NothingOSS/android_kernel_msm-6.1_nothing_sm7635
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Revert "ANDROID: GKI: Add module load time protected symbol lookup"

Browse source 
This reverts commit f5794dc184.

Reason for revert: Upstream mainline module code has been refactored;
and gki-modules implementation has changed, too. So, reverting all
old stuff and adding the new with rebase as single patch via
aosp/2260477.

Signed-off-by: Ramji Jiyani <ramjiyani@google.com>
Change-Id: I095a6bb8644a81703c3fbb273845a8d0a2c6e912
This commit is contained in:
Ramji Jiyani 2022-10-20 00:36:01 +00:00
parent d7b5f1b219
commit 452678e272
8 changed files with 0 additions and 104 deletions
Download patch file Download diff file Expand all files Collapse all files

1
android/abi_gki_modules_exports
View file

@ -1 +0,0 @@
[abi_symbol_list]

1
android/abi_gki_modules_protected
View file

@ -1 +0,0 @@
[abi_symbol_list]

2
arch/arm64/configs/gki_defconfig
View file

@ -81,8 +81,6 @@ CONFIG_SHADOW_CALL_STACK=y
CONFIG_MODULES=y
CONFIG_MODULE_UNLOAD=y
CONFIG_MODVERSIONS=y
CONFIG_MODULE_SIG=y
CONFIG_MODULE_SIG_PROTECT=y
CONFIG_BLK_DEV_ZONED=y
CONFIG_BLK_INLINE_ENCRYPTION=y
CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y

2
arch/x86/configs/gki_defconfig
View file

@ -71,8 +71,6 @@ CONFIG_JUMP_LABEL=y
CONFIG_MODULES=y
CONFIG_MODULE_UNLOAD=y
CONFIG_MODVERSIONS=y
CONFIG_MODULE_SIG=y
CONFIG_MODULE_SIG_PROTECT=y
CONFIG_BLK_DEV_ZONED=y
CONFIG_BLK_INLINE_ENCRYPTION=y
CONFIG_BLK_INLINE_ENCRYPTION_FALLBACK=y

17
kernel/Makefile
View file

@ -67,7 +67,6 @@ obj-y += up.o
endif
obj-$(CONFIG_UID16) += uid16.o
obj-$(CONFIG_MODULE_SIG_FORMAT) += module_signature.o
obj-$(CONFIG_MODULE_SIG_PROTECT) += gki_module.o
obj-$(CONFIG_KALLSYMS) += kallsyms.o
obj-$(CONFIG_BSD_PROCESS_ACCT) += acct.o
obj-$(CONFIG_CRASH_CORE) += crash_core.o
@ -159,19 +158,3 @@ $(obj)/kheaders_data.tar.xz: FORCE
$(call cmd,genikh)
clean-files := kheaders_data.tar.xz kheaders.md5
#
# ANDROID: GKI: Generate headerfiles required for gki_module.o
#
# Dependencies on generated files need to be listed explicitly
$(obj)/gki_module.o: $(obj)/gki_module_protected.h $(obj)/gki_module_exported.h
$(obj)/gki_module_protected.h: $(srctree)/android/abi_gki_modules_protected \
$(srctree)/scripts/gen_gki_modules_headers.sh
$(Q)$(CONFIG_SHELL) $(srctree)/scripts/gen_gki_modules_headers.sh $@ \
"$(srctree)"
$(obj)/gki_module_exported.h: $(srctree)/android/abi_gki_modules_exports \
$(srctree)/scripts/gen_gki_modules_headers.sh
$(Q)$(CONFIG_SHELL) $(srctree)/scripts/gen_gki_modules_headers.sh $@ \
"$(srctree)"

50
kernel/gki_module.c
View file

@ -1,50 +0,0 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright 2021 Google LLC
* Author: ramjiyani@google.com (Ramji Jiyani)
*/
#include <linux/bsearch.h>
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/printk.h>
#include <linux/string.h>
/*
* Build time generated header files
*
* gki_module_exported.h -- Symbols protected from _export_ by unsigned modules
* gki_module_protected.h -- Symbols protected from _access_ by unsigned modules
*/
#include "gki_module_protected.h"
#include "gki_module_exported.h"
#define MAX_STRCMP_LEN (max(MAX_PROTECTED_NAME_LEN, MAX_EXPORTED_NAME_LEN))
/* bsearch() comparision callback */
static int cmp_name(const void *sym, const void *protected_sym)
{
return strncmp(sym, protected_sym, MAX_STRCMP_LEN);
}
/**
* gki_is_module_protected_symbol - Is a symbol protected from unsigned module?
*
* @name: Symbol being checked against protection from unsigned module
*/
bool gki_is_module_protected_symbol(const char *name)
{
return bsearch(name, gki_protected_symbols, NO_OF_PROTECTED_SYMBOLS,
MAX_PROTECTED_NAME_LEN, cmp_name) != NULL;
}
/**
* gki_is_module_exported_symbol - Is a symbol exported from a GKI module?
*
* @name: Symbol being checked against exported symbols from GKI modules
*/
bool gki_is_module_exported_symbol(const char *name)
{
return bsearch(name, gki_exported_symbols, NO_OF_EXPORTED_SYMBOLS,
MAX_EXPORTED_NAME_LEN, cmp_name) != NULL;
}

14
kernel/module/internal.h
View file

@ -303,17 +303,3 @@ static inline int same_magic(const char *amagic, const char *bmagic, bool has_cr
return strcmp(amagic, bmagic) == 0;
}
#endif /* CONFIG_MODVERSIONS */
#ifdef CONFIG_MODULE_SIG_PROTECT
extern bool gki_is_module_exported_symbol(const char *name);
extern bool gki_is_module_protected_symbol(const char *name);
#else
static inline bool gki_is_module_exported_symbol(const char *name)
{
return 0;
}
static inline bool gki_is_module_protected_symbol(const char *name)
{
return 0;
}
#endif /* CONFIG_MODULE_SIG_PROTECT */

17
kernel/module/main.c
View file

@ -1247,14 +1247,6 @@ static int verify_exported_symbols(struct module *mod)
.name = kernel_symbol_name(s),
.gplok = true,
};
if (!mod->sig_ok && gki_is_module_exported_symbol(
kernel_symbol_name(s))) {
pr_err("%s: exporting protected symbol(%s)\n",
mod->name, kernel_symbol_name(s));
return -EACCES;
}
if (find_symbol(&fsa)) {
pr_err("%s: exports duplicate symbol %s"
" (owned by %s)\n",
@ -1322,13 +1314,6 @@ static int simplify_symbols(struct module *mod, const struct load_info *info)
break;
case SHN_UNDEF:
if (!mod->sig_ok &&
gki_is_module_protected_symbol(name)) {
pr_err("%s: is not an Android GKI signed module. It can not access protected symbol: %s\n",
mod->name, name);
return -EACCES;
}
ksym = resolve_symbol_wait(mod, info, name);
/* Ok if resolved. */
if (ksym && !IS_ERR(ksym)) {
@ -2764,8 +2749,6 @@ static int load_module(struct load_info *info, const char __user *uargs,
"kernel\n", mod->name);
add_taint_module(mod, TAINT_UNSIGNED_MODULE, LOCKDEP_STILL_OK);
}
#else
mod->sig_ok = 0;
#endif
/* To avoid stressing percpu allocator, do this once we're unique. */