MIRRORS/linux-yocto
1
0
Fork 0
mirror of git://git.yoctoproject.org/linux-yocto.git synced 2025-10-23 07:23:12 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

module: Add a separate function to mark sections as read-only after init

Browse Source 
Move the logic to mark special sections as read-only after module
initialization into a separate function, along other related code in
strict_rwx.c. Use a table with names of such sections to make it easier to
add more.

Reviewed-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20250306131430.7016-3-petr.pavlu@suse.com
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
This commit is contained in:
Petr Pavlu 2025-03-06 14:13:53 +01:00
parent 7bba3167c0
commit f798494263
3 changed files with 38 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
kernel/module/internal.h
View File

@ -325,6 +325,8 @@ int module_enable_text_rox(const struct module *mod);
int module_enforce_rwx_sections(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
const char *secstrings,
const struct module *mod);
void module_mark_ro_after_init(const Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
const char *secstrings);
#ifdef CONFIG_MODULE_SIG
int module_sig_check(struct load_info *info, int flags);

18
kernel/module/main.c
View File

@ -2768,7 +2768,6 @@ core_param(module_blacklist, module_blacklist, charp, 0400);
static struct module *layout_and_allocate(struct load_info *info, int flags)
{
struct module *mod;
unsigned int ndx;
int err;
/* Allow arches to frob section contents and sizes. */
@ -2786,22 +2785,11 @@ static struct module *layout_and_allocate(struct load_info *info, int flags)
info->sechdrs[info->index.pcpu].sh_flags &= ~(unsigned long)SHF_ALLOC;
/*
* Mark ro_after_init section with SHF_RO_AFTER_INIT so that
* layout_sections() can put it in the right place.
* Mark relevant sections as SHF_RO_AFTER_INIT so layout_sections() can
* put them in the right place.
* Note: ro_after_init sections also have SHF_{WRITE,ALLOC} set.
*/
ndx = find_sec(info, ".data..ro_after_init");
if (ndx)
info->sechdrs[ndx].sh_flags |= SHF_RO_AFTER_INIT;
/*
* Mark the __jump_table section as ro_after_init as well: these data
* structures are never modified, with the exception of entries that
* refer to code in the __init section, which are annotated as such
* at module load time.
*/
ndx = find_sec(info, "__jump_table");
if (ndx)
info->sechdrs[ndx].sh_flags |= SHF_RO_AFTER_INIT;
module_mark_ro_after_init(info->hdr, info->sechdrs, info->secstrings);
/*
* Determine total sizes, and put offsets in sh_entsize. For now

33
kernel/module/strict_rwx.c
View File

@ -107,3 +107,36 @@ int module_enforce_rwx_sections(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
return 0;
}
static const char *const ro_after_init[] = {
/*
* Section .data..ro_after_init holds data explicitly annotated by
* __ro_after_init.
*/
".data..ro_after_init",
/*
* Section __jump_table holds data structures that are never modified,
* with the exception of entries that refer to code in the __init
* section, which are marked as such at module load time.
*/
"__jump_table",
};
void module_mark_ro_after_init(const Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
const char *secstrings)
{
int i, j;
for (i = 1; i < hdr->e_shnum; i++) {
Elf_Shdr *shdr = &sechdrs[i];
for (j = 0; j < ARRAY_SIZE(ro_after_init); j++) {
if (strcmp(secstrings + shdr->sh_name,
ro_after_init[j]) == 0) {
shdr->sh_flags |= SHF_RO_AFTER_INIT;
break;
}
}
}
}