diff options
| author | Dennis Chen <dechen@redhat.com> | 2026-10-14 13:58:59 -0400 |
|---|---|---|
| committer | Kees Cook <kees@kernel.org> | 2026-10-14 13:11:13 -0700 |
| commit | e2cd253cb31bb0da4bcc512e20bfeebf76880891 (patch) | |
| tree | 2dfd53df93f8a15bd16500b9a75c8b0f94039eb0 | |
| parent | ef16259088f99c5997e198561bdcbb89ab70fd0f (diff) | |
| download | linux-next-e2cd253cb31bb0da4bcc512e20bfeebf76880891.tar.gz linux-next-e2cd253cb31bb0da4bcc512e20bfeebf76880891.zip | |
lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
native_write_cr4 should not be exported to modules. Commit 21953ee5013d
("x86/cpu: Export native_write_cr4() only when CONFIG_LKTDM=m")
restricted the export somewhat, but native_write_cr4() is still exposed
to all GPL-compatible modules when CONFIG_LKDTM=m.
UNSET_SMEP is the only module user of native_write_cr4(). Restrict
the test to CONFIG_LKDTM=y and remove the export. When LKDTM is
built as a module, report XFAIL for UNSET_SMEP.
Suggested-by: Christoph Hellwig <hch@infradead.org>
Link: https://lore.kernel.org/all/20200420090102.GB24518@infradead.org/
Signed-off-by: Dennis Chen <dechen@redhat.com>
Link: https://patch.msgid.link/20261014175859.30863-1-dechen@redhat.com
Signed-off-by: Kees Cook <kees@kernel.org>
| -rw-r--r-- | arch/x86/kernel/cpu/common.c | 3 | ||||
| -rw-r--r-- | drivers/misc/lkdtm/bugs.c | 4 |
2 files changed, 2 insertions, 5 deletions
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index c7352827f491..7c1b9e045d5f 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -490,9 +490,6 @@ set_register: bits_changed); } } -#if IS_MODULE(CONFIG_LKDTM) -EXPORT_SYMBOL_GPL(native_write_cr4); -#endif void cr4_update_irqsoff(unsigned long set, unsigned long clear) { diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index 3eca2ef64aff..d82c47fb9f03 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -676,7 +676,7 @@ static void lkdtm_STACK_GUARD_PAGE_TRAILING(void) static void lkdtm_UNSET_SMEP(void) { -#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML) +#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML) && IS_BUILTIN(CONFIG_LKDTM) #define MOV_CR4_DEPTH 64 void (*direct_write_cr4)(unsigned long val); unsigned char *insn; @@ -737,7 +737,7 @@ static void lkdtm_UNSET_SMEP(void) native_write_cr4(cr4); } #else - pr_err("XFAIL: this test is x86_64-only\n"); + pr_err("XFAIL: this test is x86_64-only and requires CONFIG_LKDTM=y\n"); #endif } |