github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()

Browse Source 
native_write_cr4 should not be exported to modules. Commit 21953ee501
("x86/cpu: Export native_write_cr4() only when CONFIG_LKTDM=m")
restricted the export somewhat, but native_write_cr4() is still exposed
to all GPL-compatible modules when CONFIG_LKDTM=m.

UNSET_SMEP is the only module user of native_write_cr4(). Restrict
the test to CONFIG_LKDTM=y and remove the export. When LKDTM is
built as a module, report XFAIL for UNSET_SMEP.

Suggested-by: Christoph Hellwig <hch@infradead.org>
Link: https://lore.kernel.org/all/20200420090102.GB24518@infradead.org/
Signed-off-by: Dennis Chen <dechen@redhat.com>
Link: https://patch.msgid.link/20261014175859.30863-1-dechen@redhat.com
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Dennis Chen 2026-10-14 13:58:59 -04:00 committed by Kees Cook
parent ef16259088
commit e2cd253cb3
2 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
arch/x86/kernel/cpu/common.c
View File

@ -490,9 +490,6 @@ void __no_profile native_write_cr4(unsigned long val)
bits_changed);
}
}
#if IS_MODULE(CONFIG_LKDTM)
EXPORT_SYMBOL_GPL(native_write_cr4);
#endif
void cr4_update_irqsoff(unsigned long set, unsigned long clear)
{

4
drivers/misc/lkdtm/bugs.c
View File

@ -676,7 +676,7 @@ static void lkdtm_STACK_GUARD_PAGE_TRAILING(void)
static void lkdtm_UNSET_SMEP(void)
{
#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML)
#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML) && IS_BUILTIN(CONFIG_LKDTM)
#define MOV_CR4_DEPTH 64
void (*direct_write_cr4)(unsigned long val);
unsigned char *insn;
@ -737,7 +737,7 @@ static void lkdtm_UNSET_SMEP(void)
native_write_cr4(cr4);
}
#else
pr_err("XFAIL: this test is x86_64-only\n");
pr_err("XFAIL: this test is x86_64-only and requires CONFIG_LKDTM=y\n");
#endif
}