[PATCH] lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()

[PATCH] lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()

[Dennis Chen]

native_write_cr4 should not be exported to modules. Commit 21953ee5013d
("x86/cpu: Export native_write_cr4() only when CONFIG_LKTDM=m")
restricted the export somewhat, but native_write_cr4() is still exposed
to all GPL-compatible modules when CONFIG_LKDTM=m.

UNSET_SMEP is the only module user of native_write_cr4(). Restrict
the test to CONFIG_LKDTM=y and remove the export. When LKDTM is
built as a module, report XFAIL for UNSET_SMEP.

Suggested-by: Christoph Hellwig <hch@infradead.org>
Link: https://lore.kernel.org/all/20200420090102.GB24518@infradead.org/
Signed-off-by: Dennis Chen <dechen@redhat.com>
---
 arch/x86/kernel/cpu/common.c | 3 ---
 drivers/misc/lkdtm/bugs.c    | 4 ++--
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index c7352827f491..7c1b9e045d5f 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -490,9 +490,6 @@ void __no_profile native_write_cr4(unsigned long val)
 			  bits_changed);
 	}
 }
-#if IS_MODULE(CONFIG_LKDTM)
-EXPORT_SYMBOL_GPL(native_write_cr4);
-#endif
 
 void cr4_update_irqsoff(unsigned long set, unsigned long clear)
 {
diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c
index 3eca2ef64aff..d82c47fb9f03 100644
--- a/drivers/misc/lkdtm/bugs.c
+++ b/drivers/misc/lkdtm/bugs.c
@@ -676,7 +676,7 @@ static void lkdtm_STACK_GUARD_PAGE_TRAILING(void)
 
 static void lkdtm_UNSET_SMEP(void)
 {
-#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML)
+#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML) && IS_BUILTIN(CONFIG_LKDTM)
 #define MOV_CR4_DEPTH	64
 	void (*direct_write_cr4)(unsigned long val);
 	unsigned char *insn;
@@ -737,7 +737,7 @@ static void lkdtm_UNSET_SMEP(void)
 		native_write_cr4(cr4);
 	}
 #else
-	pr_err("XFAIL: this test is x86_64-only\n");
+	pr_err("XFAIL: this test is x86_64-only and requires CONFIG_LKDTM=y\n");
 #endif
 }
 
-- 
2.56.0

Re: [PATCH] lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()

[Kees Cook]

On Wed, 14 Oct 2026 13:58:59 -0400, Dennis Chen wrote:
> native_write_cr4 should not be exported to modules. Commit 21953ee5013d
> ("x86/cpu: Export native_write_cr4() only when CONFIG_LKTDM=m")
> restricted the export somewhat, but native_write_cr4() is still exposed
> to all GPL-compatible modules when CONFIG_LKDTM=m.
> 
> UNSET_SMEP is the only module user of native_write_cr4(). Restrict
> the test to CONFIG_LKDTM=y and remove the export. When LKDTM is
> built as a module, report XFAIL for UNSET_SMEP.
> 
> [...]

Applied to for-next/hardening, thanks!

[1/1] lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
      https://git.kernel.org/kees/c/e2cd253cb31b

Take care,

-- 
Kees Cook

Re: [PATCH] lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()

[Christoph Hellwig]

Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>