Eric Lee / smarc-ti-linux-kernel

5
Download as
Browse Code ยป

Commit 45e2a9d4701d8c624d4a4bcdd1084eae31e92f58

Authored by Kees Cook
Committed by Thomas Gleixner
1 parent fb86b97300
Exists in ti-lsk-linux-4.1.y and in 10 other branches dlt-processor-sdk-linux-03.00.00.04, processor-sdk-linux-02.00.01, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04

x86, mm: Set NX across entire PMD at boot 

When setting up permissions on kernel memory at boot, the end of the
PMD that was split from bss remained executable. It should be NX like
the rest. This performs a PMD alignment instead of a PAGE alignment to
get the correct span of memory.

Before:
---[ High Kernel Mapping ]---
...
0xffffffff8202d000-0xffffffff82200000  1868K     RW       GLB NX pte
0xffffffff82200000-0xffffffff82c00000    10M     RW   PSE GLB NX pmd
0xffffffff82c00000-0xffffffff82df5000  2004K     RW       GLB NX pte
0xffffffff82df5000-0xffffffff82e00000    44K     RW       GLB x  pte
0xffffffff82e00000-0xffffffffc0000000   978M                     pmd

After:
---[ High Kernel Mapping ]---
...
0xffffffff8202d000-0xffffffff82200000  1868K     RW       GLB NX pte
0xffffffff82200000-0xffffffff82e00000    12M     RW   PSE GLB NX pmd
0xffffffff82e00000-0xffffffffc0000000   978M                     pmd

[ tglx: Changed it to roundup(_brk_end, PMD_SIZE) and added a comment.
        We really should unmap the reminder along with the holes
        caused by init,initdata etc. but thats a different issue ]

Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Toshi Kani <toshi.kani@hp.com>
Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Cc: David Vrabel <david.vrabel@citrix.com>
Cc: Wang Nan <wangnan0@huawei.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: stable@vger.kernel.org
Link: http://lkml.kernel.org/r/20141114194737.GA3091@www.outflux.net
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

Showing 1 changed file with 10 additions and 1 deletions Side-by-side Diff

arch/x86/mm/init_64.c
Diff comments   View file @ 45e2a9d
... ... @@ -1123,7 +1123,7 @@
1123 1123 unsigned long end = (unsigned long) &__end_rodata_hpage_align;
1124 1124 unsigned long text_end = PFN_ALIGN(&__stop___ex_table);
1125 1125 unsigned long rodata_end = PFN_ALIGN(&__end_rodata);
1126   - unsigned long all_end = PFN_ALIGN(&_end);
  1126 + unsigned long all_end;
1127 1127  
1128 1128 printk(KERN_INFO "Write protecting the kernel read-only data: %luk\n",
1129 1129 (end - start) >> 10);
1130 1130  
... ... @@ -1134,7 +1134,16 @@
1134 1134 /*
1135 1135 * The rodata/data/bss/brk section (but not the kernel text!)
1136 1136 * should also be not-executable.
  1137 + *
  1138 + * We align all_end to PMD_SIZE because the existing mapping
  1139 + * is a full PMD. If we would align _brk_end to PAGE_SIZE we
  1140 + * split the PMD and the reminder between _brk_end and the end
  1141 + * of the PMD will remain mapped executable.
  1142 + *
  1143 + * Any PMD which was setup after the one which covers _brk_end
  1144 + * has been zapped already via cleanup_highmem().
1137 1145 */
  1146 + all_end = roundup((unsigned long)_brk_end, PMD_SIZE);
1138 1147 set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT);
1139 1148  
1140 1149 rodata_test();