From patchwork Tue Apr 21 08:17:12 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Zong Li X-Patchwork-Id: 11500787 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 66B531392 for ; Tue, 21 Apr 2020 08:17:31 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 33A6C2073A for ; Tue, 21 Apr 2020 08:17:31 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=sifive.com header.i=@sifive.com header.b="cj0aBop9" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 33A6C2073A Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=sifive.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 2DD6B8E0006; Tue, 21 Apr 2020 04:17:30 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id 2B3F18E0003; Tue, 21 Apr 2020 04:17:30 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 1F1D98E0006; Tue, 21 Apr 2020 04:17:30 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0049.hostedemail.com [216.40.44.49]) by kanga.kvack.org (Postfix) with ESMTP id 0BC228E0003 for ; Tue, 21 Apr 2020 04:17:30 -0400 (EDT) Received: from smtpin24.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id AE05C40C7 for ; Tue, 21 Apr 2020 08:17:29 +0000 (UTC) X-FDA: 76731157818.24.game65_731a72808013 X-Spam-Summary: 2,0,0,925e2fc728ba4906,d41d8cd98f00b204,zong.li@sifive.com,,RULES_HIT:41:355:379:541:800:960:973:988:989:1260:1311:1314:1345:1359:1431:1437:1515:1534:1541:1711:1730:1747:1777:1792:2194:2199:2393:2559:2562:2894:3138:3139:3140:3141:3142:3353:3865:3866:3867:3870:3871:3872:3874:4605:5007:6261:6653:6737:10004:11026:11473:11658:11914:12043:12048:12291:12296:12297:12517:12519:12555:12683:12895:13069:13095:13311:13357:13894:14096:14110:14181:14384:14394:14721:21080:21433:21444:21451:21627:21939:30054:30070,0,RBL:209.85.210.193:@sifive.com:.lbl8.mailshell.net-62.2.0.100 66.100.201.201,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:25,LUA_SUMMARY:none X-HE-Tag: game65_731a72808013 X-Filterd-Recvd-Size: 4927 Received: from mail-pf1-f193.google.com (mail-pf1-f193.google.com [209.85.210.193]) by imf18.hostedemail.com (Postfix) with ESMTP for ; Tue, 21 Apr 2020 08:17:29 +0000 (UTC) Received: by mail-pf1-f193.google.com with SMTP id x15so2010163pfa.1 for ; Tue, 21 Apr 2020 01:17:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sifive.com; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=qCOK+HxEBj2bh5BFlG2zt/46BhY0DW9NF3gypZJ6i18=; b=cj0aBop907dm+mkl5z5Mfm3dfJHK382iyGGadBdhXTU4SezE2MCsVNmjWKHydO1MeY hFpq9McPFpfy4rmx7G+Ad1j8hWL2TnkmF0IkMCtKAGmpU+zQZ6aqaTdmOppP8E8jMoFd Fk88jdQI+8R4LkqajRqwVMi8EwnmwqLx6QnbQ8a9F0T2Mu69VHyd9ana73iFO3tfR1QY WOG8lsevniXIBle/Wpw32M1HPnUM/cXVhVfyULOzUIUxNwMYRjXLGcKHakrVVhIkdCst HcA/EUYHskjCRFk4RGeoZHsmrSkm/oL6EadoBmaeDy9n6/Ei3y51wlw/4DW50BwDLHDj 41mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=qCOK+HxEBj2bh5BFlG2zt/46BhY0DW9NF3gypZJ6i18=; b=PHTKSEqLutAdV+JfyUSysoynz034r9YvjJfi6cvjhSG5hCjXeIqcmnJJIdEsobSLYD 2Wibrq2WDV800J1QLQXDD+9fV4Bbz+WanEFBVZqIWmfy/qKJpahnAoSHn7rRu/EaejXq hldRb5HL987nfUX/2nH/gqjCRkEMh+hdoXl4u1+FTufmTlF5bBoDsTmCQX8WgEnt/g4r nBXAfA1jBeFqRLwY5EYklLjr7UUBVkYPcBSDA8rwoHBEoGfqcLyvz68LyIWuxlLIpvaF EykwOrBxA7OEMTXjxvey0RltyermIcaGh6CsPM8pLUlY9BRcodim78yCGIzop2723n5z H6Ww== X-Gm-Message-State: AGi0Pua6Rq+89l/C04zOHHrt06fmnaVy24VQN6h7v1/bnMaBGGF9iS0Y 6ystm5CcSjwD5djBhQVi6ziItA== X-Google-Smtp-Source: APiQypLl5oCj7vFGv7zZNaxGJsgDSRmBearvlFa0TCQKMUrRrSskifrV8HFOIzfmSxRHB+7OBiCjMA== X-Received: by 2002:a62:18c8:: with SMTP id 191mr21232603pfy.255.1587457048276; Tue, 21 Apr 2020 01:17:28 -0700 (PDT) Received: from hsinchu02.internal.sifive.com (114-34-229-221.HINET-IP.hinet.net. [114.34.229.221]) by smtp.gmail.com with ESMTPSA id v9sm1610067pju.3.2020.04.21.01.17.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Apr 2020 01:17:27 -0700 (PDT) From: Zong Li To: akpm@linux-foundation.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, paul.walmsley@sifive.com, palmer@dabbelt.com, linux-riscv@lists.infradead.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, x86@kernel.org, hpa@zytor.com, catalin.marinas@arm.com, will@kernel.org, linux-arm-kernel@lists.infradead.org Cc: Zong Li Subject: [PATCH 1/4] mm: add DEBUG_WX support Date: Tue, 21 Apr 2020 16:17:12 +0800 Message-Id: <23980cd0f0e5d79e24a92169116407c75bcc650d.1587455584.git.zong.li@sifive.com> X-Mailer: git-send-email 2.26.1 In-Reply-To: References: MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Some architectures support DEBUG_WX function, it's verbatim from each others. Extract to mm/Kconfig.debug for shared use. Signed-off-by: Zong Li Suggested-by: Palmer Dabbelt --- mm/Kconfig.debug | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/mm/Kconfig.debug b/mm/Kconfig.debug index 0271b22e063f..077458ad968d 100644 --- a/mm/Kconfig.debug +++ b/mm/Kconfig.debug @@ -118,6 +118,39 @@ config DEBUG_RODATA_TEST ---help--- This option enables a testcase for the setting rodata read-only. +config ARCH_HAS_DEBUG_WX + bool + +config DEBUG_WX + bool "Warn on W+X mappings at boot" + depends on ARCH_HAS_DEBUG_WX + select PTDUMP_CORE + help + Generate a warning if any W+X mappings are found at boot. + + This is useful for discovering cases where the kernel is leaving + W+X mappings after applying NX, as such mappings are a security risk. + This check also includes UXN, which should be set on all kernel + mappings. + + Look for a message in dmesg output like this: + + /mm: Checked W+X mappings: passed, no W+X pages found. + + or like this, if the check failed: + + /mm: Checked W+X mappings: failed, W+X pages found. + + Note that even if the check fails, your kernel is possibly + still fine, as W+X mappings are not a security hole in + themselves, what they do is that they make the exploitation + of other unfixed kernel bugs easier. + + There is no runtime or memory usage effect of this option + once the kernel has booted up - it's a one time check. + + If in doubt, say "Y". + config GENERIC_PTDUMP bool