On Thu, Oct 1, 2015 at 6:04 AM, Stephen Smalley <s...@tycho.nsa.gov> wrote: > Unused space between the end of __ex_table and the start of rodata > can be left W+x in the kernel page tables. Extend the setting > of the NX bit to cover this gap by starting from text_end rather than > rodata_start. > > Before: > ---[ High Kernel Mapping ]--- > 0xffffffff80000000-0xffffffff81000000 16M > pmd > 0xffffffff81000000-0xffffffff81600000 6M ro PSE GLB > x pmd > 0xffffffff81600000-0xffffffff81754000 1360K ro GLB > x pte > 0xffffffff81754000-0xffffffff81800000 688K RW GLB > x pte > 0xffffffff81800000-0xffffffff81a00000 2M ro PSE GLB > NX pmd > 0xffffffff81a00000-0xffffffff81b3b000 1260K ro GLB > NX pte > 0xffffffff81b3b000-0xffffffff82000000 4884K RW GLB > NX pte > 0xffffffff82000000-0xffffffff82200000 2M RW PSE GLB > NX pmd > 0xffffffff82200000-0xffffffffa0000000 478M > pmd > > After: > ---[ High Kernel Mapping ]--- > 0xffffffff80000000-0xffffffff81000000 16M > pmd > 0xffffffff81000000-0xffffffff81600000 6M ro PSE GLB > x pmd > 0xffffffff81600000-0xffffffff81754000 1360K ro GLB > x pte > 0xffffffff81754000-0xffffffff81800000 688K RW GLB > NX pte > 0xffffffff81800000-0xffffffff81a00000 2M ro PSE GLB > NX pmd > 0xffffffff81a00000-0xffffffff81b3b000 1260K ro GLB > NX pte > 0xffffffff81b3b000-0xffffffff82000000 4884K RW GLB > NX pte > 0xffffffff82000000-0xffffffff82200000 2M RW PSE GLB > NX pmd > 0xffffffff82200000-0xffffffffa0000000 478M > pmd > > Signed-off-by: Stephen Smalley <s...@tycho.nsa.gov>
Acked-by: Kees Cook <keesc...@chromium.org> -Kees > --- > arch/x86/mm/init_64.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c > index 30564e2..df48430 100644 > --- a/arch/x86/mm/init_64.c > +++ b/arch/x86/mm/init_64.c > @@ -1132,7 +1132,7 @@ void mark_rodata_ro(void) > * has been zapped already via cleanup_highmem(). > */ > all_end = roundup((unsigned long)_brk_end, PMD_SIZE); > - set_memory_nx(rodata_start, (all_end - rodata_start) >> PAGE_SHIFT); > + set_memory_nx(text_end, (all_end - text_end) >> PAGE_SHIFT); > > rodata_test(); > > -- > 2.1.0 > -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
