This effectively unexports set_memory_ro and set_memory_rw functions, and
thus reverts a03352d2c1dc ("x86: export set_memory_ro and set_memory_rw").
They have been introduced for debugging purposes in e1000e, but no module
user is in mainline kernel (anymore?) and we explicitly do not want modules
to use these functions, as they i.e. protect eBPF (interpreted & JIT'ed)
images from malicious modifications or bugs.
Outside of eBPF scope, I believe also other set_memory_* functions should
be unexported on x86 for modules.
Signed-off-by: Daniel Borkmann <[email protected]>
Cc: Bruce Allan <[email protected]>
Cc: Jesse Brandeburg <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: [email protected]
Acked-by: Alexei Starovoitov <[email protected]>
---
arch/x86/mm/pageattr.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 536ea2f..81e8282 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -1654,13 +1654,11 @@ int set_memory_ro(unsigned long addr, int numpages)
{
return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_RW), 0);
}
-EXPORT_SYMBOL_GPL(set_memory_ro);
int set_memory_rw(unsigned long addr, int numpages)
{
return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_RW), 0);
}
-EXPORT_SYMBOL_GPL(set_memory_rw);
int set_memory_np(unsigned long addr, int numpages)
{
--
1.9.3
Commit-ID: 6bbb614ec478961c7443086bdf7fd6784479c14a
Gitweb: http://git.kernel.org/tip/6bbb614ec478961c7443086bdf7fd6784479c14a
Author: Daniel Borkmann <[email protected]>
AuthorDate: Fri, 27 Feb 2015 15:55:40 +0100
Committer: Ingo Molnar <[email protected]>
CommitDate: Sat, 28 Feb 2015 10:41:59 +0100
x86/mm: Unexport set_memory_ro() and set_memory_rw()
This effectively unexports set_memory_ro() and set_memory_rw()
functions, and thus reverts:
a03352d2c1dc ("x86: export set_memory_ro and set_memory_rw").
They have been introduced for debugging purposes in e1000e, but
no module user is in mainline kernel (anymore?) and we
explicitly do not want modules to use these functions, as they
i.e. protect eBPF (interpreted & JIT'ed) images from malicious
modifications or bugs.
Outside of eBPF scope, I believe also other set_memory_*()
functions should be unexported on x86 for modules.
Signed-off-by: Daniel Borkmann <[email protected]>
Acked-by: Alexei Starovoitov <[email protected]>
Cc: Arjan van de Ven <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Bruce Allan <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Jesse Brandeburg <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: [email protected]
Link: http://lkml.kernel.org/r/a064393a0a5d319eebde5c761cfd743132d4f213.1425040940.git.daniel@iogearbox.net
Signed-off-by: Ingo Molnar <[email protected]>
---
arch/x86/mm/pageattr.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 536ea2f..81e8282 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -1654,13 +1654,11 @@ int set_memory_ro(unsigned long addr, int numpages)
{
return change_page_attr_clear(&addr, numpages, __pgprot(_PAGE_RW), 0);
}
-EXPORT_SYMBOL_GPL(set_memory_ro);
int set_memory_rw(unsigned long addr, int numpages)
{
return change_page_attr_set(&addr, numpages, __pgprot(_PAGE_RW), 0);
}
-EXPORT_SYMBOL_GPL(set_memory_rw);
int set_memory_np(unsigned long addr, int numpages)
{
On 2/28/2015 2:00 AM, tip-bot for Daniel Borkmann wrote:
> Commit-ID: 6bbb614ec478961c7443086bdf7fd6784479c14a
> Gitweb: http://git.kernel.org/tip/6bbb614ec478961c7443086bdf7fd6784479c14a
> Author: Daniel Borkmann <[email protected]>
> AuthorDate: Fri, 27 Feb 2015 15:55:40 +0100
> Committer: Ingo Molnar <[email protected]>
> CommitDate: Sat, 28 Feb 2015 10:41:59 +0100
>
> x86/mm: Unexport set_memory_ro() and set_memory_rw()
>
> This effectively unexports set_memory_ro() and set_memory_rw()
> functions, and thus reverts:
>
> a03352d2c1dc ("x86: export set_memory_ro and set_memory_rw").
>
> They have been introduced for debugging purposes in e1000e, but
> no module user is in mainline kernel (anymore?) and we
> explicitly do not want modules to use these functions, as they
> i.e. protect eBPF (interpreted & JIT'ed) images from malicious
> modifications or bugs.
>
> Outside of eBPF scope, I believe also other set_memory_*()
> functions should be unexported on x86 for modules.
>
Acked-by: Arjan van de Ven <[email protected]>