From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.6 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D822DC433E1 for ; Tue, 30 Mar 2021 20:58:05 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 736C3619CA for ; Tue, 30 Mar 2021 20:58:05 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 736C3619CA Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id D93F06B0085; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id CF52C6B0088; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A351E6B008A; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0251.hostedemail.com [216.40.44.251]) by kanga.kvack.org (Postfix) with ESMTP id 66AEA6B0085 for ; Tue, 30 Mar 2021 16:57:58 -0400 (EDT) Received: from smtpin06.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 2EE788249980 for ; Tue, 30 Mar 2021 20:57:58 +0000 (UTC) X-FDA: 77977752636.06.F768BC5 Received: from mail-pj1-f50.google.com (mail-pj1-f50.google.com [209.85.216.50]) by imf07.hostedemail.com (Postfix) with ESMTP id 8DBA0A0003A2 for ; Tue, 30 Mar 2021 20:57:57 +0000 (UTC) Received: by mail-pj1-f50.google.com with SMTP id q6-20020a17090a4306b02900c42a012202so83027pjg.5 for ; Tue, 30 Mar 2021 13:57:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=dHwr6OVFfk7s7Yw8a90FyZmnLv02IEGSs6EhbG8UN8M=; b=hlWyqrrdivPvUsK2urCX5gbrxgHLV4EYIBS2FOfT0y3D/wpHPrKrvmLaAL5Yl6MNe7 s8xQY60zPWjczFajqojxMdNTb+YVRWOmxbrkyFleNzk2fZr+gpe5pyPWLdMQx1C0pFPg odydi07JBlH01reKlWGYNqcTIdZo3NMmPvWCE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=dHwr6OVFfk7s7Yw8a90FyZmnLv02IEGSs6EhbG8UN8M=; b=stSYEdS1898d2XZGnG+nbgF8uBrdXFundLs3XfNTuZ9A2GrmMLcUCY3OKMlCrgnrZq E4GrALu8ZW3QlAiVfJIHFmc9t7LkL/0SdwTZt2y7M+SD4SYXkJyo+xZxZ1DdjrsoQsuK 44w4cG90V9NL3Y3aIvL6wd+BMbqEvHjWgWIa0SxDVDCtuSO/Q1PkycyKNrYhUkHg4GZX XLp67DPXxIinbA+SsPfQjb10+6wcBHqyTLVqSrC6Hzq4e/JfezyhAd85QGyYsmdadYv1 2VLdpVUVfx/3Y72ONOT0FCDaDZH32TapdG10rd/sknSr2VyQA648Kw7SNJ8XUUPzJZqM zRPA== X-Gm-Message-State: AOAM5312J6D9lVfbGjV+B52KID6XSxFi3Z2uEyB2dZharRCZKD8ImVdN MfdbdZcDibsUSoMKyGY+8U0ACQ== X-Google-Smtp-Source: ABdhPJylAI9yxAoBrtRs4JyfT9rDF2n0nHOzw2dYUFJTY/UD7TWKY70QYv/FPZ+e1PRlkr1nagTnQQ== X-Received: by 2002:a17:90a:f184:: with SMTP id bv4mr181607pjb.43.1617137876881; Tue, 30 Mar 2021 13:57:56 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id mp19sm7171048pjb.2.2021.03.30.13.57.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 30 Mar 2021 13:57:55 -0700 (PDT) From: Kees Cook To: Thomas Gleixner Cc: Kees Cook , Elena Reshetova , x86@kernel.org, Andy Lutomirski , Peter Zijlstra , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Potapenko , Alexander Popov , Ard Biesheuvel , Jann Horn , Vlastimil Babka , David Hildenbrand , Mike Rapoport , Andrew Morton , Jonathan Corbet , Randy Dunlap , kernel-hardening@lists.openwall.com, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v8 5/6] arm64: entry: Enable random_kstack_offset support Date: Tue, 30 Mar 2021 13:57:49 -0700 Message-Id: <20210330205750.428816-6-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20210330205750.428816-1-keescook@chromium.org> References: <20210330205750.428816-1-keescook@chromium.org> MIME-Version: 1.0 X-Patch-Hashes: v=1; h=sha256; g=248270d6e87ad6ffcee20e448a3bbf6614f92c8d; i=6FjHrMJQ1a03WxuPiMt8aIK5MW/T0bayLG0SuUm7Wt4=; m=DW/OKOjAEidoxl6ODEV6zN0c7U/uCvK1t/uZsIkKPaM=; p=nb+ZCQAESoMtgqRKEEjn/wowCv7zZGeRTSUAEFbjSEQ= X-Patch-Sig: m=pgp; i=keescook@chromium.org; s=0x0x8972F4DFDC6DC026; b=iQIzBAABCgAdFiEEpcP2jyKd1g9yPm4TiXL039xtwCYFAmBjkM0ACgkQiXL039xtwCaO6Q//aar 6eVN//dg/fHBNLu2Gxap4jQwEL4B/h8LTF1EJJl+k981UHFhnFIYt8oW893e2NxbM0D1e845pN6po JTH0/kJzFiX5epyMsOKxIez20UlQsvmuATkeG7Ps6g+nXIpo54Sh/isnkNMV+NlQ6FZKtmP2/CCXm gXQgeCZJbD5ospCgiwZ5S16NR8Z5x1lzFOh11lCBjULCcG/OSLleoyWdadpnTa0bPjxQ9gIHBDxZE 5ufEVIEM9MmBAoE/UjxYyuIHROQGSdkwQMjfFM64hKOBM0E2+f8uxt0aNwxTWrdl/hwJCKzRP7f/0 LLqb3h825YDdfUxRySjRg66bDXL9j210YtIT1LoXaNcYEC9YR/+KE8ojXkZfi0K9/T4bETedLdhy2 EMNyu7LBrGoghShBmB7+hgMZisZBQvi99S6yGrQx+ZewJlYFlOCfLDUSJle4Cq1d2yZzj0NF9xUDI o/7+0luGZgIrHjoa7jpd9ckdrEFzCjOMrwZ9E2TsOkEVeL/MQlFa2Bndcgl2DkmCmk/dI9VcS+to1 O5NsZSB+oYVwZpg4MWLlEzE+g781nqeZbke/Is3MfFGqn3hHgC39raKe1uUPIyzh7ae5YMSB/v0So COf7PQUrybaOrXlDmivGjp0mfAhxQ2fngtrT32UEvGeLivm3olP9QbeCfmRKzbtY= X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 8DBA0A0003A2 X-Stat-Signature: z3bz6fju3hzwxgp4nfwyhitca15regd9 Received-SPF: none (chromium.org>: No applicable sender policy available) receiver=imf07; identity=mailfrom; envelope-from=""; helo=mail-pj1-f50.google.com; client-ip=209.85.216.50 X-HE-DKIM-Result: pass/pass X-HE-Tag: 1617137877-390849 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Allow for a randomized stack offset on a per-syscall basis, with roughly 5 bits of entropy. (And include AAPCS rationale AAPCS thanks to Mark Rutland.) In order to avoid unconditional stack canaries on syscall entry (due to the use of alloca()), also disable stack protector to avoid triggering needless checks and slowing down the entry path. As there is no general way to control stack protector coverage with a function attribute[1], this must be disabled at the compilation unit level. This isn't a problem here, though, since stack protector was not triggered before: examining the resulting syscall.o, there are no changes in canary coverage (none before, none now). [1] a working __attribute__((no_stack_protector)) has been added to GCC and Clang but has not been released in any version yet: https://gcc.gnu.org/git/gitweb.cgi?p=3Dgcc.git;h=3D346b302d09c1e6db56d9fe= 69048acb32fbb97845 https://reviews.llvm.org/rG4fbf84c1732fca596ad1d6e96015e19760eb8a9b Signed-off-by: Kees Cook --- arch/arm64/Kconfig | 1 + arch/arm64/kernel/Makefile | 5 +++++ arch/arm64/kernel/syscall.c | 16 ++++++++++++++++ 3 files changed, 22 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 1f212b47a48a..2d0e5f544429 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -146,6 +146,7 @@ config ARM64 select HAVE_ARCH_MMAP_RND_COMPAT_BITS if COMPAT select HAVE_ARCH_PFN_VALID select HAVE_ARCH_PREL32_RELOCATIONS + select HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET select HAVE_ARCH_SECCOMP_FILTER select HAVE_ARCH_STACKLEAK select HAVE_ARCH_THREAD_STRUCT_WHITELIST diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile index ed65576ce710..6cc97730790e 100644 --- a/arch/arm64/kernel/Makefile +++ b/arch/arm64/kernel/Makefile @@ -9,6 +9,11 @@ CFLAGS_REMOVE_ftrace.o =3D $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_insn.o =3D $(CC_FLAGS_FTRACE) CFLAGS_REMOVE_return_address.o =3D $(CC_FLAGS_FTRACE) =20 +# Remove stack protector to avoid triggering unneeded stack canary +# checks due to randomize_kstack_offset. +CFLAGS_REMOVE_syscall.o =3D -fstack-protector -fstack-protector-strong +CFLAGS_syscall.o +=3D -fno-stack-protector + # Object file lists. obj-y :=3D debug-monitors.o entry.o irq.o fpsimd.o \ entry-common.o entry-fpsimd.o process.o ptrace.o \ diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c index b9cf12b271d7..263d6c1a525f 100644 --- a/arch/arm64/kernel/syscall.c +++ b/arch/arm64/kernel/syscall.c @@ -5,6 +5,7 @@ #include #include #include +#include #include =20 #include @@ -43,6 +44,8 @@ static void invoke_syscall(struct pt_regs *regs, unsign= ed int scno, { long ret; =20 + add_random_kstack_offset(); + if (scno < sc_nr) { syscall_fn_t syscall_fn; syscall_fn =3D syscall_table[array_index_nospec(scno, sc_nr)]; @@ -55,6 +58,19 @@ static void invoke_syscall(struct pt_regs *regs, unsig= ned int scno, ret =3D lower_32_bits(ret); =20 regs->regs[0] =3D ret; + + /* + * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), + * but not enough for arm64 stack utilization comfort. To keep + * reasonable stack head room, reduce the maximum offset to 9 bits. + * + * The actual entropy will be further reduced by the compiler when + * applying stack alignment constraints: the AAPCS mandates a + * 16-byte (i.e. 4-bit) aligned SP at function boundaries. + * + * The resulting 5 bits of entropy is seen in SP[8:4]. + */ + choose_random_kstack_offset(get_random_int() & 0x1FF); } =20 static inline bool has_syscall_work(unsigned long flags) --=20 2.25.1