RE: [PATCH v2] MIPS: Add nonxstack=on|off kernel parameter

From: Miodrag Dinic
Date: Fri Dec 01 2017 - 06:38:28 EST

Next message: Matthias Brugger: "Re: [PATCH 3/3] arm: dts: mt7623: fix card detection issue on bananapi-r2"
Previous message: Jinbum Park: "[kernel-hardening][PATCH v2 3/3] arm: mm: dump: add checking for writable and executable pages"
Next in thread: David Daney: "Re: [PATCH v2] MIPS: Add nonxstack=on|off kernel parameter"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Hi everyone,

just a note, even though we started discussion on V2 version of this patch, an up to date V3 version is available at :
https://patchwork.kernel.org/patch/10068871/

It contains spelling check fixes.

Thank you.

Kind regards,
Miodrag

________________________________________
From: Miodrag Dinic
Sent: Thursday, November 30, 2017 2:06 PM
To: James Hogan
Cc: David Daney; Aleksandar Markovic; linux-mips@xxxxxxxxxxxxxx; Aleksandar Markovic; Andrew Morton; DengCheng Zhu; Ding Tianhong; Douglas Leung; Frederic Weisbecker; Goran Ferenc; Ingo Molnar; James Cowgill; Jonathan Corbet; linux-doc@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Marc Zyngier; Matt Redfearn; Mimi Zohar; Paul Burton; Paul E. McKenney; Petar Jovanovic; Raghu Gandham; Ralf Baechle; Thomas Gleixner; Tom Saeger
Subject: RE: [PATCH v2] MIPS: Add nonxstack=on|off kernel parameter

Hi James,

> > We do have PT_GNU_STACK flags set correctly, this feature is required to
> > workaround CPU revisions which do not have RIXI support.
>
> RIXI support can be discovered programatically from CP0_Config3.RXI
> (cpu_has_rixi in asm/cpu-features.h), so I don't follow why CPUs without
> RIXI would require a kernel parameter.

The following patch introduced change in behavior with regards to
stack & heap execute-ability :
commit 1a770b85c1f1c1ee37afd7cef5237ffc4c970f04
Author: Paul Burton <paul.burton@xxxxxxxxxx>
Date: Fri Jul 8 11:06:20 2016 +0100

MIPS: non-exec stack & heap when non-exec PT_GNU_STACK is present

The stack and heap have both been executable by default on MIPS until
now. This patch changes the default to be non-executable, but only for
ELF binaries with a non-executable PT_GNU_STACK header present. This
does apply to both the heap & the stack, despite the name PT_GNU_STACK,
and this matches the behaviour of other architectures like ARM & x86.

Current MIPS toolchains do not produce the PT_GNU_STACK header, which
means that we can rely upon this patch not changing the behaviour of
existing binaries. The new default will only take effect for newly
compiled binaries once toolchains are updated to support PT_GNU_STACK,
and since those binaries are newly compiled they can be compiled
expecting the change in default behaviour. Again this matches the way in
which the ARM & x86 architectures handled their implementations of
non-executable memory.

Signed-off-by: Paul Burton <paul.burton@xxxxxxxxxx>
Cc: Leonid Yegoshin <leonid.yegoshin@xxxxxxxxxx>
Cc: Maciej Rozycki <maciej.rozycki@xxxxxxxxxx>
Cc: Faraz Shahbazker <faraz.shahbazker@xxxxxxxxxx>
Cc: Raghu Gandham <raghu.gandham@xxxxxxxxxx>
Cc: Matthew Fortune <matthew.fortune@xxxxxxxxxx>
Cc: linux-mips@xxxxxxxxxxxxxx
Patchwork: https://patchwork.linux-mips.org/patch/13765/
Signed-off-by: Ralf Baechle <ralf@xxxxxxxxxxxxxx>

...

When kernel is detecting the type of mapping it should apply :

fs/binfmt_elf.c:
..
if (elf_read_implies_exec(loc->elf_ex, executable_stack))
current->personality |= READ_IMPLIES_EXEC;
..

this effectively calls mips_elf_read_implies_exec() which performs a check:
..
if (!cpu_has_rixi) {
/* The CPU doesn't support non-executable memory */
return 1;
}

return 0;
}

This will in turn make stack & heap executable on processors without RIXI, which are practically all processors with MIPS ISA R < 6.

We would like to have an option to override this and force non-executable mappings for such systems.

Kind regards,
Miodrag
________________________________________
From: James Hogan
Sent: Thursday, November 30, 2017 11:09 AM
To: Miodrag Dinic
Cc: David Daney; Aleksandar Markovic; linux-mips@xxxxxxxxxxxxxx; Aleksandar Markovic; Andrew Morton; DengCheng Zhu; Ding Tianhong; Douglas Leung; Frederic Weisbecker; Goran Ferenc; Ingo Molnar; James Cowgill; Jonathan Corbet; linux-doc@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Marc Zyngier; Matt Redfearn; Mimi Zohar; Paul Burton; Paul E. McKenney; Petar Jovanovic; Raghu Gandham; Ralf Baechle; Thomas Gleixner; Tom Saeger
Subject: Re: [PATCH v2] MIPS: Add nonxstack=on|off kernel parameter

On Thu, Nov 30, 2017 at 09:34:15AM +0000, Miodrag Dinic wrote:
> Hi David,
>
> Sorry for a late response, please find answers in-lined:
>
> > > If this parameter is omitted, kernel behavior remains the same as it
> > > was before this patch is applied.
> >
> > Do other architectures have a similar hack?
> >
> > If arm{,64} and x86 don't need this, what would make MIPS so special
> > that we have to carry this around?
>
> Yes, there are similar workarounds. Just a couple lines above
> nonxstack description in the documentation there are :
> noexec [IA-64]
>
> noexec [X86]
> On X86-32 available only on PAE configured kernels.
> noexec=on: enable non-executable mappings (default)
> noexec=off: disable non-executable mappings
> ...
>
> noexec32 [X86-64]
> This affects only 32-bit executables.
> noexec32=on: enable non-executable mappings (default)
> read doesn't imply executable mappings
> noexec32=off: disable non-executable mappings
> read implies executable mappings
>
> > >
> > > This functionality is convenient during debugging and is especially
> > > useful for Android development where non-exec stack is required.
> >
> > Why not just set the PT_GNU_STACK flags correctly in the first place?
>
> We do have PT_GNU_STACK flags set correctly, this feature is required to
> workaround CPU revisions which do not have RIXI support.

RIXI support can be discovered programatically from CP0_Config3.RXI
(cpu_has_rixi in asm/cpu-features.h), so I don't follow why CPUs without
RIXI would require a kernel parameter.

Cheers
James

>
> Kind regards,
> Miodrag
> ________________________________________
> From: David Daney [ddaney@xxxxxxxxxxxxxxxxxx]
> Sent: Tuesday, November 21, 2017 9:53 PM
> To: Aleksandar Markovic; linux-mips@xxxxxxxxxxxxxx
> Cc: Miodrag Dinic; Aleksandar Markovic; Andrew Morton; DengCheng Zhu; Ding Tianhong; Douglas Leung; Frederic Weisbecker; Goran Ferenc; Ingo Molnar; James Cowgill; James Hogan; Jonathan Corbet; linux-doc@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; Marc Zyngier; Matt Redfearn; Mimi Zohar; Paul Burton; Paul E. McKenney; Petar Jovanovic; Raghu Gandham; Ralf Baechle; Thomas Gleixner; Tom Saeger
> Subject: Re: [PATCH v2] MIPS: Add nonxstack=on|off kernel parameter
>
> On 11/21/2017 05:56 AM, Aleksandar Markovic wrote:
> > From: Miodrag Dinic <miodrag.dinic@xxxxxxxx>
> >
> > Add a new kernel parameter to override the default behavior related
> > to the decision whether to set up stack as non-executable in function
> > mips_elf_read_implies_exec().
> >
> > The new parameter is used to control non executable stack and heap,
> > regardless of PT_GNU_STACK entry. This does apply to both stack and
> > heap, despite the name.
> >
> > Allowed values:
> >
> > nonxstack=on Force non-exec stack & heap
> > nonxstack=off Force executable stack & heap
> >
> > If this parameter is omitted, kernel behavior remains the same as it
> > was before this patch is applied.
>
> Do other architectures have a similar hack?
>
> If arm{,64} and x86 don't need this, what would make MIPS so special
> that we have to carry this around?
>
>
> >
> > This functionality is convenient during debugging and is especially
> > useful for Android development where non-exec stack is required.
>
> Why not just set the PT_GNU_STACK flags correctly in the first place?
>
> >
> > Signed-off-by: Miodrag Dinic <miodrag.dinic@xxxxxxxx>
> > Signed-off-by: Aleksandar Markovic <aleksandar.markovic@xxxxxxxx>
> > ---
> > Documentation/admin-guide/kernel-parameters.txt | 11 +++++++
> > arch/mips/kernel/elf.c | 39 +++++++++++++++++++++++++
> > 2 files changed, 50 insertions(+)
> >
> > diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
> > index b74e133..99464ee 100644
> > --- a/Documentation/admin-guide/kernel-parameters.txt
> > +++ b/Documentation/admin-guide/kernel-parameters.txt
> > @@ -2614,6 +2614,17 @@
> > noexec32=off: disable non-executable mappings
> > read implies executable mappings
> >
> > + nonxstack [MIPS]
> > + Force setting up stack and heap as non-executable or
> > + executable regardless of PT_GNU_STACK entry. Both
> > + stack and heap are affected, despite the name. Valid
> > + arguments: on, off.
> > + nonxstack=on: Force non-executable stack and heap
> > + nonxstack=off: Force executable stack and heap
> > + If ommited, stack and heap will or will not be set
> > + up as non-executable depending on PT_GNU_STACK
> > + entry and possibly other factors.
> > +
> > nofpu [MIPS,SH] Disable hardware FPU at boot time.
> >
> > nofxsr [BUGS=X86-32] Disables x86 floating point extended
> > diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c
> > index 731325a..28ef7f3 100644
> > --- a/arch/mips/kernel/elf.c
> > +++ b/arch/mips/kernel/elf.c
> > @@ -326,8 +326,47 @@ void mips_set_personality_nan(struct arch_elf_state *state)
> > }
> > }
> >
> > +static int nonxstack = EXSTACK_DEFAULT;
> > +
> > +/*
> > + * kernel parameter: nonxstack=on|off
> > + *
> > + * Force setting up stack and heap as non-executable or
> > + * executable regardless of PT_GNU_STACK entry. Both
> > + * stack and heap are affected, despite the name. Valid
> > + * arguments: on, off.
> > + *
> > + * nonxstack=on: Force non-executable stack and heap
> > + * nonxstack=off: Force executable stack and heap
> > + *
> > + * If ommited, stack and heap will or will not be set
> > + * up as non-executable depending on PT_GNU_STACK
> > + * entry and possibly other factors.
> > + */
> > +static int __init nonxstack_setup(char *str)
> > +{
> > + if (!strcmp(str, "on"))
> > + nonxstack = EXSTACK_DISABLE_X;
> > + else if (!strcmp(str, "off"))
> > + nonxstack = EXSTACK_ENABLE_X;
> > + else
> > + pr_err("Malformed nonxstack format! nonxstack=on|off\n");
> > +
> > + return 1;
> > +}
> > +__setup("nonxstack=", nonxstack_setup);
> > +
> > int mips_elf_read_implies_exec(void *elf_ex, int exstack)
> > {
> > + switch (nonxstack) {
> > + case EXSTACK_DISABLE_X:
> > + return 0;
> > + case EXSTACK_ENABLE_X:
> > + return 1;
> > + default:
> > + break;
> > + }
> > +
> > if (exstack != EXSTACK_DISABLE_X) {
> > /* The binary doesn't request a non-executable stack */
> > return 1;
> >
>
>

Next message: Matthias Brugger: "Re: [PATCH 3/3] arm: dts: mt7623: fix card detection issue on bananapi-r2"
Previous message: Jinbum Park: "[kernel-hardening][PATCH v2 3/3] arm: mm: dump: add checking for writable and executable pages"
Next in thread: David Daney: "Re: [PATCH v2] MIPS: Add nonxstack=on|off kernel parameter"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]