| Message ID | 20210517032810.129949-7-jniethe5@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | powerpc: Further Strict RWX support | expand |
| Related | show |
| Context | Check | Description |
|---|---|---|
| snowpatch_ozlabs/apply_patch | warning | Failed to apply on branch powerpc/merge (3a81c0495fdb91fd9a9b4f617098c283131eeae1) |
| snowpatch_ozlabs/apply_patch | warning | Failed to apply on branch powerpc/next (6efb943b8616ec53a5e444193dccf1af9ad627b5) |
| snowpatch_ozlabs/apply_patch | warning | Failed to apply on branch linus/master (d07f6ca923ea0927a1024dfccafc5b53b61cfecc) |
| snowpatch_ozlabs/apply_patch | warning | Failed to apply on branch powerpc/fixes (c6ac667b07996929835b512de0e9a988977e6abc) |
| snowpatch_ozlabs/apply_patch | warning | Failed to apply on branch linux-next (c12a29ed9094b4b9cde8965c12850460b9a79d7c) |
| snowpatch_ozlabs/apply_patch | fail | Failed to apply to any branch |
Le 17/05/2021 à 05:28, Jordan Niethe a écrit : > Add the necessary call to bpf_jit_binary_lock_ro() to remove write and > add exec permissions to the JIT image after it has finished being > written. > > Without CONFIG_STRICT_MODULE_RWX the image will be writable and > executable until the call to bpf_jit_binary_lock_ro(). And _with_ CONFIG_STRICT_MODULE_RWX what will happen ? It will be _writable_ but not _executable_ ? > > Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> > Signed-off-by: Jordan Niethe <jniethe5@gmail.com> > --- > v10: New to series > v11: Remove CONFIG_STRICT_MODULE_RWX conditional > --- > arch/powerpc/net/bpf_jit_comp.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c > index 6c8c268e4fe8..53aefee3fe70 100644 > --- a/arch/powerpc/net/bpf_jit_comp.c > +++ b/arch/powerpc/net/bpf_jit_comp.c > @@ -237,6 +237,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) > fp->jited_len = alloclen; > > bpf_flush_icache(bpf_hdr, (u8 *)bpf_hdr + (bpf_hdr->pages * PAGE_SIZE)); > + bpf_jit_binary_lock_ro(bpf_hdr); > if (!fp->is_func || extra_pass) { > bpf_prog_fill_jited_linfo(fp, addrs); > out_addrs: >
On Mon, May 17, 2021 at 4:40 PM Christophe Leroy <christophe.leroy@csgroup.eu> wrote: > > > > Le 17/05/2021 à 05:28, Jordan Niethe a écrit : > > Add the necessary call to bpf_jit_binary_lock_ro() to remove write and > > add exec permissions to the JIT image after it has finished being > > written. > > > > Without CONFIG_STRICT_MODULE_RWX the image will be writable and > > executable until the call to bpf_jit_binary_lock_ro(). > > And _with_ CONFIG_STRICT_MODULE_RWX what will happen ? It will be _writable_ but not _executable_ ? That's right. With CONFIG_STRICT_MODULE_RWX the image will initially be PAGE_KERNEL from bpf_jit_alloc_exec() calling module_alloc(). So not executable. bpf_jit_binary_lock_ro() will then remove write and add executable. Without CONFIG_STRICT_MODULE_RWX the image will initially be PAGE_KERNEL_EXEC from module_alloc(). bpf_jit_binary_lock_ro() will remove write, but until that point it will have been write + exec. > > > > > Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> > > Signed-off-by: Jordan Niethe <jniethe5@gmail.com> > > --- > > v10: New to series > > v11: Remove CONFIG_STRICT_MODULE_RWX conditional > > --- > > arch/powerpc/net/bpf_jit_comp.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c > > index 6c8c268e4fe8..53aefee3fe70 100644 > > --- a/arch/powerpc/net/bpf_jit_comp.c > > +++ b/arch/powerpc/net/bpf_jit_comp.c > > @@ -237,6 +237,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) > > fp->jited_len = alloclen; > > > > bpf_flush_icache(bpf_hdr, (u8 *)bpf_hdr + (bpf_hdr->pages * PAGE_SIZE)); > > + bpf_jit_binary_lock_ro(bpf_hdr); > > if (!fp->is_func || extra_pass) { > > bpf_prog_fill_jited_linfo(fp, addrs); > > out_addrs: > >
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c index 6c8c268e4fe8..53aefee3fe70 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c @@ -237,6 +237,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) fp->jited_len = alloclen; bpf_flush_icache(bpf_hdr, (u8 *)bpf_hdr + (bpf_hdr->pages * PAGE_SIZE)); + bpf_jit_binary_lock_ro(bpf_hdr); if (!fp->is_func || extra_pass) { bpf_prog_fill_jited_linfo(fp, addrs); out_addrs: