mbox series

[v3,0/4] arm64: Add return address protection to asm code

Message ID 20221209152048.3517080-1-ardb@kernel.org (mailing list archive)
Headers show
Series arm64: Add return address protection to asm code | expand

Message

Ard Biesheuvel Dec. 9, 2022, 3:20 p.m. UTC 
Control flow integrity features such as shadow call stack or PAC work by
placing special instructions between the reload of the link register
from the stack and the function return. The point of this is not only to
protect the control flow when calling that particular function, but also
to ensure that the sequence of instructions appearing at the end of the
function cannot be subverted and used in other ways than intended, in a
ROP/JOP style attack.

This means that it is generally a bad idea to incorporate any code that
is rarely or never used, but lacks such protections. So add some macros
that we can invoke in assembler code to protect the return address while
it is stored on the stack, and wire it up in the ftrace code, which is
often built into production kernels even when not used.

Another example of this is crypto code, and some fixes have been queued
up in the cryptodev tree to ensure that the frame_push and frame_pop
macros are used consistently. 

v3:
- rebase onto updated ftrace tree
- drop EFI changes for the time being, I'll bring those back later
- emit unwind directives for return address registers != x30, and handle
  them in the dynamic SCS patching code

Cc: Marc Zyngier <maz@kernel.org>
Cc: Will Deacon <will@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Mark Brown <broonie@kernel.org>

Ard Biesheuvel (4):
  arm64: assembler: Force error on misuse of .Lframe_local_offset
  arm64: assembler: Protect return addresses in asm routines
  arm64: ftrace: Preserve original link register value in ftrace_regs
  arm64: ftrace: Add return address protection

 arch/arm64/include/asm/assembler.h | 76 ++++++++++++++++++++
 arch/arm64/include/asm/ftrace.h    |  2 +-
 arch/arm64/kernel/entry-ftrace.S   | 27 +++++--
 arch/arm64/kernel/patch-scs.c      | 70 +++++++++++++-----
 arch/arm64/kernel/stacktrace.c     |  1 +
 5 files changed, 151 insertions(+), 25 deletions(-)