On Sat Nov 9, 2024 at 11:35 AM CET, Christophe Leroy wrote:
> module_enable_rodata_ro() is called twice, once before module init
> to set rodata sections readonly and once after module init to set
> rodata_after_init section readonly.
>
> The second time, only the rodata_after_init section needs to be
> set to read-only, no need to re-apply it to already set rodata.
>
> Split module_enable_rodata_ro() in two.
>
> Signed-off-by: Christophe Leroy <christophe.leroy@xxxxxxxxxx>
Tested-by: Daniel Gomez <da.gomez@xxxxxxxxxxx>
> ---
> kernel/module/internal.h | 3 ++-
> kernel/module/main.c | 4 ++--
> kernel/module/strict_rwx.c | 13 +++++++++----
> 3 files changed, 13 insertions(+), 7 deletions(-)
>
> diff --git a/kernel/module/internal.h b/kernel/module/internal.h
> index 2ebece8a789f..994f35a779dc 100644
> --- a/kernel/module/internal.h
> +++ b/kernel/module/internal.h
> @@ -322,7 +322,8 @@ static inline struct module *mod_find(unsigned long addr, struct mod_tree_root *
> }
> #endif /* CONFIG_MODULES_TREE_LOOKUP */
>
> -int module_enable_rodata_ro(const struct module *mod, bool after_init);
> +int module_enable_rodata_ro(const struct module *mod);
> +int module_enable_rodata_ro_after_init(const struct module *mod);
> int module_enable_data_nx(const struct module *mod);
> int module_enable_text_rox(const struct module *mod);
> int module_enforce_rwx_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs,
> diff --git a/kernel/module/main.c b/kernel/module/main.c
> index 49b9bca9de12..2de4ad7af335 100644
> --- a/kernel/module/main.c
> +++ b/kernel/module/main.c
> @@ -2581,7 +2581,7 @@ static noinline int do_init_module(struct module *mod)
> /* Switch to core kallsyms now init is done: kallsyms may be walking! */
> rcu_assign_pointer(mod->kallsyms, &mod->core_kallsyms);
> #endif
> - ret = module_enable_rodata_ro(mod, true);
> + ret = module_enable_rodata_ro_after_init(mod);
> if (ret)
> goto fail_mutex_unlock;
> mod_tree_remove_init(mod);
> @@ -2751,7 +2751,7 @@ static int complete_formation(struct module *mod, struct load_info *info)
> module_bug_finalize(info->hdr, info->sechdrs, mod);
> module_cfi_finalize(info->hdr, info->sechdrs, mod);
>
> - err = module_enable_rodata_ro(mod, false);
> + err = module_enable_rodata_ro(mod);
> if (err)
> goto out_strict_rwx;
> err = module_enable_data_nx(mod);
> diff --git a/kernel/module/strict_rwx.c b/kernel/module/strict_rwx.c
> index c45caa4690e5..f68c59974ae2 100644
> --- a/kernel/module/strict_rwx.c
> +++ b/kernel/module/strict_rwx.c
> @@ -44,7 +44,7 @@ int module_enable_text_rox(const struct module *mod)
> return 0;
> }
>
> -int module_enable_rodata_ro(const struct module *mod, bool after_init)
> +int module_enable_rodata_ro(const struct module *mod)
> {
> int ret;
>
> @@ -58,12 +58,17 @@ int module_enable_rodata_ro(const struct module *mod, bool after_init)
> if (ret)
> return ret;
>
> - if (after_init)
> - return module_set_memory(mod, MOD_RO_AFTER_INIT, set_memory_ro);
> -
> return 0;
> }
>
> +int module_enable_rodata_ro_after_init(const struct module *mod)
> +{
> + if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX) || !rodata_enabled)
> + return 0;
> +
> + return module_set_memory(mod, MOD_RO_AFTER_INIT, set_memory_ro);
> +}
> +
> int module_enable_data_nx(const struct module *mod)
> {
> if (!IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
