Yang Yingliang
ae415d7a27
modules: fix BUG when load module with rodata=n
commit 2eef1399a866c57687962e15142b141a4f8e7862 upstream.
When loading a module with rodata=n, it causes an executing
NX-protected page BUG.
[ 32.379191] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
[ 32.382917] BUG: unable to handle page fault for address: ffffffffc0005000
[ 32.385947] #PF: supervisor instruction fetch in kernel mode
[ 32.387662] #PF: error_code(0x0011) - permissions violation
[ 32.389352] PGD 240c067 P4D 240c067 PUD 240e067 PMD 421a52067 PTE 8000000421a53063
[ 32.391396] Oops: 0011 [#1] SMP PTI
[ 32.392478] CPU: 7 PID: 2697 Comm: insmod Tainted: G O 5.2.0-rc5+ #202
[ 32.394588] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[ 32.398157] RIP: 0010:ko_test_init+0x0/0x1000 [ko_test]
[ 32.399662] Code: Bad RIP value.
[ 32.400621] RSP: 0018:ffffc900029f3ca8 EFLAGS: 00010246
[ 32.402171] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 32.404332] RDX: 00000000000004c7 RSI: 0000000000000cc0 RDI: ffffffffc0005000
[ 32.406347] RBP: ffffffffc0005000 R08: ffff88842fbebc40 R09: ffffffff810ede4a
[ 32.408392] R10: ffffea00108e3480 R11: 0000000000000000 R12: ffff88842bee21a0
[ 32.410472] R13: 0000000000000001 R14: 0000000000000001 R15: ffffc900029f3e78
[ 32.412609] FS: 00007fb4f0c0a700(0000) GS:ffff88842fbc0000(0000) knlGS:0000000000000000
[ 32.414722] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 32.416290] CR2: ffffffffc0004fd6 CR3: 0000000421a90004 CR4: 0000000000020ee0
[ 32.418471] Call Trace:
[ 32.419136] do_one_initcall+0x41/0x1df
[ 32.420199] ? _cond_resched+0x10/0x40
[ 32.421433] ? kmem_cache_alloc_trace+0x36/0x160
[ 32.422827] do_init_module+0x56/0x1f7
[ 32.423946] load_module+0x1e67/0x2580
[ 32.424947] ? __alloc_pages_nodemask+0x150/0x2c0
[ 32.426413] ? map_vm_area+0x2d/0x40
[ 32.427530] ? __vmalloc_node_range+0x1ef/0x260
[ 32.428850] ? __do_sys_init_module+0x135/0x170
[ 32.430060] ? _cond_resched+0x10/0x40
[ 32.431249] __do_sys_init_module+0x135/0x170
[ 32.432547] do_syscall_64+0x43/0x120
[ 32.433853] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Because if rodata=n, set_memory_x() can't be called, fix this by
calling set_memory_x in complete_formation();
Fixes: f2c65fb3221a ("x86/modules: Avoid breaking W^X while loading modules")
Suggested-by: Jian Cheng <cj.chengjian@huawei.com>
Reviewed-by: Nadav Amit <namit@vmware.com>
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
2019-09-19 09:09:40 +02:00 |
| .. |
|
bpf
|
bpf: silence warning messages in core
|
2019-07-26 09:14:06 +02:00 |
|
cgroup
|
cgroup: Fix css_task_iter_advance_css_set() cset skip condition
|
2019-08-09 17:52:35 +02:00 |
|
configs
|
kconfig: tinyconfig: remove stale stack protector fixups
|
2018-06-15 07:15:28 +09:00 |
|
debug
|
kdb: Don't back trace on a cpu that didn't round up
|
2019-02-12 19:47:19 +01:00 |
|
dma
|
dma-direct: do not include SME mask in the DMA supported check
|
2019-01-13 09:51:05 +01:00 |
|
events
|
perf/core: Fix creating kernel counters for PMUs that override event->cpu
|
2019-08-16 10:12:50 +02:00 |
|
gcov
|
gcov: remove CONFIG_GCOV_FORMAT_AUTODETECT
|
2018-06-08 18:56:02 +09:00 |
|
irq
|
genirq: Prevent NULL pointer dereference in resend_irqs()
|
2019-09-19 09:09:34 +02:00 |
|
livepatch
|
module: Fix livepatch/ftrace module text permissions race
|
2019-07-10 09:53:40 +02:00 |
|
locking
|
locking/lockdep: Hide unused 'class' variable
|
2019-07-31 07:27:09 +02:00 |
|
power
|
x86/power: Fix 'nosmt' vs hibernation triple fault during resume
|
2019-06-11 12:20:52 +02:00 |
|
printk
|
printk: Fix panic caused by passing log_buf_len to command line
|
2018-11-13 11:08:48 -08:00 |
|
rcu
|
rcuperf: Fix cleanup path for invalid perf_type strings
|
2019-05-31 06:46:30 -07:00 |
|
sched
|
sched/fair: Don't assign runtime for throttled cfs_rq
|
2019-09-16 08:21:40 +02:00 |
|
time
|
timekeeping: Use proper ktime_add when adding nsecs in coarse offset
|
2019-09-16 08:21:42 +02:00 |
|
trace
|
ftrace: Check for empty hash and comment the race with registering probes
|
2019-09-06 10:22:13 +02:00 |
|
.gitignore
|
|
|
|
acct.c
|
acct_on(): don't mess with freeze protection
|
2019-05-31 06:46:05 -07:00 |
|
async.c
|
kernel/async.c: revert "async: simplify lowest_in_progress()"
|
2018-02-06 18:32:44 -08:00 |
|
audit.c
|
audit: use ktime_get_coarse_real_ts64() for timestamps
|
2018-07-17 14:45:08 -04:00 |
|
audit.h
|
audit: track the owner of the command mutex ourselves
|
2018-02-23 11:22:22 -05:00 |
|
audit_fsnotify.c
|
fsnotify: add fsnotify_add_inode_mark() wrappers
|
2018-05-18 14:58:22 +02:00 |
|
audit_tree.c
|
\n
|
2018-08-17 09:41:28 -07:00 |
|
audit_watch.c
|
audit: fix use-after-free in audit_add_watch
|
2018-07-18 11:43:36 -04:00 |
|
auditfilter.c
|
audit: fix a memory leak bug
|
2019-05-31 06:46:17 -07:00 |
|
auditsc.c
|
audit/stable-4.18 PR 20180814
|
2018-08-15 10:46:54 -07:00 |
|
backtracetest.c
|
|
|
|
bounds.c
|
kbuild: fix kernel/bounds.c 'W=1' warning
|
2018-11-13 11:08:47 -08:00 |
|
capability.c
|
|
|
|
compat.c
|
time: Enable get/put_compat_itimerspec64 always
|
2018-06-24 14:39:47 +02:00 |
|
configs.c
|
|
|
|
context_tracking.c
|
|
|
|
cpu.c
|
cpu/hotplug: Fix out-of-bounds read when setting fail state
|
2019-07-21 09:03:11 +02:00 |
|
cpu_pm.c
|
|
|
|
crash_core.c
|
kernel/crash_core.c: print timestamp using time64_t
|
2018-08-22 10:52:47 -07:00 |
|
crash_dump.c
|
|
|
|
cred.c
|
access: avoid the RCU grace period for the temporary subjective credentials
|
2019-07-31 07:27:11 +02:00 |
|
delayacct.c
|
delayacct: Use raw_spinlocks
|
2018-04-27 14:34:51 +02:00 |
|
dma.c
|
proc: introduce proc_create_single{,_data}
|
2018-05-16 07:23:35 +02:00 |
|
elfcore.c
|
|
|
|
exec_domain.c
|
proc: introduce proc_create_single{,_data}
|
2018-05-16 07:23:35 +02:00 |
|
exit.c
|
cgroup: Call cgroup_release() before __exit_signal()
|
2019-08-09 17:52:34 +02:00 |
|
extable.c
|
extable: Make init_kernel_text() global
|
2018-02-21 16:54:06 +01:00 |
|
fail_function.c
|
bpf/error-inject/kprobes: Clear current_kprobe and enable preempt in kprobe
|
2018-06-21 12:33:19 +02:00 |
|
fork.c
|
sched/fair: Don't free p->numa_faults with concurrent readers
|
2019-08-04 09:30:56 +02:00 |
|
freezer.c
|
PM / reboot: Eliminate race between reboot and suspend
|
2018-08-06 12:35:20 +02:00 |
|
futex.c
|
locking/futex: Allow low-level atomic operations to return -EAGAIN
|
2019-05-10 17:54:11 +02:00 |
|
futex_compat.c
|
|
|
|
groups.c
|
|
|
|
hung_task.c
|
kernel: hung_task.c: disable on suspend
|
2019-04-20 09:16:02 +02:00 |
|
iomem.c
|
memremap: split devm_memremap_pages() and memremap() infrastructure
|
2018-05-15 23:08:33 -07:00 |
|
irq_work.c
|
irq_work: Do not raise an IPI when queueing work on the local CPU
|
2019-05-31 06:46:19 -07:00 |
|
jump_label.c
|
jump_label: move 'asm goto' support test to Kconfig
|
2019-06-04 08:02:34 +02:00 |
|
kallsyms.c
|
kallsyms, x86: Export addresses of PTI entry trampolines
|
2018-08-14 19:12:29 -03:00 |
|
kcmp.c
|
|
|
|
Kconfig.freezer
|
|
|
|
Kconfig.hz
|
|
|
|
Kconfig.locks
|
|
|
|
Kconfig.preempt
|
kconfig: include kernel/Kconfig.preempt from init/Kconfig
|
2018-08-02 08:06:54 +09:00 |
|
kcov.c
|
kernel/kcov.c: mark write_comp_data() as notrace
|
2019-02-12 19:47:20 +01:00 |
|
kexec.c
|
kexec: add call to LSM hook in original kexec_load syscall
|
2018-07-16 12:31:57 -07:00 |
|
kexec_core.c
|
kexec: yield to scheduler when loading kimage segments
|
2018-06-15 07:55:24 +09:00 |
|
kexec_file.c
|
treewide: Use array_size() in vzalloc()
|
2018-06-12 16:19:22 -07:00 |
|
kexec_internal.h
|
|
|
|
kmod.c
|
|
|
|
kprobes.c
|
kprobes: Fix potential deadlock in kprobe_optimizer()
|
2019-09-10 10:33:49 +01:00 |
|
ksysfs.c
|
|
|
|
kthread.c
|
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
|
2018-08-13 11:25:07 -07:00 |
|
latencytop.c
|
|
|
|
Makefile
|
x86/uaccess, kcov: Disable stack protector
|
2019-06-19 08:18:01 +02:00 |
|
memremap.c
|
mm, devm_memremap_pages: add MEMORY_DEVICE_PRIVATE support
|
2019-01-13 09:51:04 +01:00 |
|
module-internal.h
|
modsign: log module name in the event of an error
|
2018-07-02 11:36:17 +02:00 |
|
module.c
|
modules: fix BUG when load module with rodata=n
|
2019-09-19 09:09:40 +02:00 |
|
module_signing.c
|
modsign: log module name in the event of an error
|
2018-07-02 11:36:17 +02:00 |
|
notifier.c
|
|
|
|
nsproxy.c
|
|
|
|
padata.c
|
padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
|
2019-07-26 09:14:25 +02:00 |
|
panic.c
|
panic: avoid deadlocks in re-entrant console drivers
|
2018-12-29 13:37:57 +01:00 |
|
params.c
|
kernel/params.c: downgrade warning for unsafe parameters
|
2018-04-11 10:28:37 -07:00 |
|
pid.c
|
Fix failure path in alloc_pid()
|
2019-01-13 09:51:06 +01:00 |
|
pid_namespace.c
|
signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
|
2019-07-26 09:14:01 +02:00 |
|
profile.c
|
|
|
|
ptrace.c
|
ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
|
2019-07-10 09:53:41 +02:00 |
|
range.c
|
|
|
|
reboot.c
|
PM / reboot: Eliminate race between reboot and suspend
|
2018-08-06 12:35:20 +02:00 |
|
relay.c
|
relay: check return of create_buf_file() properly
|
2019-03-13 14:02:35 -07:00 |
|
resource.c
|
resource: fix locking in find_next_iomem_res()
|
2019-09-16 08:22:20 +02:00 |
|
rseq.c
|
rseq: uapi: Declare rseq_cs field as union, update includes
|
2018-07-10 22:18:52 +02:00 |
|
seccomp.c
|
audit/stable-4.18 PR 20180605
|
2018-06-06 16:34:00 -07:00 |
|
signal.c
|
kernel/signal.c: trace_signal_deliver when signal_group_exit
|
2019-06-09 09:17:20 +02:00 |
|
smp.c
|
cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
|
2019-02-12 19:47:25 +01:00 |
|
smpboot.c
|
smpboot: Remove cpumask from the API
|
2018-07-03 09:20:44 +02:00 |
|
smpboot.h
|
|
|
|
softirq.c
|
nohz: Fix missing tick reprogram when interrupting an inline softirq
|
2018-08-03 15:52:10 +02:00 |
|
stacktrace.c
|
|
|
|
stop_machine.c
|
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
|
2018-08-13 11:25:07 -07:00 |
|
sys.c
|
kernel/sys.c: prctl: fix false positive in validate_prctl_map()
|
2019-06-15 11:54:01 +02:00 |
|
sys_ni.c
|
Merge branch 'core-rseq-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
|
2018-06-10 10:17:09 -07:00 |
|
sysctl.c
|
sysctl: return -EINVAL if val violates minmax
|
2019-06-15 11:53:59 +02:00 |
|
sysctl_binary.c
|
staging: irda: remove remaining remants of irda code removal
|
2018-04-16 11:26:49 +02:00 |
|
task_work.c
|
|
|
|
taskstats.c
|
pids: introduce find_get_task_by_vpid() helper
|
2018-02-06 18:32:46 -08:00 |
|
test_kprobes.c
|
kprobes: Remove jprobe API implementation
|
2018-06-21 12:33:05 +02:00 |
|
torture.c
|
torture: Keep old-school dmesg format
|
2018-06-25 11:30:10 -07:00 |
|
tracepoint.c
|
tracepoint: Fix tracepoint array element size mismatch
|
2018-10-17 15:35:29 -04:00 |
|
tsacct.c
|
|
|
|
ucount.c
|
headers: untangle kmemleak.h from mm.h
|
2018-04-05 21:36:27 -07:00 |
|
uid16.c
|
fs: add do_fchownat(), ksys_fchown() helpers and ksys_{,l}chown() wrappers
|
2018-04-02 20:15:59 +02:00 |
|
uid16.h
|
kernel: provide ksys_*() wrappers for syscalls called by kernel/uid16.c
|
2018-04-02 20:15:30 +02:00 |
|
umh.c
|
umh: fix race condition
|
2018-06-07 16:56:28 -04:00 |
|
up.c
|
|
|
|
user-return-notifier.c
|
|
|
|
user.c
|
userns: use irqsave variant of refcount_dec_and_lock()
|
2018-08-22 10:52:47 -07:00 |
|
user_namespace.c
|
userns: also map extents in the reverse map to kernel IDs
|
2018-11-13 11:09:00 -08:00 |
|
utsname.c
|
uts: create "struct uts_namespace" from kmem_cache
|
2018-04-11 10:28:35 -07:00 |
|
utsname_sysctl.c
|
sys: don't hold uts_sem while accessing userspace memory
|
2018-08-11 02:05:53 -05:00 |
|
watchdog.c
|
watchdog: Respect watchdog cpumask on CPU hotplug
|
2019-04-03 06:26:29 +02:00 |
|
watchdog_hld.c
|
watchdog: Mark watchdog touch functions as notrace
|
2018-08-30 12:56:40 +02:00 |
|
workqueue.c
|
workqueue: Try to catch flush_work() without INIT_WORK().
|
2019-05-02 09:58:56 +02:00 |
|
workqueue_internal.h
|
workqueue: Set worker->desc to workqueue name by default
|
2018-05-18 08:47:13 -07:00 |