linux-toradex.git/kernel/module.c, branch v5.13-rc3

module: check for exit sections in layout_sections() instead of module_init_section()

2021-05-17T07:48:24+00:00

Previously, when CONFIG_MODULE_UNLOAD=n, the module loader just does not
attempt to load exit sections since it never expects that any code in those
sections will ever execute. However, dynamic code patching (alternatives,
jump_label and static_call) can have sites in __exit code, even if __exit is
never executed. Therefore __exit must be present at runtime, at least for as
long as __init code is.

Commit 33121347fb1c ("module: treat exit sections the same as init
sections when !CONFIG_MODULE_UNLOAD") solves the requirements of
jump_labels and static_calls by putting the exit sections in the init
region of the module so that they are at least present at init, and
discarded afterwards. It does this by including a check for exit
sections in module_init_section(), so that it also returns true for exit
sections, and the module loader will automatically sort them in the init
region of the module.

However, the solution there was not completely arch-independent. ARM is
a special case where it supplies its own module_{init, exit}_section()
functions. Instead of pushing the exit section checks into
module_init_section(), just implement the exit section check in
layout_sections(), so that we don't have to touch arch-dependent code.

Fixes: 33121347fb1c ("module: treat exit sections the same as init sections when !CONFIG_MODULE_UNLOAD")
Reviewed-by: Russell King (Oracle) 
Signed-off-by: Jessica Yu

Merge tag 'modules-for-v5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux

2021-04-30T19:29:36+00:00

Pull module updates from Jessica Yu:
 "Fix an age old bug involving jump_calls and static_labels when
  CONFIG_MODULE_UNLOAD=n.

  When CONFIG_MODULE_UNLOAD=n, it means you can't unload modules, so
  normally the __exit sections of a module are not loaded at all.
  However, dynamic code patching (jump_label, static_call, alternatives)
  can have sites in __exit sections even if __exit is never executed.

  Reported by Peter Zijlstra:
     'Alternatives, jump_labels and static_call all can have relocations
      into __exit code. Not loading it at all would be BAD.'

  Therefore, load the __exit sections even when CONFIG_MODULE_UNLOAD=n,
  and discard them after init"

* tag 'modules-for-v5.13' of git://git.kernel.org/pub/scm/linux/kernel/git/jeyu/linux:
  module: treat exit sections the same as init sections when !CONFIG_MODULE_UNLOAD

add support for Clang CFI

2021-04-08T23:04:20+00:00

This change adds support for Clang’s forward-edge Control Flow
Integrity (CFI) checking. With CONFIG_CFI_CLANG, the compiler
injects a runtime check before each indirect function call to ensure
the target is a valid function with the correct static type. This
restricts possible call targets and makes it more difficult for
an attacker to exploit bugs that allow the modification of stored
function pointers. For more details, see:

  https://clang.llvm.org/docs/ControlFlowIntegrity.html

Clang requires CONFIG_LTO_CLANG to be enabled with CFI to gain
visibility to possible call targets. Kernel modules are supported
with Clang’s cross-DSO CFI mode, which allows checking between
independently compiled components.

With CFI enabled, the compiler injects a __cfi_check() function into
the kernel and each module for validating local call targets. For
cross-module calls that cannot be validated locally, the compiler
calls the global __cfi_slowpath_diag() function, which determines
the target module and calls the correct __cfi_check() function. This
patch includes a slowpath implementation that uses __module_address()
to resolve call targets, and with CONFIG_CFI_CLANG_SHADOW enabled, a
shadow map that speeds up module look-ups by ~3x.

Clang implements indirect call checking using jump tables and
offers two methods of generating them. With canonical jump tables,
the compiler renames each address-taken function to .cfi
and points the original symbol to a jump table entry, which passes
__cfi_check() validation. This isn’t compatible with stand-alone
assembly code, which the compiler doesn’t instrument, and would
result in indirect calls to assembly code to fail. Therefore, we
default to using non-canonical jump tables instead, where the compiler
generates a local jump table entry .cfi_jt for each
address-taken function, and replaces all references to the function
with the address of the jump table entry.

Note that because non-canonical jump table addresses are local
to each component, they break cross-module function address
equality. Specifically, the address of a global function will be
different in each module, as it's replaced with the address of a local
jump table entry. If this address is passed to a different module,
it won’t match the address of the same function taken there. This
may break code that relies on comparing addresses passed from other
components.

CFI checking can be disabled in a function with the __nocfi attribute.
Additionally, CFI can be disabled for an entire compilation unit by
filtering out CC_FLAGS_CFI.

By default, CFI failures result in a kernel panic to stop a potential
exploit. CONFIG_CFI_PERMISSIVE enables a permissive mode, where the
kernel prints out a rate-limited warning instead, and allows execution
to continue. This option is helpful for locating type mismatches, but
should only be enabled during development.

Signed-off-by: Sami Tolvanen 
Reviewed-by: Kees Cook 
Tested-by: Nathan Chancellor 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20210408182843.1754385-2-samitolvanen@google.com

module: treat exit sections the same as init sections when !CONFIG_MODULE_UNLOAD

2021-03-29T11:08:53+00:00

Dynamic code patching (alternatives, jump_label and static_call) can
have sites in __exit code, even it __exit is never executed. Therefore
__exit must be present at runtime, at least for as long as __init code
is.

Additionally, for jump_label and static_call, the __exit sites must also
identify as within_module_init(), such that the infrastructure is aware
to never touch them after module init -- alternatives are only ran once
at init and hence don't have this particular constraint.

By making __exit identify as __init for MODULE_UNLOAD, the above is
satisfied.

So, when !CONFIG_MODULE_UNLOAD, the section ordering should look like the
following, with the .exit sections moved to the init region of the module.

Core section allocation order:
 	.text
 	.rodata
 	__ksymtab_gpl
 	__ksymtab_strings
 	.note.* sections
 	.bss
 	.data
 	.gnu.linkonce.this_module
 Init section allocation order:
 	.init.text
 	.exit.text
 	.symtab
 	.strtab

[jeyu: thanks to Peter Zijlstra for most of changelog]

Link: https://lore.kernel.org/lkml/YFiuphGw0RKehWsQ@gunter/
Link: https://lore.kernel.org/r/20210323142756.11443-1-jeyu@kernel.org
Acked-by: Peter Zijlstra (Intel) 
Signed-off-by: Jessica Yu

module: potential uninitialized return in module_kallsyms_on_each_symbol()

2021-02-10T15:57:04+00:00

Smatch complains that:

	kernel/module.c:4472 module_kallsyms_on_each_symbol()
        error: uninitialized symbol 'ret'.

This warning looks like it could be correct if the &modules list is
empty.

Fixes: 013c1667cf78 ("kallsyms: refactor {,module_}kallsyms_on_each_symbol")
Reviewed-by: Miroslav Benes 
Reviewed-by: Christoph Hellwig 
Signed-off-by: Dan Carpenter 
Signed-off-by: Jessica Yu

module: remove EXPORT_UNUSED_SYMBOL*

2021-02-08T11:28:07+00:00

EXPORT_UNUSED_SYMBOL* is not actually used anywhere.  Remove the
unused functionality as we generally just remove unused code anyway.

Reviewed-by: Miroslav Benes 
Reviewed-by: Emil Velikov 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Jessica Yu

module: remove EXPORT_SYMBOL_GPL_FUTURE

2021-02-08T11:28:02+00:00

As far as I can tell this has never been used at all, and certainly
not any time recently.

Reviewed-by: Miroslav Benes 
Reviewed-by: Emil Velikov 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Jessica Yu

module: move struct symsearch to module.c

2021-02-08T11:27:43+00:00

struct symsearch is only used inside of module.h, so move the definition
out of module.h.

Reviewed-by: Miroslav Benes 
Reviewed-by: Emil Velikov 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Jessica Yu

module: pass struct find_symbol_args to find_symbol

2021-02-08T11:25:19+00:00

Simplify the calling convention by passing the find_symbol_args structure
to find_symbol instead of initializing it inside the function.

Reviewed-by: Miroslav Benes 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Jessica Yu

module: merge each_symbol_section into find_symbol

2021-02-08T11:25:07+00:00

each_symbol_section is only called by find_symbol, so merge the two
functions.

Reviewed-by: Miroslav Benes 
Signed-off-by: Christoph Hellwig 
Signed-off-by: Jessica Yu