mbox series

[v2,0/2] arm64: harden shadow call stack pointer handling

Message ID 20230109174800.3286265-1-ardb@kernel.org (mailing list archive)
Headers show
Series arm64: harden shadow call stack pointer handling | expand

Message

Ard Biesheuvel Jan. 9, 2023, 5:47 p.m. UTC 
A couple of tweaks to the arm64 entry code to avoid loading the shadow
call stack pointer in a way that could potentially be unsafe in the
context of ROP attacks.

Changes since v1:
- rebase onto v6.2-rc1

Cc: Sami Tolvanen <samitolvanen@google.com>
Cc: Kees Cook <keescook@chromium.org>

Ard Biesheuvel (2):
  arm64: Always load shadow stack pointer directly from the task struct
  arm64: Stash shadow stack pointer in the task struct on interrupt

 arch/arm64/include/asm/scs.h |  7 ++++---
 arch/arm64/kernel/entry.S    | 16 +++++++---------
 arch/arm64/kernel/head.S     |  2 +-
 3 files changed, 12 insertions(+), 13 deletions(-)

Comments

Catalin Marinas Jan. 20, 2023, 4:59 p.m. UTC | #1 
On Mon, 09 Jan 2023 18:47:58 +0100, Ard Biesheuvel wrote:
> A couple of tweaks to the arm64 entry code to avoid loading the shadow
> call stack pointer in a way that could potentially be unsafe in the
> context of ROP attacks.
> 
> Changes since v1:
> - rebase onto v6.2-rc1
> 
> [...]

Applied to arm64 (for-next/scs), thanks!

[1/2] arm64: Always load shadow stack pointer directly from the task struct
      https://git.kernel.org/arm64/c/2198d07c509f
[2/2] arm64: Stash shadow stack pointer in the task struct on interrupt
      https://git.kernel.org/arm64/c/59b37fe52f49