Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1239857
| From | Stephen Smalley <sds@tycho.nsa.gov> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v2] x86/mm: warn on W+x mappings |
| Date | 2015-10-05 21:20 +0200 |
| Message-ID | <qgjsJ-821-9@gated-at.bofh.it> (permalink) |
| References | <qff7Q-5Cf-15@gated-at.bofh.it> <qftaN-nH-3@gated-at.bofh.it> |
| Organization | National Security Agency |
On 10/03/2015 07:27 AM, Ingo Molnar wrote:
>
> * Stephen Smalley <sds@tycho.nsa.gov> wrote:
>
>> diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
>> index 30564e2..f8b1573 100644
>> --- a/arch/x86/mm/init_64.c
>> +++ b/arch/x86/mm/init_64.c
>> @@ -1150,6 +1150,8 @@ void mark_rodata_ro(void)
>> free_init_pages("unused kernel",
>> (unsigned long) __va(__pa_symbol(rodata_end)),
>> (unsigned long) __va(__pa_symbol(_sdata)));
>> +
>> + debug_checkwx();
>
> Any reason to not do this on NX capable 32-bit kernels as well?
Done in v3. However, I do see lots of W+X mappings there.
[ 1.012796] WARNING: CPU: 1 PID: 1 at arch/x86/mm/dump_pagetables.c:225 note_page+0x65d/0x840()
[ 1.012803] x86/mm: Found insecure W+X mapping at address f4a00000/0xf4a00000
[ 1.012805] Modules linked in:
[ 1.012833] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.3.0-rc4+ #2
[ 1.012837] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153950- 04/01/2014
[ 1.012844] c0d32967 173b7da7 00000000 f7105e7c c0713490 f7105ebc f7105eac c045d077
[ 1.012848] c0c47ef8 f7105edc 00000001 c0c4de42 000000e1 c04551fd c04551fd f7105f3c
[ 1.012851] 00000002 00000000 f7105ec8 c045d0ee 00000009 f7105ebc c0c47ef8 f7105edc
[ 1.012855] Call Trace:
[ 1.012868] [<c0713490>] dump_stack+0x41/0x61
[ 1.012871] [<c045d077>] warn_slowpath_common+0x87/0xc0
[ 1.012873] [<c04551fd>] ? note_page+0x65d/0x840
[ 1.012875] [<c04551fd>] ? note_page+0x65d/0x840
[ 1.012877] [<c045d0ee>] warn_slowpath_fmt+0x3e/0x60
[ 1.012878] [<c04551fd>] note_page+0x65d/0x840
[ 1.012880] [<c04555b6>] ptdump_walk_pgd_level_core+0x1d6/0x2d0
[ 1.012883] [<c04557a6>] ptdump_walk_pgd_level_checkwx+0x16/0x20
[ 1.012886] [<c044ba15>] mark_rodata_ro+0x135/0x160
[ 1.012898] [<c0a9b33f>] kernel_init+0x1f/0xe0
[ 1.012906] [<c0484b41>] ? schedule_tail+0x11/0x50
[ 1.012909] [<c0aa0bc1>] ret_from_kernel_thread+0x21/0x30
[ 1.012910] [<c0a9b320>] ? rest_init+0x70/0x70
[ 1.012912] ---[ end trace 40a4f3d5e8fb70ac ]---
[ 1.012954] x86/mm: Checked W+X mappings: FAILED, 6556 W+X pages found.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH v2] x86/mm: warn on W+x mappings Stephen Smalley <sds@tycho.nsa.gov> - 2015-10-02 22:30 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Kees Cook <keescook@chromium.org> - 2015-10-02 22:50 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-03 13:30 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Stephen Smalley <sds@tycho.nsa.gov> - 2015-10-05 21:20 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-06 09:40 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Stephen Smalley <sds@tycho.nsa.gov> - 2015-10-06 17:50 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Borislav Petkov <bp@alien8.de> - 2015-10-12 13:40 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Matt Fleming <matt@codeblueprint.co.uk> - 2015-10-12 14:50 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-12 14:50 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Matt Fleming <matt@codeblueprint.co.uk> - 2015-10-12 15:00 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-12 16:20 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Matt Fleming <matt@codeblueprint.co.uk> - 2015-10-12 16:50 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2015-10-12 17:40 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Matt Fleming <matt@codeblueprint.co.uk> - 2015-10-12 18:00 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2015-10-12 18:50 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-14 17:20 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Borislav Petkov <bp@alien8.de> - 2015-10-14 17:40 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Matt Fleming <matt@codeblueprint.co.uk> - 2015-10-15 12:20 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Borislav Petkov <bp@alien8.de> - 2015-10-15 12:40 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ricardo Neri <ricardo.neri-calderon@linux.intel.com> - 2015-10-16 03:50 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Andy Lutomirski <luto@amacapital.net> - 2015-10-14 17:40 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Matt Fleming <matt@codeblueprint.co.uk> - 2015-10-14 23:10 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Josh Triplett <josh@joshtriplett.org> - 2015-10-12 17:00 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Ingo Molnar <mingo@kernel.org> - 2015-10-14 17:30 +0200
Re: [PATCH v2] x86/mm: warn on W+x mappings Josh Triplett <josh@joshtriplett.org> - 2015-10-14 18:50 +0200
csiph-web