From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2BEECC433EF for ; Fri, 15 Oct 2021 21:35:48 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A9ADC60FE3 for ; Fri, 15 Oct 2021 21:35:47 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org A9ADC60FE3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id 46B396B0075; Fri, 15 Oct 2021 17:35:47 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 41A59900002; Fri, 15 Oct 2021 17:35:47 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2E2CF6B007B; Fri, 15 Oct 2021 17:35:47 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0034.hostedemail.com [216.40.44.34]) by kanga.kvack.org (Postfix) with ESMTP id 1EF966B0075 for ; Fri, 15 Oct 2021 17:35:47 -0400 (EDT) Received: from smtpin40.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id D19611814ECA0 for ; Fri, 15 Oct 2021 21:35:46 +0000 (UTC) X-FDA: 78699979092.40.4C24A9F Received: from mail-pj1-f43.google.com (mail-pj1-f43.google.com [209.85.216.43]) by imf11.hostedemail.com (Postfix) with ESMTP id 87086F0000AE for ; Fri, 15 Oct 2021 21:35:46 +0000 (UTC) Received: by mail-pj1-f43.google.com with SMTP id pf6-20020a17090b1d8600b0019fa884ab85so10234137pjb.5 for ; Fri, 15 Oct 2021 14:35:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=fXK9I7sL2UAvUUHr680VS0N7hcJaT8a/qC/oAjWAekg=; b=i/plbNWQsfMbAtipP0bedfIRhU9GtT0vQBPBSqxQOXPLHpycgRU2/2eFgrucmm2h2H jyUzWsmXl3g4lj7XR6uQJW5kj6zHZDhfr5oLknCnvhs4hYYOrFP7YzLzzikPK/mnLAUp qzqAv/u7xWCe7UATWzGpSateqcXcucSLev7S0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=fXK9I7sL2UAvUUHr680VS0N7hcJaT8a/qC/oAjWAekg=; b=3fScXi/OG/ymgHb8TM8pfFhFhw6j7MeYRxHAIp5l1YSEMov5/Yoc1PkufhJYOamxio xXHvKRKwlng/OFtCgcZN8snfKrJc2omvGvSWQNs+BNfFHHjE4J08GCPvkxxxp33o2y1l TUnZamUID2xxNnphtx2FwKFOHV2Q32ZotZCHS1ds/ki9UX6e3aYeDGjQstu66VS1adhF bTge/UW/Jcp+3iFC0T0jdwgDjcVy4evJFWqiXC2HaOeyqou11GROn2dGqbJnzwYrSr1O r3qZYyKw9RhzCMQTfb2DSl4aU+gHVsY2+KNa3JTlppPS5VGwJWnEsR5nwvQ/eoBQ2SDV hcJA== X-Gm-Message-State: AOAM533v9gRJ0yYtN30xFYfOVqLNvk3WX5DFzLzk5BjSSn3CUW25+l7K 9L9YKsRJRxhWaEjosYeXgLbqPQ== X-Google-Smtp-Source: ABdhPJzGiIkXXBmy5DDoWMNsGgWcXqtw/xBNMBOjRI4bsAE2X+6lsLV+71+RhBCvt+ERtsGfcdpHpA== X-Received: by 2002:a17:90b:1a86:: with SMTP id ng6mr16246857pjb.120.1634333745601; Fri, 15 Oct 2021 14:35:45 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id q10sm5538176pgn.31.2021.10.15.14.35.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 15 Oct 2021 14:35:45 -0700 (PDT) Date: Fri, 15 Oct 2021 14:35:44 -0700 From: Kees Cook To: Christophe Leroy Cc: Benjamin Herrenschmidt , Paul Mackerras , Michael Ellerman , Andrew Morton , "James E.J. Bottomley" , Helge Deller , Arnd Bergmann , Greg Kroah-Hartman , linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-ia64@vger.kernel.org, linux-parisc@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH v2 13/13] lkdtm: Add a test for function descriptors protection Message-ID: <202110151433.6270D717@keescook> References: <08a3dfbc55e1c7a0a1917b22f0ca6cabd9895ab2.1634190022.git.christophe.leroy@csgroup.eu> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <08a3dfbc55e1c7a0a1917b22f0ca6cabd9895ab2.1634190022.git.christophe.leroy@csgroup.eu> X-Rspamd-Queue-Id: 87086F0000AE X-Stat-Signature: e4x1uusne61wf313ba5j9rjz18ymzd3o Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=chromium.org header.s=google header.b="i/plbNWQ"; dmarc=pass (policy=none) header.from=chromium.org; spf=pass (imf11.hostedemail.com: domain of keescook@chromium.org designates 209.85.216.43 as permitted sender) smtp.mailfrom=keescook@chromium.org X-Rspamd-Server: rspam02 X-HE-Tag: 1634333746-295242 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Oct 14, 2021 at 07:50:02AM +0200, Christophe Leroy wrote: > Add WRITE_OPD to check that you can't modify function > descriptors. > > Gives the following result when function descriptors are > not protected: > > lkdtm: Performing direct entry WRITE_OPD > lkdtm: attempting bad 16 bytes write at c00000000269b358 > lkdtm: FAIL: survived bad write > lkdtm: do_nothing was hijacked! > > Looks like a standard compiler barrier(); is not enough to force > GCC to use the modified function descriptor. Add to add a fake empty > inline assembly to force GCC to reload the function descriptor. > > Signed-off-by: Christophe Leroy > --- > drivers/misc/lkdtm/core.c | 1 + > drivers/misc/lkdtm/lkdtm.h | 1 + > drivers/misc/lkdtm/perms.c | 22 ++++++++++++++++++++++ > 3 files changed, 24 insertions(+) > > diff --git a/drivers/misc/lkdtm/core.c b/drivers/misc/lkdtm/core.c > index fe6fd34b8caf..de092aa03b5d 100644 > --- a/drivers/misc/lkdtm/core.c > +++ b/drivers/misc/lkdtm/core.c > @@ -148,6 +148,7 @@ static const struct crashtype crashtypes[] = { > CRASHTYPE(WRITE_RO), > CRASHTYPE(WRITE_RO_AFTER_INIT), > CRASHTYPE(WRITE_KERN), > + CRASHTYPE(WRITE_OPD), > CRASHTYPE(REFCOUNT_INC_OVERFLOW), > CRASHTYPE(REFCOUNT_ADD_OVERFLOW), > CRASHTYPE(REFCOUNT_INC_NOT_ZERO_OVERFLOW), > diff --git a/drivers/misc/lkdtm/lkdtm.h b/drivers/misc/lkdtm/lkdtm.h > index c212a253edde..188bd0fd6575 100644 > --- a/drivers/misc/lkdtm/lkdtm.h > +++ b/drivers/misc/lkdtm/lkdtm.h > @@ -105,6 +105,7 @@ void __init lkdtm_perms_init(void); > void lkdtm_WRITE_RO(void); > void lkdtm_WRITE_RO_AFTER_INIT(void); > void lkdtm_WRITE_KERN(void); > +void lkdtm_WRITE_OPD(void); > void lkdtm_EXEC_DATA(void); > void lkdtm_EXEC_STACK(void); > void lkdtm_EXEC_KMALLOC(void); > diff --git a/drivers/misc/lkdtm/perms.c b/drivers/misc/lkdtm/perms.c > index 96b3ebfcb8ed..3870bc82d40d 100644 > --- a/drivers/misc/lkdtm/perms.c > +++ b/drivers/misc/lkdtm/perms.c > @@ -44,6 +44,11 @@ static noinline void do_overwritten(void) > return; > } > > +static noinline void do_almost_nothing(void) > +{ > + pr_info("do_nothing was hijacked!\n"); > +} > + > static void *setup_function_descriptor(func_desc_t *fdesc, void *dst) > { > memcpy(fdesc, do_nothing, sizeof(*fdesc)); > @@ -143,6 +148,23 @@ void lkdtm_WRITE_KERN(void) > do_overwritten(); > } > > +void lkdtm_WRITE_OPD(void) > +{ > + size_t size = sizeof(func_desc_t); > + void (*func)(void) = do_nothing; > + > + if (!have_function_descriptors()) { > + pr_info("Platform doesn't have function descriptors.\n"); This should be more explicit ('xfail'): pr_info("XFAIL: platform doesn't use function descriptors.\n"); > + return; > + } > + pr_info("attempting bad %zu bytes write at %px\n", size, do_nothing); > + memcpy(do_nothing, do_almost_nothing, size); > + pr_err("FAIL: survived bad write\n"); > + > + asm("" : "=m"(func)); Since this is a descriptor, I assume no icache flush is needed. Are function descriptors strictly dcache? (Is anything besides just a barrier needed?) > + func(); > +} > + > void lkdtm_EXEC_DATA(void) > { > execute_location(data_area, CODE_WRITE); > -- > 2.31.1 > -- Kees Cook