[v1] x86: Disable EXECMEM_ROX support

[PATCH] x86: Disable EXECMEM_ROX support

Posted by Peter Zijlstra 11 months, 1 week ago

On Mon, Jan 13, 2025 at 12:11:16PM +0100, Peter Zijlstra wrote:

> There's definiltely breakage with that module_writable_address()
> nonsense in alternative.c that will not be fixed by that patch.
> 
> The very simplest thing at this point is to remove:
> 
>      select ARCH_HAS_EXECMEM_ROX             if X86_64
> 
> and try again next cycle.

Boris asked I send it as a proper patch, so here goes. Perhaps next time
let x86 merge x86 code :/

---
Subject: x86: Disable EXECMEM_ROX support

The whole module_writable_address() nonsense made a giant mess of
alternative.c, not to mention it still contains bugs -- notable some of the CFI
variants crash and burn.

Mike has been working on patches to clean all this up again, but given the
current state of things, this stuff just isn't ready.

Disable for now, lets try again next cycle.

Fixes: 5185e7f9f3bd ("x86/module: enable ROX caches for module text on 64 bit")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
---
 arch/x86/Kconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9d7bd0ae48c4..ef6cfea9df73 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -83,7 +83,6 @@ config X86
 	select ARCH_HAS_DMA_OPS			if GART_IOMMU || XEN
 	select ARCH_HAS_EARLY_DEBUG		if KGDB
 	select ARCH_HAS_ELF_RANDOMIZE
-	select ARCH_HAS_EXECMEM_ROX		if X86_64
 	select ARCH_HAS_FAST_MULTIPLIER
 	select ARCH_HAS_FORTIFY_SOURCE
 	select ARCH_HAS_GCOV_PROFILE_ALL

Re: [PATCH] x86: Disable EXECMEM_ROX support

Posted by Ville Syrjälä 11 months, 1 week ago

On Mon, Jan 13, 2025 at 12:29:34PM +0100, Peter Zijlstra wrote:
> On Mon, Jan 13, 2025 at 12:11:16PM +0100, Peter Zijlstra wrote:
> 
> > There's definiltely breakage with that module_writable_address()
> > nonsense in alternative.c that will not be fixed by that patch.
> > 
> > The very simplest thing at this point is to remove:
> > 
> >      select ARCH_HAS_EXECMEM_ROX             if X86_64
> > 
> > and try again next cycle.
> 
> Boris asked I send it as a proper patch, so here goes. Perhaps next time
> let x86 merge x86 code :/
> 
> ---
> Subject: x86: Disable EXECMEM_ROX support
> 
> The whole module_writable_address() nonsense made a giant mess of
> alternative.c, not to mention it still contains bugs -- notable some of the CFI
> variants crash and burn.
> 
> Mike has been working on patches to clean all this up again, but given the
> current state of things, this stuff just isn't ready.
> 
> Disable for now, lets try again next cycle.
> 
> Fixes: 5185e7f9f3bd ("x86/module: enable ROX caches for module text on 64 bit")
> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> ---
>  arch/x86/Kconfig | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index 9d7bd0ae48c4..ef6cfea9df73 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -83,7 +83,6 @@ config X86
>  	select ARCH_HAS_DMA_OPS			if GART_IOMMU || XEN
>  	select ARCH_HAS_EARLY_DEBUG		if KGDB
>  	select ARCH_HAS_ELF_RANDOMIZE
> -	select ARCH_HAS_EXECMEM_ROX		if X86_64
>  	select ARCH_HAS_FAST_MULTIPLIER
>  	select ARCH_HAS_FORTIFY_SOURCE
>  	select ARCH_HAS_GCOV_PROFILE_ALL

This one works for my hibernate woes.

In case you want it:
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>

-- 
Ville Syrjälä
Intel

Re: [PATCH] x86: Disable EXECMEM_ROX support

Posted by Borislav Petkov 11 months, 1 week ago

On Mon, Jan 13, 2025 at 12:29:34PM +0100, Peter Zijlstra wrote:
> On Mon, Jan 13, 2025 at 12:11:16PM +0100, Peter Zijlstra wrote:
> 
> > There's definiltely breakage with that module_writable_address()
> > nonsense in alternative.c that will not be fixed by that patch.
> > 
> > The very simplest thing at this point is to remove:
> > 
> >      select ARCH_HAS_EXECMEM_ROX             if X86_64
> > 
> > and try again next cycle.
> 
> Boris asked I send it as a proper patch, so here goes. Perhaps next time
> let x86 merge x86 code :/

I just love it how this went in without a single x86 maintainer Ack, it broke
a bunch of things and then it is still there instead of getting reverted.

Let's not do this again please.

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette

[tip: x86/urgent] x86: Disable EXECMEM_ROX support

Posted by tip-bot2 for Peter Zijlstra 11 months, 1 week ago

The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     a9bbe341333109465605e8733bab0b573cddcc8c
Gitweb:        https://git.kernel.org/tip/a9bbe341333109465605e8733bab0b573cddcc8c
Author:        Peter Zijlstra <peterz@infradead.org>
AuthorDate:    Mon, 13 Jan 2025 12:29:34 +01:00
Committer:     Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Mon, 13 Jan 2025 12:42:51 +01:00

x86: Disable EXECMEM_ROX support

The whole module_writable_address() nonsense made a giant mess of
alternative.c, not to mention it still contains bugs -- notable some of the
CFI variants crash and burn.

Mike has been working on patches to clean all this up again, but given the
current state of things, this stuff just isn't ready.

Disable for now, lets try again next cycle.

Fixes: 5185e7f9f3bd ("x86/module: enable ROX caches for module text on 64 bit")
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20250113112934.GA8385@noisy.programming.kicks-ass.net
---
 arch/x86/Kconfig | 1 -
 1 file changed, 1 deletion(-)

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 9d7bd0a..ef6cfea 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -83,7 +83,6 @@ config X86
 	select ARCH_HAS_DMA_OPS			if GART_IOMMU || XEN
 	select ARCH_HAS_EARLY_DEBUG		if KGDB
 	select ARCH_HAS_ELF_RANDOMIZE
-	select ARCH_HAS_EXECMEM_ROX		if X86_64
 	select ARCH_HAS_FAST_MULTIPLIER
 	select ARCH_HAS_FORTIFY_SOURCE
 	select ARCH_HAS_GCOV_PROFILE_ALL