grsecurity forums

I'm trying to compile the new intel e1000e driver for my current Grsec kernel, but it fails with the error:
assignment of member ‘blink_led’ in read-only object

The offending piece of code:

Code: Select all

static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter)
{
  struct e1000_hw *hw = &adapter->hw;

  /*
   * Disable Jumbo Frame support on parts with Intel 10/100 PHY or
   * on parts with MACsec enabled in NVM (reflected in CTRL_EXT).
   */
  if ((adapter->hw.phy.type == e1000_phy_ife) ||
      ((adapter->hw.mac.type >= e1000_pch2lan) &&
       (!(er32(CTRL_EXT) & E1000_CTRL_EXT_LSECCK)))) {
    adapter->flags &= ~FLAG_HAS_JUMBO_FRAMES;
    adapter->max_hw_frame_size = ETH_FRAME_LEN + ETH_FCS_LEN;

    hw->mac.ops.blink_led = NULL;
  }

  if ((adapter->hw.mac.type == e1000_ich8lan) &&
      (adapter->hw.phy.type != e1000_phy_ife))
    adapter->flags |= FLAG_LSC_GIG_SPEED_DROP;

  /* Enable workaround for 82579 w/ ME enabled */
  if ((adapter->hw.mac.type == e1000_pch2lan) &&
      (er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
    adapter->flags2 |= FLAG2_PCIM2PCI_ARBITER_WA;

  return 0;
}


How would I resolve this issue? I've checked, and the CONFIG_PAX_KERNEXEC flag is disabled, as that was the issue with the Virtualbox module compilation. Any help would really be appreciated.

Ichabond wrote:How would I resolve this issue? I've checked, and the CONFIG_PAX_KERNEXEC flag is disabled

which kernel/grsec/gcc versions have you got exactly? my first guess is that you're using a plugin capable gcc and have enabled the constification plugin that automatically makes ops structures read-only. the way out of that is either disabling that config option or marking the affected structure declaration with a __no_const attribute or creating a no_const typedef and making use of it in the right places (you'll find examples of all this in the in-tree e1000e driver).

Kernel 3.2.12
The grsec patch version is grsecurity-2.9-3.2.13-201204010911.patch

I can't find the CONFIG_PAX_CONSTIFY_PLUGIN variable in the current kernel config, so while it looks like you are right, I don't see how I can disable it with new kernel builds.

If I compile the driver with said attributes, won't it give errors @ runtime?

Ichabond wrote:I can't find the CONFIG_PAX_CONSTIFY_PLUGIN variable in the current kernel config, so while it looks like you are right, I don't see how I can disable it with new kernel builds.

in grsec you have to pass -DDISABLE_PAX_CONSTIFY_PLUGIN to 'make' in order to disable this plugin. but the correct solution would be to patch the driver .

If I compile the driver with said attributes, won't it give errors @ runtime?

if it compiles then it'll work. the only special case is when you want to modify an actually read-only static variable as that'd be mapped into read-only memory under KERNEXEC and the write accessors would need the open/close kernel dance (your case is simpler in that these ops structures are allocated on the heap and hence are always writable, for the better or worse).

Hi Ichabond,

I don't want you to have to disable the constify plugin just for this, so I've created a patch here:
http://grsecurity.net/~spender/e1000e-1 ... t-fix.diff

It also fixes a problem with their Makefile which caused a build failure on my Debian system with a 64bit kernel.

-Brad