Commit 9dd721c6 authored by Kees Cook's avatar Kees Cook Committed by H. Peter Anvin

x86, kaslr: fix module lock ordering problem

There was a potential lock ordering problem with the module kASLR patch
("x86, kaslr: randomize module base load address"). This patch removes
the usage of the module_mutex and creates a new mutex to protect the
module base address offset value.

Chain exists of:
  text_mutex --> kprobe_insn_slots.mutex --> module_mutex

[    0.515561]  Possible unsafe locking scenario:
[    0.515561]
[    0.515561]        CPU0                    CPU1
[    0.515561]        ----                    ----
[    0.515561]   lock(module_mutex);
[    0.515561]                                lock(kprobe_insn_slots.mutex);
[    0.515561]                                lock(module_mutex);
[    0.515561]   lock(text_mutex);
[    0.515561]
[    0.515561]  *** DEADLOCK ***
Reported-by: default avatarFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: default avatarAndy Honig <ahonig@google.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarMasami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
parent e2b32e67
...@@ -48,6 +48,9 @@ do { \ ...@@ -48,6 +48,9 @@ do { \
static unsigned long module_load_offset; static unsigned long module_load_offset;
static int randomize_modules = 1; static int randomize_modules = 1;
/* Mutex protects the module_load_offset. */
static DEFINE_MUTEX(module_kaslr_mutex);
static int __init parse_nokaslr(char *p) static int __init parse_nokaslr(char *p)
{ {
randomize_modules = 0; randomize_modules = 0;
...@@ -58,7 +61,7 @@ early_param("nokaslr", parse_nokaslr); ...@@ -58,7 +61,7 @@ early_param("nokaslr", parse_nokaslr);
static unsigned long int get_module_load_offset(void) static unsigned long int get_module_load_offset(void)
{ {
if (randomize_modules) { if (randomize_modules) {
mutex_lock(&module_mutex); mutex_lock(&module_kaslr_mutex);
/* /*
* Calculate the module_load_offset the first time this * Calculate the module_load_offset the first time this
* code is called. Once calculated it stays the same until * code is called. Once calculated it stays the same until
...@@ -67,7 +70,7 @@ static unsigned long int get_module_load_offset(void) ...@@ -67,7 +70,7 @@ static unsigned long int get_module_load_offset(void)
if (module_load_offset == 0) if (module_load_offset == 0)
module_load_offset = module_load_offset =
(get_random_int() % 1024 + 1) * PAGE_SIZE; (get_random_int() % 1024 + 1) * PAGE_SIZE;
mutex_unlock(&module_mutex); mutex_unlock(&module_kaslr_mutex);
} }
return module_load_offset; return module_load_offset;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment