[PATCH] arm64/module: set trampoline section flags regardless of CONFIG_DYNAMIC_FTRACE

[PATCH] arm64/module: set trampoline section flags regardless of CONFIG_DYNAMIC_FTRACE

[Jessica Yu]

In the arm64 module linker script, the section .text.ftrace_trampoline
is specified unconditionally regardless of whether CONFIG_DYNAMIC_FTRACE
is enabled (this is simply due to the limitation that module linker
scripts are not preprocessed like the vmlinux one).

Normally, for .plt and .text.ftrace_trampoline, the section flags
present in the module binary wouldn't matter since module_frob_arch_sections()
would assign them manually anyway. However, the arm64 module loader only
sets the section flags for .text.ftrace_trampoline when CONFIG_DYNAMIC_FTRACE=y.
That's only become problematic recently due to a recent change in
binutils-2.35, where the .text.ftrace_trampoline section (along with the
.plt section) is now marked writable and executable (WAX).

We no longer allow writable and executable sections to be loaded due to
commit 5c3a7db0c7ec ("module: Harden STRICT_MODULE_RWX"), so this is
causing all modules linked with binutils-2.35 to be rejected under arm64.
Drop the IS_ENABLED(CONFIG_DYNAMIC_FTRACE) check in module_frob_arch_sections()
so that the section flags for .text.ftrace_trampoline get properly set to
SHF_EXECINSTR|SHF_ALLOC, without SHF_WRITE.

Link: http://lore.kernel.org/r/20200831094651.GA16385@linux-8ccs
Acked-by: Will Deacon <will@kernel.org>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
---
 arch/arm64/kernel/module-plts.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c
index 0ce3a28e3347..2e224435c024 100644
--- a/arch/arm64/kernel/module-plts.c
+++ b/arch/arm64/kernel/module-plts.c
@@ -305,8 +305,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
 			mod->arch.core.plt_shndx = i;
 		else if (!strcmp(secstrings + sechdrs[i].sh_name, ".init.plt"))
 			mod->arch.init.plt_shndx = i;
-		else if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
-			 !strcmp(secstrings + sechdrs[i].sh_name,
+		else if (!strcmp(secstrings + sechdrs[i].sh_name,
 				 ".text.ftrace_trampoline"))
 			tramp = sechdrs + i;
 		else if (sechdrs[i].sh_type == SHT_SYMTAB)
-- 
2.16.4

Re: [PATCH] arm64/module: set trampoline section flags regardless of CONFIG_DYNAMIC_FTRACE

[Ard Biesheuvel]

On Tue, 1 Sep 2020 at 19:00, Jessica Yu <jeyu@kernel.org> wrote:
>
> In the arm64 module linker script, the section .text.ftrace_trampoline
> is specified unconditionally regardless of whether CONFIG_DYNAMIC_FTRACE
> is enabled (this is simply due to the limitation that module linker
> scripts are not preprocessed like the vmlinux one).
>
> Normally, for .plt and .text.ftrace_trampoline, the section flags
> present in the module binary wouldn't matter since module_frob_arch_sections()
> would assign them manually anyway. However, the arm64 module loader only
> sets the section flags for .text.ftrace_trampoline when CONFIG_DYNAMIC_FTRACE=y.
> That's only become problematic recently due to a recent change in
> binutils-2.35, where the .text.ftrace_trampoline section (along with the
> .plt section) is now marked writable and executable (WAX).
>
> We no longer allow writable and executable sections to be loaded due to
> commit 5c3a7db0c7ec ("module: Harden STRICT_MODULE_RWX"), so this is
> causing all modules linked with binutils-2.35 to be rejected under arm64.
> Drop the IS_ENABLED(CONFIG_DYNAMIC_FTRACE) check in module_frob_arch_sections()
> so that the section flags for .text.ftrace_trampoline get properly set to
> SHF_EXECINSTR|SHF_ALLOC, without SHF_WRITE.
>
> Link: http://lore.kernel.org/r/20200831094651.GA16385@linux-8ccs
> Acked-by: Will Deacon <will@kernel.org>
> Signed-off-by: Jessica Yu <jeyu@kernel.org>

Acked-by: Ard Biesheuvel <ardb@kernel.org>

> ---
>  arch/arm64/kernel/module-plts.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/arch/arm64/kernel/module-plts.c b/arch/arm64/kernel/module-plts.c
> index 0ce3a28e3347..2e224435c024 100644
> --- a/arch/arm64/kernel/module-plts.c
> +++ b/arch/arm64/kernel/module-plts.c
> @@ -305,8 +305,7 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
>                         mod->arch.core.plt_shndx = i;
>                 else if (!strcmp(secstrings + sechdrs[i].sh_name, ".init.plt"))
>                         mod->arch.init.plt_shndx = i;
> -               else if (IS_ENABLED(CONFIG_DYNAMIC_FTRACE) &&
> -                        !strcmp(secstrings + sechdrs[i].sh_name,
> +               else if (!strcmp(secstrings + sechdrs[i].sh_name,
>                                  ".text.ftrace_trampoline"))
>                         tramp = sechdrs + i;
>                 else if (sechdrs[i].sh_type == SHT_SYMTAB)
> --
> 2.16.4
>

Re: [PATCH] arm64/module: set trampoline section flags regardless of CONFIG_DYNAMIC_FTRACE

[Catalin Marinas]

On Tue, 1 Sep 2020 18:00:16 +0200, Jessica Yu wrote:
> In the arm64 module linker script, the section .text.ftrace_trampoline
> is specified unconditionally regardless of whether CONFIG_DYNAMIC_FTRACE
> is enabled (this is simply due to the limitation that module linker
> scripts are not preprocessed like the vmlinux one).
> 
> Normally, for .plt and .text.ftrace_trampoline, the section flags
> present in the module binary wouldn't matter since module_frob_arch_sections()
> would assign them manually anyway. However, the arm64 module loader only
> sets the section flags for .text.ftrace_trampoline when CONFIG_DYNAMIC_FTRACE=y.
> That's only become problematic recently due to a recent change in
> binutils-2.35, where the .text.ftrace_trampoline section (along with the
> .plt section) is now marked writable and executable (WAX).
> 
> [...]

Applied to arm64 (for-next/fixes), thanks!

[1/1] arm64/module: set trampoline section flags regardless of CONFIG_DYNAMIC_FTRACE
      https://git.kernel.org/arm64/c/e0328feda79d

-- 
Catalin