diff options
| author | Dennis Chen <dechen@redhat.com> | 2026-10-14 13:58:59 -0400 |
|---|---|---|
| committer | Kees Cook <kees@kernel.org> | 2026-10-14 13:11:13 -0700 |
| commit | e2cd253cb31bb0da4bcc512e20bfeebf76880891 (patch) | |
| tree | 2dfd53df93f8a15bd16500b9a75c8b0f94039eb0 /arch/x86/kernel/cpu | |
| parent | ef16259088f99c5997e198561bdcbb89ab70fd0f (diff) | |
lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
native_write_cr4 should not be exported to modules. Commit 21953ee5013d
("x86/cpu: Export native_write_cr4() only when CONFIG_LKTDM=m")
restricted the export somewhat, but native_write_cr4() is still exposed
to all GPL-compatible modules when CONFIG_LKDTM=m.
UNSET_SMEP is the only module user of native_write_cr4(). Restrict
the test to CONFIG_LKDTM=y and remove the export. When LKDTM is
built as a module, report XFAIL for UNSET_SMEP.
Suggested-by: Christoph Hellwig <hch@infradead.org>
Link: https://lore.kernel.org/all/20200420090102.GB24518@infradead.org/
Signed-off-by: Dennis Chen <dechen@redhat.com>
Link: https://patch.msgid.link/20261014175859.30863-1-dechen@redhat.com
Signed-off-by: Kees Cook <kees@kernel.org>
Diffstat (limited to 'arch/x86/kernel/cpu')
| -rw-r--r-- | arch/x86/kernel/cpu/common.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index c7352827f491..7c1b9e045d5f 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -490,9 +490,6 @@ set_register: bits_changed); } } -#if IS_MODULE(CONFIG_LKDTM) -EXPORT_SYMBOL_GPL(native_write_cr4); -#endif void cr4_update_irqsoff(unsigned long set, unsigned long clear) { |