Currently, the "module_blacklist=" command-line parameter only applies to
loadable modules. If a module is built-in, the parameter is silently
ignored. This patch extends the blacklisting functionality to built-in
modules by intercepting their initialization routines during early boot.
To achieve this, we introduce a new ".initcall.modnames" memory section.
For each built-in module, we use a standard C structure (i.e., struct
initcall_modname) to map its initcall function pointer to its associated
KBUILD_MODNAME string.
During boot, do_one_initcall() cross-references the initcall function
pointer against this table. If a match is found and the module is
present in the blacklist, the initcall is skipped.
Design Considerations and Trade-offs:
1. LTO and CFI Compatibility vs. PREL32
Previous iterations of this patch attempted to use top-level
inline assembly to generate 32-bit relative offsets (PREL32) to
save memory. However, raw inline assembly operates blindly
outside of the C compiler's visibility. When compiled with
CONFIG_LTO_CLANG or CONFIG_CFI_CLANG, the compiler applies
symbol renaming and generates Control Flow Integrity stubs.
The raw assembly string-matching fails to track these changes,
resulting in undefined references or runtime address mismatches.
To resolve this, we strictly use standard C structures to hold
the function pointers. This natively allows the compiler to
resolve LTO renaming and map CFI stubs correctly. We trade the
minor spatial optimization of PREL32 (using absolute 64-bit
pointers instead) to guarantee architectural safety under modern
compiler protections. Because this metadata is placed in an
".init" section and freed entirely after boot, the temporary
memory overhead is negligible.
2. Prevention of UAF (Use-After-Free):
Because do_one_initcall() is a shared path invoked by both the
early boot process and runtime module loading (i.e.,
do_init_module()), we must prevent loadable modules from
attempting to scan the ".initcall.modnames" section after it has
been reclaimed by free_initmem(). We introduce a strictly
serialised 'initmem_freed' flag, locked by '__ro_after_init', to
safely bypass the built-in lookup for loadable modules. Loadable
modules are instead checked against the blacklist directly
inside do_init_module() before their initcalls are invoked.
Signed-off-by: Aaron Tomlin <[email protected]>
---
Changes since v2:
- Avoided relative 32-bit offsets (PREL32) with inline assembly, opting
instead for standard C structures with absolute pointers. This fixes LTO
and CFI compatibility issues (e.g., under Clang) where raw inline assembly
fails to track compiler-generated symbols and CFI stubs
- Placed module name strings into the ".init.rodata" section via a dedicated
static array to ensure they are freed from memory after boot
- Avoided Use-After-Free (UAF) bugs post-boot when loading dynamic modules:
- Added an 'initmem_freed' flag, marked as '__ro_after_init', set after
free_initmem() to skip table lookups for dynamically loaded modules
- Added a blacklist check in do_init_module() for dynamic modules
- Simplified the linker script using the BOUNDED_SECTION_PRE_LABEL() macro
to define the ".initcall.modnames" section boundary
- Added a dummy/stub implementation of module_is_blacklisted() when
CONFIG_MODULES is disabled to avoid build errors
- Linked to v2:
https://lore.kernel.org/lkml/[email protected]/
Changes since v1:
- Pivoted entirely from exposing built-in initcalls and their blacklist
status via a debugfs interface to directly extending the existing
"module_blacklist=" to intercept built-in modules at boot (Petr Pavlu)
- Implemented 32-bit relative offsets (CONFIG_HAVE_ARCH_PREL32_RELOCATIONS)
to store the mappings, preventing binary bloat and preserving KASLR
efficacy
- Linked to v1:
https://lore.kernel.org/lkml/[email protected]/
---
include/asm-generic/vmlinux.lds.h | 4 +++-
include/linux/init.h | 14 +++++++++++++-
include/linux/module.h | 9 +++++++++
init/main.c | 28 ++++++++++++++++++++++++++++
kernel/module/main.c | 8 ++++++--
5 files changed, 59 insertions(+), 4 deletions(-)
diff --git a/include/asm-generic/vmlinux.lds.h
b/include/asm-generic/vmlinux.lds.h
index 5659f4b5a125..fc863595743e 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -734,7 +734,9 @@
EARLYCON_TABLE() \
LSM_TABLE() \
EARLY_LSM_TABLE() \
- KUNIT_INIT_TABLE()
+ KUNIT_INIT_TABLE() \
+ . = ALIGN(8); \
+ BOUNDED_SECTION_PRE_LABEL(.initcall.modnames, initcall_modnames,
__start_, __stop_)
#define INIT_TEXT \
*(.init.text .init.text.*) \
diff --git a/include/linux/init.h b/include/linux/init.h
index 40331923b9f4..c0db1a6a0191 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -271,8 +271,20 @@ extern struct module __this_module;
__initcall_name(initcall, __iid, id), \
__initcall_section(__sec, __iid))
+struct initcall_modname {
+ initcall_t initcall_fn;
+ const char *modname;
+};
+
#define ___define_initcall(fn, id, __sec) \
- __unique_initcall(fn, id, __sec, __initcall_id(fn))
+ __unique_initcall(fn, id, __sec, __initcall_id(fn)) \
+ static const char __initstr_##fn[] __used __aligned(1) \
+ __section(".init.rodata") = KBUILD_MODNAME; \
+ static const struct initcall_modname __modname_##fn __used \
+ __section(".initcall.modnames") = { \
+ .initcall_fn = fn, \
+ .modname = __initstr_##fn \
+ };
#define __define_initcall(fn, id) ___define_initcall(fn, id, .initcall##id)
diff --git a/include/linux/module.h b/include/linux/module.h
index 7566815fabbe..b9b0dc419aee 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -756,6 +756,15 @@ void *dereference_module_function_descriptor(struct module
*mod, void *ptr);
int register_module_notifier(struct notifier_block *nb);
int unregister_module_notifier(struct notifier_block *nb);
+#ifdef CONFIG_MODULES
+extern bool module_is_blacklisted(const char *module_name);
+#else
+static inline bool module_is_blacklisted(const char *module_name)
+{
+ return false;
+}
+#endif
+
extern void print_modules(void);
static inline bool module_requested_async_probing(struct module *module)
diff --git a/init/main.c b/init/main.c
index e363232b428b..918e6e9442a8 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1334,12 +1334,39 @@ static inline void do_trace_initcall_level(const char
*level)
}
#endif /* !TRACEPOINTS_ENABLED */
+extern struct initcall_modname __start_initcall_modnames[];
+extern struct initcall_modname __stop_initcall_modnames[];
+
+static bool initmem_freed __ro_after_init = false;
+
+static const char *initcall_get_modname(initcall_t fn)
+{
+ struct initcall_modname *p;
+
+ if (initmem_freed)
+ return NULL;
+
+ for (p = __start_initcall_modnames; p < __stop_initcall_modnames; p++) {
+ if (p->initcall_fn == fn)
+ return p->modname;
+ }
+ return NULL;
+}
+
int __init_or_module do_one_initcall(initcall_t fn)
{
int count = preempt_count();
char msgbuf[64];
+ const char *modname;
int ret;
+ modname = initcall_get_modname(fn);
+ if (modname && module_is_blacklisted(modname)) {
+ pr_info("Skipping initcall for blacklisted built-in module
%s\n",
+ modname);
+ return 0;
+ }
+
if (initcall_blacklisted(fn))
return -EPERM;
@@ -1555,6 +1582,7 @@ static int __ref kernel_init(void *unused)
kgdb_free_init_mem();
exit_boot_config();
free_initmem();
+ initmem_freed = true;
mark_readonly();
/*
diff --git a/kernel/module/main.c b/kernel/module/main.c
index 46dd8d25a605..2a467a8ee551 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -2921,7 +2921,7 @@ int __weak module_frob_arch_sections(Elf_Ehdr *hdr,
/* module_blacklist is a comma-separated list of module names */
static char *module_blacklist;
-static bool blacklisted(const char *module_name)
+bool module_is_blacklisted(const char *module_name)
{
const char *p;
size_t len;
@@ -3090,6 +3090,10 @@ static noinline int do_init_module(struct module *mod)
}
}
#endif
+ if (module_is_blacklisted(mod->name)) {
+ pr_info("Module %s is blacklisted\n", mod->name);
+ return -EPERM;
+ }
freeinit = kmalloc_obj(*freeinit);
if (!freeinit) {
@@ -3391,7 +3395,7 @@ static int early_mod_check(struct load_info *info, int
flags)
* Now that we know we have the correct module name, check
* if it's blacklisted.
*/
- if (blacklisted(info->name)) {
+ if (module_is_blacklisted(info->name)) {
pr_err("Module %s is blacklisted\n", info->name);
return -EPERM;
}
--
2.54.0
