On Wed, 2016-08-10 at 10:43 +0100, Russell King - ARM Linux wrote: > On Fri, Jun 03, 2016 at 11:40:24AM -0700, Kees Cook wrote: > > > > @@ -1309,16 +1309,11 @@ void __init arm_mm_memblock_reserve(void) > > * Any other function or debugging method which may touch any > > device _will_ > > * crash the kernel. > > */ > > +static char vectors[PAGE_SIZE * 2] __ro_after_init > > __aligned(PAGE_SIZE); > > static void __init devicemaps_init(const struct machine_desc > > *mdesc) > > { > > struct map_desc map; > > unsigned long addr; > > - void *vectors; > > - > > - /* > > - * Allocate the vector page early. > > - */ > > - vectors = early_alloc(PAGE_SIZE * 2); > > This one is not appropriate. We _do_ write to these pages after init > for FIQ handler updates. See set_fiq_handler(). This is one of the many cases where pax_open_kernel/pax_close_kernel are needed to temporarily toggle it read-only. From grsecurity: @@ -95,7 +95,10 @@ void set_fiq_handler(void *start, unsigned int length) void *base = vectors_page; unsigned offset = FIQ_OFFSET; + pax_open_kernel(); memcpy(base + offset, start, length); + pax_close_kernel();
Attachment:
signature.asc
Description: This is a digitally signed message part