Commit 097fd001 authored by Christophe Leroy's avatar Christophe Leroy Committed by Petr Pavlu
Browse files

module: Split module_enable_rodata_ro() 



module_enable_rodata_ro() is called twice, once before module init
to set rodata sections readonly and once after module init to set
rodata_after_init section readonly.

The second time, only the rodata_after_init section needs to be
set to read-only, no need to re-apply it to already set rodata.

Split module_enable_rodata_ro() in two.

Signed-off-by: default avatarChristophe Leroy <christophe.leroy@csgroup.eu>
Tested-by: default avatarDaniel Gomez <da.gomez@samsung.com>
Reviewed-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/e3b6ff0df7eac281c58bb02cecaeb377215daff3.1733427536.git.christophe.leroy@csgroup.eu


Signed-off-by: default avatarPetr Pavlu <petr.pavlu@suse.com>
parent b83815af

kernel/module/internal.h

+2 −1
Original line number Diff line number Diff line
@@ -327,7 +327,8 @@ static inline struct module *mod_find(unsigned long addr, struct mod_tree_root * 
}

#endif /* CONFIG_MODULES_TREE_LOOKUP */



int module_enable_rodata_ro(const struct module *mod, bool after_init);

int module_enable_rodata_ro(const struct module *mod);

int module_enable_rodata_ro_after_init(const struct module *mod);

int module_enable_data_nx(const struct module *mod);

int module_enable_text_rox(const struct module *mod);

int module_enforce_rwx_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,

kernel/module/main.c

+2 −2
Original line number Diff line number Diff line
@@ -2953,7 +2953,7 @@ static noinline int do_init_module(struct module *mod) 
	/* Switch to core kallsyms now init is done: kallsyms may be walking! */

	rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);

#endif

	ret = module_enable_rodata_ro(mod, true);

	ret = module_enable_rodata_ro_after_init(mod);

	if (ret)

		goto fail_mutex_unlock;

	mod_tree_remove_init(mod);
@@ -3123,7 +3123,7 @@ static int complete_formation(struct module *mod, struct load_info *info) 
	module_bug_finalize(info->hdr, info->sechdrs, mod);

	module_cfi_finalize(info->hdr, info->sechdrs, mod);



	err = module_enable_rodata_ro(mod, false);

	err = module_enable_rodata_ro(mod);

	if (err)

		goto out_strict_rwx;

	err = module_enable_data_nx(mod);

kernel/module/strict_rwx.c

+9 −4
Original line number Diff line number Diff line
@@ -47,7 +47,7 @@ int module_enable_text_rox(const struct module *mod) 
	return 0;

}



int module_enable_rodata_ro(const struct module *mod, bool after_init)

int module_enable_rodata_ro(const struct module *mod)

{

	int ret;
@@ -61,10 +61,15 @@ int module_enable_rodata_ro(const struct module *mod, bool after_init) 
	if (ret)

		return ret;



	if (after_init)

		return module_set_memory(mod, MOD_RO_AFTER_INIT, set_memory_ro);

	return 0;

}



int module_enable_rodata_ro_after_init(const struct module *mod)

{

	if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX) || !rodata_enabled)

		return 0;



	return module_set_memory(mod, MOD_RO_AFTER_INIT, set_memory_ro);

}



int module_enable_data_nx(const struct module *mod)