@@ -150,6 +150,7 @@ config X86
select HAVE_ARCH_TRANSPARENT_HUGEPAGE
select HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD if X86_64
select HAVE_ARCH_VMAP_STACK if X86_64
+ select HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET
select HAVE_ARCH_WITHIN_STACK_FRAMES
select HAVE_ASM_MODVERSIONS
select HAVE_CMPXCHG_DOUBLE
@@ -7,6 +7,15 @@ OBJECT_FILES_NON_STANDARD_entry_64_compat.o := y
CFLAGS_syscall_64.o += $(call cc-option,-Wno-override-init,)
CFLAGS_syscall_32.o += $(call cc-option,-Wno-override-init,)
+
+# Downgrade to -fstack-protector to avoid triggering unneeded stack canary
+# checks due to randomize_kstack_offset. This also removes canaries in
+# other places as well, due to a handful of declarations of __u64 args[6]
+# (seccomp) and unsigned long args[6] (tracepoints), but their accesses
+# are indexed (instead of via dynamically sized linear reads/writes) so
+# the risk of removing useful mitigation coverage here is very low.
+CFLAGS_common.o += $(subst -fstack-protector-strong,-fstack-protector,$(filter -fstack-protector-strong,$(KBUILD_CFLAGS)))
+
obj-y := entry_$(BITS).o thunk_$(BITS).o syscall_$(BITS).o
obj-y += common.o
@@ -26,6 +26,7 @@
#include <linux/livepatch.h>
#include <linux/syscalls.h>
#include <linux/uaccess.h>
+#include <linux/randomize_kstack.h>
#include <asm/desc.h>
#include <asm/traps.h>
@@ -189,6 +190,13 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs)
lockdep_assert_irqs_disabled();
lockdep_sys_exit();
+ /*
+ * x86_64 stack alignment means 3 bits are ignored, so keep
+ * the top 5 bits. x86_32 needs only 2 bits of alignment, so
+ * the top 6 bits will be used.
+ */
+ choose_random_kstack_offset(rdtsc() & 0xFF);
+
cached_flags = READ_ONCE(ti->flags);
if (unlikely(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS))
@@ -283,6 +291,7 @@ __visible void do_syscall_64(unsigned long nr, struct pt_regs *regs)
{
struct thread_info *ti;
+ add_random_kstack_offset();
enter_from_user_mode();
local_irq_enable();
ti = current_thread_info();
@@ -355,6 +364,7 @@ static __always_inline void do_syscall_32_irqs_on(struct pt_regs *regs)
/* Handles int $0x80 */
__visible void do_int80_syscall_32(struct pt_regs *regs)
{
+ add_random_kstack_offset();
enter_from_user_mode();
local_irq_enable();
do_syscall_32_irqs_on(regs);
@@ -378,8 +388,8 @@ __visible long do_fast_syscall_32(struct pt_regs *regs)
*/
regs->ip = landing_pad;
+ add_random_kstack_offset();
enter_from_user_mode();
-
local_irq_enable();
/* Fetch EBP from where the vDSO stashed it. */
Allow for a randomized stack offset on a per-syscall basis, with roughly 5 bits of entropy. In order to avoid unconditional stack canaries on syscall entry, also downgrade from -fstack-protector-strong to -fstack-protector to avoid triggering checks due to alloca(). Examining the resulting canary coverage changes to common.o, this also removes canaries in other functions, due to a handful of declarations of "__u64 args[6]" (from seccomp) and "unsigned long args[6]" (from tracepoints), but their accesses are indexed (instead of via dynamically sized linear reads/writes) so the risk of removing useful mitigation coverage here is very low. Signed-off-by: Kees Cook <keescook@chromium.org> --- arch/x86/Kconfig | 1 + arch/x86/entry/Makefile | 9 +++++++++ arch/x86/entry/common.c | 12 +++++++++++- 3 files changed, 21 insertions(+), 1 deletion(-)