From patchwork Fri Mar 19 21:28:29 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 12151943 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.0 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4177C433C1 for ; Fri, 19 Mar 2021 21:31:32 +0000 (UTC) Received: from desiato.infradead.org (desiato.infradead.org [90.155.92.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 538056193A for ; Fri, 19 Mar 2021 21:31:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 538056193A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding :Content-Type:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:Message-Id:Date:Subject:Cc:To:From: Reply-To:Content-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender :Resent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner; bh=Mmwovvs66WBZXabI0ugfQ87c3fXVHig6hBneTXtBjaw=; b=AXN5dJHygCL9xRxzOpt0BiT6oh Gs7gNApoUyKuZp494rXHUHMSBY3ni5LpUvyIJW38w/jJrjegx3Gdsuk3Xb5DeZFVBly1vWhOoRk5H FC636gpGd80OYOof5RwRcfd2b3tbFAmrtJRAgkfLVe+tZ3Z0bhrwl4S+hAlobFxl1pl8gk/fqe4LV rSFCi9Oabz65+TUKYsIVZkvsB8OzfK5rpMNJq1zBLxTM6xCw0Gr3Qav0qxORzUgwbq7nfejpOMHNA 4UifzOWw90j0c+nGpqwrygwrqywcNWlsjTKQM3d5o01Owvxt/+1Mpn50yLYSmjcagn+fF/tR+mgnS ZvXhyS6Q==; Received: from localhost ([::1] helo=desiato.infradead.org) by desiato.infradead.org with esmtp (Exim 4.94 #2 (Red Hat Linux)) id 1lNMgc-008B5c-41; Fri, 19 Mar 2021 21:29:38 +0000 Received: from mail-pf1-x429.google.com ([2607:f8b0:4864:20::429]) by desiato.infradead.org with esmtps (Exim 4.94 #2 (Red Hat Linux)) id 1lNMfr-008AxC-Sa for linux-arm-kernel@lists.infradead.org; Fri, 19 Mar 2021 21:28:56 +0000 Received: by mail-pf1-x429.google.com with SMTP id j25so6774465pfe.2 for ; Fri, 19 Mar 2021 14:28:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=COYequ/Al4vh0bS6DyJKs6KMlXrnC5mSUzfXzkBff1k=; b=I8TknAyVLcDhMIatOxfg+fdU62BWJHBXwg3Rx8TWavaNLBa3eNY1/bJ+QswJecZL+u dxQZJxpcqrjERo37QE97Ja+SJjY29erRLfmXZqZDZ0A18U3QnAljIYefhpB0s3kMil0o OHt2KyuJ0VnoNR446RaOmtyETkgphZPoeTESE= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=COYequ/Al4vh0bS6DyJKs6KMlXrnC5mSUzfXzkBff1k=; b=dXpSXFBflyWkhnSLgKjlIgPO9ztFv0MI/urHSs6TDpgnWIGK2RifAyTJYJ5UlvtTO1 /TQSsssegkuuqr2g9j9SbCLOjORfecRCx5pzx38txVN3TRb4WrAlW1XaEF7gHMU7Od6U sphyiVrRVCyAeQe/V55gZ6mBHLzlZugylHWai/qDKrqz7T9OGciL9hYfMiCDBqmPvgA7 ZxZuKiwa6pIiYwkfufJjqeAJyIEWFfbsYJ07JgeGEvW1B2GnuuS9W6LukAkzIdaSyKBC 7yYNwI99KhbKXjXM7bp9LtLQN6jdfQ1cvP33IX83avQ2dtVgcCXWFfUyN8kSUnllLT2f 9t3g== X-Gm-Message-State: AOAM5314nSzhpDDYMaM5CYpvNn/0+NB4seh2WmQiugLSgCYq4bqgNRIS +hzeMhaHg1/UGjvUdAFrdM7WvQ== X-Google-Smtp-Source: ABdhPJyZr4/GDEamWBieVEFuuZx6Q7tu0xmdbWTaLaDKNdCcZA75rRto0XPpcUkqhpQvA6Nqpe018g== X-Received: by 2002:aa7:9081:0:b029:1f9:26c9:1609 with SMTP id i1-20020aa790810000b02901f926c91609mr10885048pfa.54.1616189319323; Fri, 19 Mar 2021 14:28:39 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id t19sm6136631pgj.8.2021.03.19.14.28.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 19 Mar 2021 14:28:38 -0700 (PDT) From: Kees Cook To: Thomas Gleixner Cc: Kees Cook , Elena Reshetova , x86@kernel.org, Andy Lutomirski , Peter Zijlstra , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Potapenko , Alexander Popov , Ard Biesheuvel , Jann Horn , Vlastimil Babka , David Hildenbrand , Mike Rapoport , Andrew Morton , Jonathan Corbet , Randy Dunlap , kernel-hardening@lists.openwall.com, linux-hardening@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v7 0/6] Optionally randomize kernel stack offset each syscall Date: Fri, 19 Mar 2021 14:28:29 -0700 Message-Id: <20210319212835.3928492-1-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20210319_212852_641296_B9718F5D X-CRM114-Status: GOOD ( 17.98 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org v7: - fix copy/paste-o from v6 CONFIG additions. v6: https://lore.kernel.org/lkml/20210315180229.1224655-1-keescook@chromium.org/ v5: https://lore.kernel.org/lkml/20210309214301.678739-1-keescook@chromium.org/ v4: https://lore.kernel.org/lkml/20200622193146.2985288-1-keescook@chromium.org/ v3: https://lore.kernel.org/lkml/20200406231606.37619-1-keescook@chromium.org/ v2: https://lore.kernel.org/lkml/20200324203231.64324-1-keescook@chromium.org/ rfc: https://lore.kernel.org/kernel-hardening/20190329081358.30497-1-elena.reshetova@intel.com/ Hi, This is a continuation and refactoring of Elena's earlier effort to add kernel stack base offset randomization. In the time since the earlier discussions, two attacks[1][2] were made public that depended on stack determinism, so we're no longer in the position of "this is a good idea but we have no examples of attacks". :) Earlier discussions also devolved into debates on entropy sources, which is mostly a red herring, given the already low entropy available due to stack size. Regardless, entropy can be changed/improved separately from this series as needed. Earlier discussions also got stuck debating how much syscall overhead was too much, but this is also a red herring since the feature itself needs to be selectable at boot with no cost for those that don't want it: this is solved here with static branches. So, here is the latest improved version, made as arch-agnostic as possible, with usage added for x86 and arm64. It also includes some small static branch clean ups, and addresses some surprise performance issues due to the stack canary[3]. At the very least, the first two patches can land separately (already Acked and Reviewed), since they're kind of "separate", but introduce macros that are used in the core stack changes. If I can get an Ack from an arm64 maintainer, I think this could all land via -tip to make merging easiest. Thanks! -Kees [1] https://a13xp0p0v.github.io/2020/02/15/CVE-2019-18683.html [2] https://repositorio-aberto.up.pt/bitstream/10216/125357/2/374717.pdf [3] https://lore.kernel.org/lkml/202003281520.A9BFF461@keescook/ Kees Cook (6): jump_label: Provide CONFIG-driven build state defaults init_on_alloc: Optimize static branches stack: Optionally randomize kernel stack offset each syscall x86/entry: Enable random_kstack_offset support arm64: entry: Enable random_kstack_offset support lkdtm: Add REPORT_STACK for checking stack offsets .../admin-guide/kernel-parameters.txt | 11 +++++ Makefile | 4 ++ arch/Kconfig | 23 ++++++++++ arch/arm64/Kconfig | 1 + arch/arm64/kernel/Makefile | 5 +++ arch/arm64/kernel/syscall.c | 10 +++++ arch/x86/Kconfig | 1 + arch/x86/entry/common.c | 3 ++ arch/x86/include/asm/entry-common.h | 8 ++++ drivers/misc/lkdtm/bugs.c | 17 ++++++++ drivers/misc/lkdtm/core.c | 1 + drivers/misc/lkdtm/lkdtm.h | 1 + include/linux/jump_label.h | 19 +++++++++ include/linux/mm.h | 10 +++-- include/linux/randomize_kstack.h | 42 +++++++++++++++++++ init/main.c | 23 ++++++++++ mm/page_alloc.c | 4 +- mm/slab.h | 6 ++- 18 files changed, 181 insertions(+), 8 deletions(-) create mode 100644 include/linux/randomize_kstack.h