From e2cd253cb31bb0da4bcc512e20bfeebf76880891 Mon Sep 17 00:00:00 2001 From: Dennis Chen Date: Wed, 14 Oct 2026 13:58:59 -0400 Subject: lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4() native_write_cr4 should not be exported to modules. Commit 21953ee5013d ("x86/cpu: Export native_write_cr4() only when CONFIG_LKTDM=m") restricted the export somewhat, but native_write_cr4() is still exposed to all GPL-compatible modules when CONFIG_LKDTM=m. UNSET_SMEP is the only module user of native_write_cr4(). Restrict the test to CONFIG_LKDTM=y and remove the export. When LKDTM is built as a module, report XFAIL for UNSET_SMEP. Suggested-by: Christoph Hellwig Link: https://lore.kernel.org/all/20200420090102.GB24518@infradead.org/ Signed-off-by: Dennis Chen Link: https://patch.msgid.link/20261014175859.30863-1-dechen@redhat.com Signed-off-by: Kees Cook --- arch/x86/kernel/cpu/common.c | 3 --- drivers/misc/lkdtm/bugs.c | 4 ++-- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index c7352827f491..7c1b9e045d5f 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -490,9 +490,6 @@ set_register: bits_changed); } } -#if IS_MODULE(CONFIG_LKDTM) -EXPORT_SYMBOL_GPL(native_write_cr4); -#endif void cr4_update_irqsoff(unsigned long set, unsigned long clear) { diff --git a/drivers/misc/lkdtm/bugs.c b/drivers/misc/lkdtm/bugs.c index 3eca2ef64aff..d82c47fb9f03 100644 --- a/drivers/misc/lkdtm/bugs.c +++ b/drivers/misc/lkdtm/bugs.c @@ -676,7 +676,7 @@ static void lkdtm_STACK_GUARD_PAGE_TRAILING(void) static void lkdtm_UNSET_SMEP(void) { -#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML) +#if IS_ENABLED(CONFIG_X86_64) && !IS_ENABLED(CONFIG_UML) && IS_BUILTIN(CONFIG_LKDTM) #define MOV_CR4_DEPTH 64 void (*direct_write_cr4)(unsigned long val); unsigned char *insn; @@ -737,7 +737,7 @@ static void lkdtm_UNSET_SMEP(void) native_write_cr4(cr4); } #else - pr_err("XFAIL: this test is x86_64-only\n"); + pr_err("XFAIL: this test is x86_64-only and requires CONFIG_LKDTM=y\n"); #endif } -- cgit v1.2.3