* [PATCH 1/2] ARM: mm: make STRICT_KERNEL_RWX effective for LPAE
2017-11-09 0:41 [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y Philip Derrin
@ 2017-11-09 0:41 ` Philip Derrin
2017-11-09 0:41 ` [PATCH 2/2] ARM: mm: dump: check hardware RO bit " Philip Derrin
` (2 subsequent siblings)
3 siblings, 0 replies; 10+ messages in thread
From: Philip Derrin @ 2017-11-09 0:41 UTC (permalink / raw)
To: linux-arm-kernel
Currently, for ARM kernels with CONFIG_ARM_LPAE and
CONFIG_STRICT_KERNEL_RWX enabled, the 2MiB pages mapping the
kernel code and rodata are writable. They are marked read-only in
a software bit (L_PMD_SECT_RDONLY) but the hardware read-only bit
is not set (PMD_SECT_AP2).
For user mappings, the logic that propagates the software bit
to the hardware bit is in set_pmd_at(); but for the kernel,
section_update() writes the PMDs directly, skipping this logic.
The fix is to set PMD_SECT_AP2 for read-only sections in
section_update(), at the same time as L_PMD_SECT_RDONLY.
Fixes: 1e3479225acb ("ARM: 8275/1: mm: fix PMD_SECT_RDONLY undeclared compile error")
Signed-off-by: Philip Derrin <philip@cog.systems>
Reported-by: Neil Dick <neil@cog.systems>
Tested-by: Neil Dick <neil@cog.systems>
Tested-by: Laura Abbott <labbott@redhat.com>
Cc: stable at vger.kernel.org
---
arch/arm/mm/init.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index ad80548325fe..0f6d1537f330 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -639,8 +639,8 @@ static struct section_perm ro_perms[] = {
.start = (unsigned long)_stext,
.end = (unsigned long)__init_begin,
#ifdef CONFIG_ARM_LPAE
- .mask = ~L_PMD_SECT_RDONLY,
- .prot = L_PMD_SECT_RDONLY,
+ .mask = ~(L_PMD_SECT_RDONLY | PMD_SECT_AP2),
+ .prot = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
#else
.mask = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE),
.prot = PMD_SECT_APX | PMD_SECT_AP_WRITE,
--
2.15.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 2/2] ARM: mm: dump: check hardware RO bit for LPAE
2017-11-09 0:41 [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y Philip Derrin
2017-11-09 0:41 ` [PATCH 1/2] ARM: mm: make STRICT_KERNEL_RWX effective for LPAE Philip Derrin
@ 2017-11-09 0:41 ` Philip Derrin
2017-11-09 1:23 ` [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y Kees Cook
2017-11-20 18:45 ` Florian Fainelli
3 siblings, 0 replies; 10+ messages in thread
From: Philip Derrin @ 2017-11-09 0:41 UTC (permalink / raw)
To: linux-arm-kernel
When CONFIG_ARM_LPAE is set, the PMD dump relies on the software
read-only bit to determine whether a page is writable. This
concealed a bug which left the kernel text section writable
(AP2=0) while marked read-only in the software bit.
In a kernel with the AP2 bug, the dump looks like this:
---[ Kernel Mapping ]---
0xc0000000-0xc0200000 2M RW NX SHD
0xc0200000-0xc0600000 4M ro x SHD
0xc0600000-0xc0800000 2M ro NX SHD
0xc0800000-0xc4800000 64M RW NX SHD
The fix is to check that the software and hardware bits are both
set before displaying "ro". The dump then shows the true perms:
---[ Kernel Mapping ]---
0xc0000000-0xc0200000 2M RW NX SHD
0xc0200000-0xc0600000 4M RW x SHD
0xc0600000-0xc0800000 2M RW NX SHD
0xc0800000-0xc4800000 64M RW NX SHD
Fixes: ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write logic for LPAE")
Signed-off-by: Philip Derrin <philip@cog.systems>
Tested-by: Neil Dick <neil@cog.systems>
Cc: stable at vger.kernel.org
---
arch/arm/mm/dump.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c
index 35ff45470dbf..fc3b44028cfb 100644
--- a/arch/arm/mm/dump.c
+++ b/arch/arm/mm/dump.c
@@ -129,8 +129,8 @@ static const struct prot_bits section_bits[] = {
.val = PMD_SECT_USER,
.set = "USR",
}, {
- .mask = L_PMD_SECT_RDONLY,
- .val = L_PMD_SECT_RDONLY,
+ .mask = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
+ .val = L_PMD_SECT_RDONLY | PMD_SECT_AP2,
.set = "ro",
.clear = "RW",
#elif __LINUX_ARM_ARCH__ >= 6
--
2.15.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y
2017-11-09 0:41 [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y Philip Derrin
2017-11-09 0:41 ` [PATCH 1/2] ARM: mm: make STRICT_KERNEL_RWX effective for LPAE Philip Derrin
2017-11-09 0:41 ` [PATCH 2/2] ARM: mm: dump: check hardware RO bit " Philip Derrin
@ 2017-11-09 1:23 ` Kees Cook
2017-11-09 9:37 ` Russell King - ARM Linux
2017-11-20 18:45 ` Florian Fainelli
3 siblings, 1 reply; 10+ messages in thread
From: Kees Cook @ 2017-11-09 1:23 UTC (permalink / raw)
To: linux-arm-kernel
On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
> Hi,
>
> This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> merged in 3.19.
>
> The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> sections to be read-only"), and another that moved the LPAE read-only bit into
> a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> logic for LPAE").
>
> The incorrect mappings were not apparent in the debugfs kernel_page_tables
> dump because that was checking only the software RO bit, not the hardware RO
> bit.
Thanks for catching this! Please consider both patches:
Reviewed-by: Kees Cook <keescook@chromium.org>
-Kees
>
> Regards,
> Philip
>
>
> Philip Derrin (2):
> ARM: mm: make STRICT_KERNEL_RWX effective for LPAE
> ARM: mm: dump: check hardware RO bit for LPAE
>
> arch/arm/mm/dump.c | 4 ++--
> arch/arm/mm/init.c | 4 ++--
> 2 files changed, 4 insertions(+), 4 deletions(-)
>
> --
> 2.15.0
>
--
Kees Cook
Pixel Security
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y
2017-11-09 1:23 ` [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y Kees Cook
@ 2017-11-09 9:37 ` Russell King - ARM Linux
2017-11-09 9:49 ` Baruch Siach
2017-11-14 2:48 ` Philip Derrin
0 siblings, 2 replies; 10+ messages in thread
From: Russell King - ARM Linux @ 2017-11-09 9:37 UTC (permalink / raw)
To: linux-arm-kernel
On Wed, Nov 08, 2017 at 05:23:43PM -0800, Kees Cook wrote:
> On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
> > Hi,
> >
> > This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> > when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> > mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> > merged in 3.19.
> >
> > The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> > mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> > implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> > sections to be read-only"), and another that moved the LPAE read-only bit into
> > a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> > logic for LPAE").
> >
> > The incorrect mappings were not apparent in the debugfs kernel_page_tables
> > dump because that was checking only the software RO bit, not the hardware RO
> > bit.
>
> Thanks for catching this! Please consider both patches:
>
> Reviewed-by: Kees Cook <keescook@chromium.org>
Where are these patches, and why weren't they copied to the arm kernel
list?
--
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y
2017-11-09 9:37 ` Russell King - ARM Linux
@ 2017-11-09 9:49 ` Baruch Siach
2017-11-09 23:13 ` Russell King - ARM Linux
2017-11-14 2:48 ` Philip Derrin
1 sibling, 1 reply; 10+ messages in thread
From: Baruch Siach @ 2017-11-09 9:49 UTC (permalink / raw)
To: linux-arm-kernel
Hi Russell,
On Thu, Nov 09, 2017 at 09:37:34AM +0000, Russell King - ARM Linux wrote:
> On Wed, Nov 08, 2017 at 05:23:43PM -0800, Kees Cook wrote:
> > On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
> > > Hi,
> > >
> > > This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> > > when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> > > mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> > > merged in 3.19.
> > >
> > > The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> > > mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> > > implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> > > sections to be read-only"), and another that moved the LPAE read-only bit into
> > > a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> > > logic for LPAE").
> > >
> > > The incorrect mappings were not apparent in the debugfs kernel_page_tables
> > > dump because that was checking only the software RO bit, not the hardware RO
> > > bit.
> >
> > Thanks for catching this! Please consider both patches:
> >
> > Reviewed-by: Kees Cook <keescook@chromium.org>
>
> Where are these patches, and why weren't they copied to the arm kernel
> list?
I got the patches from the list.
Cover:
http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541532.html
1/2:
http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541531.html
2/2:
http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541533.html
baruch
--
http://baruch.siach.name/blog/ ~. .~ Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
- baruch at tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y
2017-11-09 9:49 ` Baruch Siach
@ 2017-11-09 23:13 ` Russell King - ARM Linux
0 siblings, 0 replies; 10+ messages in thread
From: Russell King - ARM Linux @ 2017-11-09 23:13 UTC (permalink / raw)
To: linux-arm-kernel
On Thu, Nov 09, 2017 at 11:49:20AM +0200, Baruch Siach wrote:
> Hi Russell,
>
> On Thu, Nov 09, 2017 at 09:37:34AM +0000, Russell King - ARM Linux wrote:
> > On Wed, Nov 08, 2017 at 05:23:43PM -0800, Kees Cook wrote:
> > > On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
> > > > Hi,
> > > >
> > > > This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> > > > when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> > > > mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> > > > merged in 3.19.
> > > >
> > > > The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> > > > mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> > > > implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> > > > sections to be read-only"), and another that moved the LPAE read-only bit into
> > > > a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> > > > logic for LPAE").
> > > >
> > > > The incorrect mappings were not apparent in the debugfs kernel_page_tables
> > > > dump because that was checking only the software RO bit, not the hardware RO
> > > > bit.
> > >
> > > Thanks for catching this! Please consider both patches:
> > >
> > > Reviewed-by: Kees Cook <keescook@chromium.org>
> >
> > Where are these patches, and why weren't they copied to the arm kernel
> > list?
>
> I got the patches from the list.
>
> Cover:
> http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541532.html
> 1/2:
> http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541531.html
> 2/2:
> http://lists.infradead.org/pipermail/linux-arm-kernel/2017-November/541533.html
Ah, dspam decided they were spam, so they ended up in one of my junk
mailboxes.
--
RMK's Patch system: http://www.armlinux.org.uk/developer/patches/
FTTC broadband for 0.8mile line in suburbia: sync at 8.8Mbps down 630kbps up
According to speedtest.net: 8.21Mbps down 510kbps up
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y
2017-11-09 9:37 ` Russell King - ARM Linux
2017-11-09 9:49 ` Baruch Siach
@ 2017-11-14 2:48 ` Philip Derrin
1 sibling, 0 replies; 10+ messages in thread
From: Philip Derrin @ 2017-11-14 2:48 UTC (permalink / raw)
To: linux-arm-kernel
On 09/11/17 20:37, Russell King - ARM Linux wrote:
> On Wed, Nov 08, 2017 at 05:23:43PM -0800, Kees Cook wrote:
>> On Wed, Nov 8, 2017 at 4:41 PM, Philip Derrin <philip@cog.systems> wrote:
>>> Hi,
>>>
>>> This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
>>> when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
>>> mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
>>> merged in 3.19.
>>>
>>> The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
>>> mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
>>> implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
>>> sections to be read-only"), and another that moved the LPAE read-only bit into
>>> a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
>>> logic for LPAE").
>>>
>>> The incorrect mappings were not apparent in the debugfs kernel_page_tables
>>> dump because that was checking only the software RO bit, not the hardware RO
>>> bit.
>> Thanks for catching this! Please consider both patches:
>>
>> Reviewed-by: Kees Cook <keescook@chromium.org>
> Where are these patches, and why weren't they copied to the arm kernel
> list?
I've added these to the patch tracker, as 8721/1 and 8722/1.
Thanks,
Philip
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y
2017-11-09 0:41 [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y Philip Derrin
` (2 preceding siblings ...)
2017-11-09 1:23 ` [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y Kees Cook
@ 2017-11-20 18:45 ` Florian Fainelli
2017-11-20 19:01 ` Kees Cook
3 siblings, 1 reply; 10+ messages in thread
From: Florian Fainelli @ 2017-11-20 18:45 UTC (permalink / raw)
To: linux-arm-kernel
On 11/08/2017 04:41 PM, Philip Derrin wrote:
> Hi,
>
> This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
> when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
> mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
> merged in 3.19.
>
> The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
> mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
> implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
> sections to be read-only"), and another that moved the LPAE read-only bit into
> a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
> logic for LPAE").
>
> The incorrect mappings were not apparent in the debugfs kernel_page_tables
> dump because that was checking only the software RO bit, not the hardware RO
> bit.
FWIW, on an ARCH_BRCMSTB system with ARM_LPAE=y:
Tested-by: Florian Fainelli <f.fainelli@gmail.com>
--
Florian
^ permalink raw reply [flat|nested] 10+ messages in thread* [PATCH 0/2] STRICT_KERNEL_RWX weakened on ARM by CONFIG_ARM_LPAE=y
2017-11-20 18:45 ` Florian Fainelli
@ 2017-11-20 19:01 ` Kees Cook
0 siblings, 0 replies; 10+ messages in thread
From: Kees Cook @ 2017-11-20 19:01 UTC (permalink / raw)
To: linux-arm-kernel
On Mon, Nov 20, 2017 at 10:45 AM, Florian Fainelli <f.fainelli@gmail.com> wrote:
> On 11/08/2017 04:41 PM, Philip Derrin wrote:
>> Hi,
>>
>> This patch series fixes a bug which makes CONFIG_STRICT_KERNEL_RWX ineffective
>> when CONFIG_ARM_LPAE is enabled. Specifically, the kernel text and rodata are
>> mapped writeable. This has been the case since DEBUG_RODATA for ARM was first
>> merged in 3.19.
>>
>> The cause was an incorrect conflict resolution in 1e3479225acb ("ARM: 8275/1:
>> mm: fix PMD_SECT_RDONLY undeclared compile error") between the commit that
>> implemented DEBUG_RODATA, 80d6b0c2eed2 ("ARM: mm: allow text and rodata
>> sections to be read-only"), and another that moved the LPAE read-only bit into
>> a software bit, ded947798469 ("ARM: 8109/1: mm: Modify pte_write and pmd_write
>> logic for LPAE").
>>
>> The incorrect mappings were not apparent in the debugfs kernel_page_tables
>> dump because that was checking only the software RO bit, not the hardware RO
>> bit.
>
> FWIW, on an ARCH_BRCMSTB system with ARM_LPAE=y:
>
> Tested-by: Florian Fainelli <f.fainelli@gmail.com>
Russell, given this fixes an accidentally broken feature, is there any
hope for this series to land in v4.15?
Thanks!
-Kees
--
Kees Cook
Pixel Security
^ permalink raw reply [flat|nested] 10+ messages in thread