openkylin
/
linux
mirror of https://gitee.com/openkylin/linux.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

arm64: mm: Mark .rodata as RO 

Currently the .rodata section is actually still executable when DEBUG_RODATA
is enabled. This changes that so the .rodata is actually read only, no execute.
It also adds the .rodata section to the mem_init banner.

Signed-off-by: Jeremy Linton <jeremy.linton@arm.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Acked-by: Mark Rutland <mark.rutland@arm.com>
[catalin.marinas@arm.com: added vm_struct vmlinux_rodata in map_kernel()]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
This commit is contained in:
Jeremy Linton 2016-02-19 11:50:32 -06:00 committed by Catalin Marinas
parent b7dc8d16e7
commit 2f39b5f91e
3 changed files with 19 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
arch/arm64/kernel/vmlinux.lds.S
View File

@ -114,8 +114,9 @@ SECTIONS
*(.got) /* Global offset table */ *(.got) /* Global offset table */
} }
RO_DATA(PAGE_SIZE) ALIGN_DEBUG_RO_MIN(PAGE_SIZE)
EXCEPTION_TABLE(8) RO_DATA(PAGE_SIZE) /* everything from this point to */
EXCEPTION_TABLE(8) /* _etext will be marked RO NX */
NOTES NOTES
ALIGN_DEBUG_RO_MIN(PAGE_SIZE) ALIGN_DEBUG_RO_MIN(PAGE_SIZE)

4
arch/arm64/mm/init.c
View File

@ -363,6 +363,7 @@ void __init mem_init(void)
" vmalloc : 0x%16lx - 0x%16lx (%6ld GB)\n" " vmalloc : 0x%16lx - 0x%16lx (%6ld GB)\n"
" .init : 0x%p" " - 0x%p" " (%6ld KB)\n" " .init : 0x%p" " - 0x%p" " (%6ld KB)\n"
" .text : 0x%p" " - 0x%p" " (%6ld KB)\n" " .text : 0x%p" " - 0x%p" " (%6ld KB)\n"
" .rodata : 0x%p" " - 0x%p" " (%6ld KB)\n"
" .data : 0x%p" " - 0x%p" " (%6ld KB)\n" " .data : 0x%p" " - 0x%p" " (%6ld KB)\n"
#ifdef CONFIG_SPARSEMEM_VMEMMAP #ifdef CONFIG_SPARSEMEM_VMEMMAP
" vmemmap : 0x%16lx - 0x%16lx (%6ld GB maximum)\n" " vmemmap : 0x%16lx - 0x%16lx (%6ld GB maximum)\n"
@ -377,7 +378,8 @@ void __init mem_init(void)
MLM(MODULES_VADDR, MODULES_END), MLM(MODULES_VADDR, MODULES_END),
MLG(VMALLOC_START, VMALLOC_END), MLG(VMALLOC_START, VMALLOC_END),
MLK_ROUNDUP(__init_begin, __init_end), MLK_ROUNDUP(__init_begin, __init_end),
MLK_ROUNDUP(_text, _etext), MLK_ROUNDUP(_text, __start_rodata),
MLK_ROUNDUP(__start_rodata, _etext),
MLK_ROUNDUP(_sdata, _edata), MLK_ROUNDUP(_sdata, _edata),
#ifdef CONFIG_SPARSEMEM_VMEMMAP #ifdef CONFIG_SPARSEMEM_VMEMMAP
MLG((unsigned long)vmemmap, MLG((unsigned long)vmemmap,

19
arch/arm64/mm/mmu.c
View File

@ -449,12 +449,18 @@ static void __init map_mem(pgd_t *pgd)
void mark_rodata_ro(void) void mark_rodata_ro(void)
{ {
if (!IS_ENABLED(CONFIG_DEBUG_RODATA)) unsigned long section_size;
return;
section_size = (unsigned long)__start_rodata - (unsigned long)_stext;
create_mapping_late(__pa(_stext), (unsigned long)_stext, create_mapping_late(__pa(_stext), (unsigned long)_stext,
(unsigned long)_etext - (unsigned long)_stext, section_size, PAGE_KERNEL_ROX);
PAGE_KERNEL_ROX); /*
* mark .rodata as read only. Use _etext rather than __end_rodata to
* cover NOTES and EXCEPTION_TABLE.
*/
section_size = (unsigned long)_etext - (unsigned long)__start_rodata;
create_mapping_late(__pa(__start_rodata), (unsigned long)__start_rodata,
section_size, PAGE_KERNEL_RO);
} }
void fixup_init(void) void fixup_init(void)
@ -493,9 +499,10 @@ static void __init map_kernel_chunk(pgd_t *pgd, void *va_start, void *va_end,
*/ */
static void __init map_kernel(pgd_t *pgd) static void __init map_kernel(pgd_t *pgd)
{ {
static struct vm_struct vmlinux_text, vmlinux_init, vmlinux_data; static struct vm_struct vmlinux_text, vmlinux_rodata, vmlinux_init, vmlinux_data;
map_kernel_chunk(pgd, _stext, _etext, PAGE_KERNEL_EXEC, &vmlinux_text); map_kernel_chunk(pgd, _stext, __start_rodata, PAGE_KERNEL_EXEC, &vmlinux_text);
map_kernel_chunk(pgd, __start_rodata, _etext, PAGE_KERNEL, &vmlinux_rodata);
map_kernel_chunk(pgd, __init_begin, __init_end, PAGE_KERNEL_EXEC, map_kernel_chunk(pgd, __init_begin, __init_end, PAGE_KERNEL_EXEC,
&vmlinux_init); &vmlinux_init);
map_kernel_chunk(pgd, _data, _end, PAGE_KERNEL, &vmlinux_data); map_kernel_chunk(pgd, _data, _end, PAGE_KERNEL, &vmlinux_data);