[1/1] arm64: make sys_call_table const

From: Mark Rutland <mark.rutland@arm.com>

CVE-2015-8967

As with x86, mark the sys_call_table const such that it will be placed
in the .rodata section. This will cause attempts to modify the table
(accidental or deliberate) to fail when strict page permissions are in
place. In the absence of strict page permissions, there should be no
functional change.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit c623b33b4e9599c6ac5076f7db7369eb9869aa04)
Signed-off-by: Brad Figg <brad.figg@canonical.com>
---
 arch/arm64/kernel/sys.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

On 09/06/17 15:40, Brad Figg wrote:
> From: Mark Rutland <mark.rutland@arm.com>
> 
> CVE-2015-8967
> 
> As with x86, mark the sys_call_table const such that it will be placed
> in the .rodata section. This will cause attempts to modify the table
> (accidental or deliberate) to fail when strict page permissions are in
> place. In the absence of strict page permissions, there should be no
> functional change.
> 
> Signed-off-by: Mark Rutland <mark.rutland@arm.com>
> Acked-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> (cherry picked from commit c623b33b4e9599c6ac5076f7db7369eb9869aa04)
> Signed-off-by: Brad Figg <brad.figg@canonical.com>
> ---
>  arch/arm64/kernel/sys.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kernel/sys.c b/arch/arm64/kernel/sys.c
> index 3fa98ff..df20b79 100644
> --- a/arch/arm64/kernel/sys.c
> +++ b/arch/arm64/kernel/sys.c
> @@ -50,7 +50,7 @@ asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
>   * The sys_call_table array must be 4K aligned to be accessible from
>   * kernel/entry.S.
>   */
> -void *sys_call_table[__NR_syscalls] __aligned(4096) = {
> +void * const sys_call_table[__NR_syscalls] __aligned(4096) = {
>  	[0 ... __NR_syscalls - 1] = sys_ni_syscall,
>  #include <asm/unistd.h>
>  };
> 

Clean cherry pick, looks good.

Acked-by: Colin Ian King <colin.king@canonical.com>

On Fri, Jun 09, 2017 at 07:40:33AM -0700, Brad Figg wrote:
> From: Mark Rutland <mark.rutland@arm.com>
> 
> CVE-2015-8967
> 
> As with x86, mark the sys_call_table const such that it will be placed
> in the .rodata section. This will cause attempts to modify the table
> (accidental or deliberate) to fail when strict page permissions are in
> place. In the absence of strict page permissions, there should be no
> functional change.
> 
> Signed-off-by: Mark Rutland <mark.rutland@arm.com>
> Acked-by: Will Deacon <will.deacon@arm.com>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> (cherry picked from commit c623b33b4e9599c6ac5076f7db7369eb9869aa04)
> Signed-off-by: Brad Figg <brad.figg@canonical.com>
> ---
>  arch/arm64/kernel/sys.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/arm64/kernel/sys.c b/arch/arm64/kernel/sys.c
> index 3fa98ff..df20b79 100644
> --- a/arch/arm64/kernel/sys.c
> +++ b/arch/arm64/kernel/sys.c
> @@ -50,7 +50,7 @@ asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
>   * The sys_call_table array must be 4K aligned to be accessible from
>   * kernel/entry.S.
>   */
> -void *sys_call_table[__NR_syscalls] __aligned(4096) = {
> +void * const sys_call_table[__NR_syscalls] __aligned(4096) = {
>  	[0 ... __NR_syscalls - 1] = sys_ni_syscall,
>  #include <asm/unistd.h>
>  };

Clean cherry-pick.  Looks to do what is claimed.  Therefore:

Acked-by: Andy Whitcroft <apw@canonical.com>

-apw

Applied to Trusty master-next.

Thanks,
-Stefan