On Thu, 2018-12-06 at 10:52 -0800, Andy Lutomirski wrote:

On Wed, Dec 5, 2018 at 12:52 AM Nadav Amit [off-list ref] wrote:

quoted

When module memory is about to be freed, there is no apparent reason to
make it (and its data) executable, but that's exactly what is done
today. This is not efficient and not secure.

There are various theories why it was done, but none of them seem as
something that really require it today. nios2 uses kmalloc for module
memory, but anyhow it does not change the PTEs of the module memory.  In
x86, changing vmalloc'd memory mappings also modifies the direct mapping
alias, but the NX-bit is not modified in such way.

So let's remove it. Andy suggested that the changes of the PTEs can be
avoided (excluding the direct-mapping alias), which is true. However,
in x86 it requires some cleanup of the contiguous page allocator, which
is outside of the scope of this patch-set.

I'm okay with this, but I'd like to see Rick's stuff get rebased on
top of it and clean it up for real.

Nadav,

Hmm, since you are trying to move things forward and not close all cases in one
swoop, would it make sense to split the modules W^X mission from this patchset?

Thanks,

Rick