to find the default permissions > >> > and > >> > make them W+nx, though. Regardless, let's get the above added. > >> > >> The default permissions are set at boot time when setting up the early page > >> tables. When we split them up later on we inherit the PTE bits and then we > >> do > >> that _ro/nx cleanup after the overall layout has been settled. > >> > >> We can't make them W+nx in the early setup without shooting ourself in the > >> foot, > >> because we only set up at the pud/pmd level. > > > > So I think at minimum we should do a (debug) scan in late init, of the whole > > range, for any leftover WX permissions? That would have caught this bug. > > (and > > might catch other existing bugs that might occur with various > > configs/hw-layouts.) > > I think this would be great. I'd like to disassociate it from PTDUMP, > though, since that exposes kernel address to userspace. It'd be nice > to have the check without also the debugfs entry.
Yeah, so it could still use pretty much the same code, except no registry in /debug? Thanks, Ingo -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/