arm64: page-align sections for DEBUG_RODATA

A kernel built with DEBUG_RO_DATA && !CONFIG_DEBUG_ALIGN_RODATA doesn't have .text aligned to a page boundary, though fixup_executable works at page-granularity thanks to its use of create_mapping. If .text is not page-aligned, the first page it exists in may be marked non-executable, leading to failures when an attempt is made to execute code in said page.

This patch upgrades ALIGN_DEBUG_RO and ALIGN_DEBUG_RO_MIN to force page alignment for DEBUG_RO_DATA && !CONFIG_DEBUG_ALIGN_RODATA kernels, ensuring that all sections with specific RWX permission requirements are mapped with the correct permissions.

Signed-off-by Mark Rutland <[email protected]>

Reported-by Jeremy Linton <[email protected]>

Reviewed-by Laura Abbott <[email protected]>

Cc Ard Biesheuvel <[email protected]>

Cc Catalin Marinas <[email protected]>

Cc Suzuki Poulose <[email protected]>

Cc Will Deacon <[email protected]>

---
 arch/arm64/kernel/vmlinux.lds.S | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Note: this is intended to supercede [1,2].

[1] http://lists.infradead.org/pipermail/linux-arm-kernel/2015-October/380486.html
[2] http://lists.infradead.org/pipermail/linux-arm-kernel/2015-October/380999.html

arch/arm64/kernel/vmlinux.lds.S +0 -0

index 9807333..4d77757 100644
@@ -60,9 +60,12 @@ PECOFF_FILE_ALIGNMENT = 0x200;
 #define PECOFF_EDATA_PADDING
 #endif
 

Quoted 36 lines · Mark Rutland

A kernel built with DEBUG_RO_DATA && !CONFIG_DEBUG_ALIGN_RODATA doesn't have .text aligned to a page boundary, though fixup_executable works at page-granularity thanks to its use of create_mapping. If .text is not page-aligned, the first page it exists in may be marked non-executable, leading to failures when an attempt is made to execute code in said page.

This patch upgrades ALIGN_DEBUG_RO and ALIGN_DEBUG_RO_MIN to force page alignment for DEBUG_RO_DATA && !CONFIG_DEBUG_ALIGN_RODATA kernels, ensuring that all sections with specific RWX permission requirements are mapped with the correct permissions.

Signed-off-by Mark Rutland <[email protected]>

Reported-by Jeremy Linton <[email protected]>

Reviewed-by Laura Abbott <[email protected]>

Cc Ard Biesheuvel <[email protected]>

Cc Catalin Marinas <[email protected]>

Cc Suzuki Poulose <[email protected]>

Cc Will Deacon <[email protected]>

---
 arch/arm64/kernel/vmlinux.lds.S | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Note: this is intended to supercede [1,2].

[1] http://lists.infradead.org/pipermail/linux-arm-kernel/2015-October/380486.html
[2] http://lists.infradead.org/pipermail/linux-arm-kernel/2015-October/380999.html

arch/arm64/kernel/vmlinux.lds.S +0 -0

index 9807333..4d77757 100644
@@ -60,9 +60,12 @@ PECOFF_FILE_ALIGNMENT = 0x200;
 #define PECOFF_EDATA_PADDING
 #endif
 

arch/arm64/kernel/vmlinux.lds.S PECOFF_FILE_ALIGNMENT = 0x200; · line 71

Quoted 10 lines

arch/arm64/kernel/vmlinux.lds.S +4 -1

-#ifdef CONFIG_DEBUG_ALIGN_RODATA
+#if defined(CONFIG_DEBUG_ALIGN_RODATA)
 #define ALIGN_DEBUG_RO                 . = ALIGN(1<<SECTION_SHIFT);
 #define ALIGN_DEBUG_RO_MIN(min)                ALIGN_DEBUG_RO
+#elif defined(CONFIG_DEBUG_RODATA)
+#define ALIGN_DEBUG_RO                 . = ALIGN(1<<PAGE_SHIFT);
+#define ALIGN_DEBUG_RO_MIN(min)                ALIGN_DEBUG_RO
 #else
 #define ALIGN_DEBUG_RO
 #define ALIGN_DEBUG_RO_MIN(min)                . = ALIGN(min);

Acked-by Ard Biesheuvel <[email protected]>

Quoted 20 lines · Ard Biesheuvel

Quoted 19 lines · Mark Rutland

A kernel built with DEBUG_RO_DATA && !CONFIG_DEBUG_ALIGN_RODATA doesn't have .text aligned to a page boundary, though fixup_executable works at page-granularity thanks to its use of create_mapping. If .text is not page-aligned, the first page it exists in may be marked non-executable, leading to failures when an attempt is made to execute code in said page.

This patch upgrades ALIGN_DEBUG_RO and ALIGN_DEBUG_RO_MIN to force page alignment for DEBUG_RO_DATA && !CONFIG_DEBUG_ALIGN_RODATA kernels, ensuring that all sections with specific RWX permission requirements are mapped with the correct permissions.

Signed-off-by Mark Rutland <[email protected]>

Reported-by Jeremy Linton <[email protected]>

Reviewed-by Laura Abbott <[email protected]>

Cc Ard Biesheuvel <[email protected]>

Cc Catalin Marinas <[email protected]>

Cc Suzuki Poulose <[email protected]>

Cc Will Deacon <[email protected]>

Jeremy, does this work for you?

If so, I expect Catalin will take this for 4.4, with the addition of any Acks and:

Fixes da141706aea52c1a ("arm64: add better page protections to arm64")

Cc <[email protected]>