[PW_SID:1149213] x86: Support shstk via prctl - #2507
Conversation
…_RWX When CONFIG_STRICT_MODULE_RWX is not set, execmem cannot create temporary writable mappings for read-only executable pages. In this case, the execmem ranges must already have writable permissions. Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC, which causes kprobe instruction slot writes to trigger page faults on systems where CONFIG_STRICT_MODULE_RWX is not enabled. Fix this by using PAGE_KERNEL_EXEC when CONFIG_STRICT_MODULE_RWX is not available. Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/20260814082742.148403-2-xiaofengmian@163.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
patch_map() always creates a temporary writable mapping via fixmap for kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX is disabled and the kernel text is already mapped with _PAGE_WRITE. This is unnecessary overhead at best, and on minimal configurations it can cause page faults. Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX is not enabled, since the text pages are already writable in that case. The module text path is already gated on CONFIG_STRICT_MODULE_RWX and is kept unchanged. Reported-by: Klara Modin <klara@kasm.eu> Closes: https://lore.kernel.org/all/ant_8TaBbov_GS4i@soda.int.kasm.eu/ Reported-by: Lad Prabhakar <prabhakar.csengg@gmail.com> Closes: https://lore.kernel.org/all/CA+V-a8tQK8rih9SGGTyqrEBGpNkx4H0eX2YccCRrgkVAPr+EBg@mail.gmail.com/ Tested-by: Klara Modin <klarasmodin@gmail.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/20260814082742.148403-3-xiaofengmian@163.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
The Makefile has a macro called "extra-files" that sets up the dependency on the target. Right now, for some targets that need EXTRA_FILES added to the compilation, the dependency is left untracked. Thus, to fix this, use the aforementioned macro. Signed-off-by: Bill Roberts <bill.roberts@arm.com> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Shashiko correctly pointed out this fork bug, the report is below. This
patch fixes it by checking for the child and error conditions
explicitly.
[ ... ]
> +int test_ptrace(void)
> +{
> + unsigned long saved_ssp, ssp = 0;
> + struct sigaction sa = {};
> + struct iovec iov;
> + int status;
> + int pid;
> +
> + iov.iov_base = &ssp;
> + iov.iov_len = sizeof(ssp);
> +
> + pid = fork();
> + if (!pid) {
[Severity: High]
This is a pre-existing issue, but could this code broadcast SIGKILL to
all user processes if fork() fails?
If fork() returns -1 due to resource limits, execution will proceed with
pid = -1. When ptrace() subsequently fails, the error path is triggered:
out_kill:
kill(pid, SIGKILL);
return 1;
Since pid is -1, POSIX specifies that this will kill all processes the
current user has permission to terminate, potentially crashing the host
environment.
Signed-off-by: Bill Roberts <bill.roberts@arm.com>
Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Add a test that locks the shadow stack write bit and then attempts to disable write. The disable should fail with EPERM since it's in a locked state. This also preserves the write bit being set for the whole test suite as well as preserving the ability to unlock at the end. Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Historically, managing the user-space shadow stack state on x86 has been handled exclusively through the arch_prctl() interface via the ARCH_SHSTK_* operations. However, other architectures (such as arm64 and riscv) do not implement arch_prctl() and instead utilize the newer, arch-agnostic, prctl() interface (i.e. PR_GET_SHADOW_STACK_STATUS and PR_SET_SHADOW_STACK_STATUS). To provide language runtimes, toolchains, and libc implementations with a consistent, cross-architecture interface for managing control-flow integrity, wire up the generic shadow stack prctl handlers for x86. Map the generic PR_SHADOW_STACK_ENABLE, PR_SHADOW_STACK_DISABLE, and PR_SHADOW_STACK_LOCK operations onto the underlying x86 internal CET helper routines. This allows portable userspace applications to toggle or query shadow stack states without relying on architecture-specific system calls, while maintaining backward compatibility with existing arch_prctl() calls. Signed-off-by: Bill Roberts <bill.roberts@arm.com> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
Run the same test suite for arch_prctl, against prctl, to ensure consistency and correctness between the interfaces. Signed-off-by: Bill Roberts <bill.roberts@arm.com> Signed-off-by: Linux RISC-V bot <linux.riscv.bot@gmail.com>
bb1a926 to
6f6f7c0
Compare
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 1: "[v3,1/5] selftests/x86: fix Makefile dependencies" |
|
Patch 2: "[v3,2/5] selftests/x86: fix fork bug" |
|
Patch 2: "[v3,2/5] selftests/x86: fix fork bug" |
|
Patch 2: "[v3,2/5] selftests/x86: fix fork bug" |
|
Patch 2: "[v3,2/5] selftests/x86: fix fork bug" |
|
Patch 2: "[v3,2/5] selftests/x86: fix fork bug" |
|
Patch 2: "[v3,2/5] selftests/x86: fix fork bug" |
|
Patch 2: "[v3,2/5] selftests/x86: fix fork bug" |
|
Patch 2: "[v3,2/5] selftests/x86: fix fork bug" |
|
Patch 3: "[v3,3/5] selftests/x86: add shadow stack lock test" |
|
Patch 3: "[v3,3/5] selftests/x86: add shadow stack lock test" |
|
Patch 3: "[v3,3/5] selftests/x86: add shadow stack lock test" |
|
Patch 3: "[v3,3/5] selftests/x86: add shadow stack lock test" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 4: "[v3,4/5] x86/shstk: support via prctl" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
|
Patch 5: "[v3,5/5] selftests/x86: add generic prctl shadow stack test" |
PR for series 1149213 applied to workflow__riscv__fixes
Name: x86: Support shstk via prctl
URL: https://patchwork.kernel.org/project/linux-riscv/list/?series=1149213
Version: 3