diff options
| author | Atish Patra <atish.patra@wdc.com> | 2020-11-05 03:04:38 +0300 |
|---|---|---|
| committer | Palmer Dabbelt <palmerdabbelt@google.com> | 2020-11-26 03:05:28 +0300 |
| commit | 19a00869028f4a28a36f90649166631dff6e3ccd (patch) | |
| tree | ef4a68e11c94a44d7e9de3f6f83fe57877739ba9 /arch/riscv/mm/pageattr.c | |
| parent | b6566dc1acca38ce6ed845ce8a270fb181ff6d41 (diff) | |
| download | linux-19a00869028f4a28a36f90649166631dff6e3ccd.tar.xz | |
RISC-V: Protect all kernel sections including init early
Currently, .init.text & .init.data are intermixed which makes it impossible
apply different permissions to them. .init.data shouldn't need exec
permissions while .init.text shouldn't have write permission. Moreover,
the strict permission are only enforced /init starts. This leaves the
kernel vulnerable from possible buggy built-in modules.
Keep .init.text & .data in separate sections so that different permissions
are applied to each section. Apply permissions to individual sections as
early as possible. This improves the kernel protection under
CONFIG_STRICT_KERNEL_RWX. We also need to restore the permissions for the
entire _init section after it is freed so that those pages can be used
for other purpose.
Signed-off-by: Atish Patra <atish.patra@wdc.com>
Tested-by: Greentime Hu <greentime.hu@sifive.com>
Signed-off-by: Palmer Dabbelt <palmerdabbelt@google.com>
Diffstat (limited to 'arch/riscv/mm/pageattr.c')
| -rw-r--r-- | arch/riscv/mm/pageattr.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/arch/riscv/mm/pageattr.c b/arch/riscv/mm/pageattr.c index 19fecb362d81..c64ec224fd0c 100644 --- a/arch/riscv/mm/pageattr.c +++ b/arch/riscv/mm/pageattr.c @@ -128,6 +128,12 @@ static int __set_memory(unsigned long addr, int numpages, pgprot_t set_mask, return ret; } +int set_memory_rw_nx(unsigned long addr, int numpages) +{ + return __set_memory(addr, numpages, __pgprot(_PAGE_READ | _PAGE_WRITE), + __pgprot(_PAGE_EXEC)); +} + int set_memory_ro(unsigned long addr, int numpages) { return __set_memory(addr, numpages, __pgprot(_PAGE_READ), |