From patchwork Tue Apr 10 07:30:46 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: kpark3469@gmail.com X-Patchwork-Id: 10332427 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 773356028A for ; Tue, 10 Apr 2018 07:31:47 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 641C528B4F for ; Tue, 10 Apr 2018 07:31:47 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 585BD28B51; Tue, 10 Apr 2018 07:31:47 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 4896528B4F for ; Tue, 10 Apr 2018 07:31:46 +0000 (UTC) Received: (qmail 19878 invoked by uid 550); 10 Apr 2018 07:31:34 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 19847 invoked from network); 10 Apr 2018 07:31:32 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=NzoZuc+DdjRY93JGvBryC2MtxBtRt5tGrF7yypD1BLw=; b=ZhfAR9aUk98y5ZEyPrB/nlQzdYCOcBzoJ4fAvFZ1674vnjuj7010zXPhBZ1V3EFC+F gY6d+aVNwQR3jxfsD+R+EKluDxZNloiOMZy4UFfqzEYlrXL9PbT7ZR3/vVqJLQtvd5nm PgNfbjfSveTfZdjLvZIsvGWkEhM+AOYYaRywtDfq0+zEl/xaUoCWD1pjV4iaAly8YUTU DjWB7S+duUL90YawNN6/xH/KTWHPGX9DUzCnapjEDt0dL8okn/+RQkV7RmL3pm0rvSv0 hU7vbr+0dBTzk7QaQ1fBqkSRLrmmnc17WUICJpA/oSPSmGL+WAt6Gb85qMegQE3H2hRV 0vqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=NzoZuc+DdjRY93JGvBryC2MtxBtRt5tGrF7yypD1BLw=; b=HuTqFlA7R7q4OFEq6BsVie5qEgEIbkCJUTsP9T/TRncG53BtdxYwGRYQCxzXCAdlD4 ZYs7pb6nLJJ2sguEpcSUvCY2x+obzOb+sKaGC59cgRmnzpsKJspPcU5MOO97rTVFrOJo NTBXDgTO00QmwgtOrQ6OO57/tBZZNnjAD9SEHK0XOA2Ne9EiT4yfSuwgWZhcdg5n/KRi m2VaWdAlqxddg6VI5fD9XyNLcLjHy18S0N26d1ZWXZH9fEvSqRR8F0vrFhVxhJn0DCPN AhXJkvooysgLPh4Q+iL2CIOQmHyyiyP3ahLAML2zO6anGiBCEB5iBjz907Ybh7FiJSzA uzpA== X-Gm-Message-State: ALQs6tDpdVWiRHG2dGHbRt9IkLD9GYu1RtzvrfB4Kpe167sExtzqLp4N bRMGeMWx32CMs5C9/fSHcw7VHA== X-Google-Smtp-Source: AIpwx4+ZYSqdhpZOM6a3TRtV+lvjkv07r+n3zg1rE6PrrHu+q74wyS6USaOJpWxJGVfmuYA9oCvJmQ== X-Received: by 10.28.5.198 with SMTP id 189mr692839wmf.155.1523345480869; Tue, 10 Apr 2018 00:31:20 -0700 (PDT) From: kpark3469@gmail.com To: kernel-hardening@lists.openwall.com Cc: catalin.marinas@arm.com, keescook@chromium.org, will.deacon@arm.com, mark.rutland@arm.com, james.morse@arm.com, panand@redhat.com, keun-o.park@darkmatter.ae, psodagud@codeaurora.org, jpoimboe@redhat.com, mingo@kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v4 2/3] arm64: usercopy: implement arch_within_stack_frames Date: Tue, 10 Apr 2018 11:30:46 +0400 Message-Id: <1523345447-10725-3-git-send-email-kpark3469@gmail.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1523345447-10725-2-git-send-email-kpark3469@gmail.com> References: <1523345447-10725-1-git-send-email-kpark3469@gmail.com> <1523345447-10725-2-git-send-email-kpark3469@gmail.com> X-Virus-Scanned: ClamAV using ClamSMTP From: James Morse This implements arch_within_stack_frames() for arm64 that should validate if a given object is contained by a kernel stack frame. Signed-off-by: James Morse Reviewed-by: Sahara Reviewed-by: Kees Cook --- arch/arm64/Kconfig | 1 + arch/arm64/kernel/stacktrace.c | 76 ++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 77 insertions(+) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index eb2cf49..4498ff4 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -128,6 +128,7 @@ config ARM64 select HAVE_SYSCALL_TRACEPOINTS select HAVE_KPROBES select HAVE_KRETPROBES + select HAVE_ARCH_WITHIN_STACK_FRAMES select IOMMU_DMA if IOMMU_SUPPORT select IRQ_DOMAIN select IRQ_FORCED_THREADING diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c index d5718a0..5eb3784 100644 --- a/arch/arm64/kernel/stacktrace.c +++ b/arch/arm64/kernel/stacktrace.c @@ -27,6 +27,11 @@ #include #include +#define FAKE_FRAME(frame, my_func) do { \ + frame.fp = (unsigned long)__builtin_frame_address(0); \ + frame.pc = (unsigned long)my_func; \ +} while (0) + /* * AArch64 PCS assigns the frame pointer to x29. * @@ -100,6 +105,77 @@ void notrace walk_stackframe(struct task_struct *tsk, struct stackframe *frame, } } +struct check_frame_arg { + unsigned long obj_start; + unsigned long obj_end; + unsigned long frame_start; + int discard_frames; + int err; +}; + +static int check_frame(struct stackframe *frame, void *d) +{ + struct check_frame_arg *arg = d; + unsigned long frame_end = frame->fp; + + /* object overlaps multiple frames */ + if (arg->obj_start < frame->fp && frame->fp < arg->obj_end) { + arg->err = BAD_STACK; + return 1; + } + + /* + * Discard frames and check object is in a frame written early + * enough. + */ + if (arg->discard_frames) + arg->discard_frames--; + else if ((arg->frame_start <= arg->obj_start && + arg->obj_start < frame_end) && + (arg->frame_start < arg->obj_end && arg->obj_end <= frame_end)) + return 1; + + /* object exists in a previous frame */ + if (arg->obj_end < arg->frame_start) { + arg->err = BAD_STACK; + return 1; + } + + arg->frame_start = frame_end + 0x10; + + return 0; +} + +/* Check obj doesn't overlap a stack frame record */ +int arch_within_stack_frames(const void *stack, + const void *stack_end, + const void *obj, unsigned long obj_len) +{ + struct stackframe frame; + struct check_frame_arg arg; + + if (!IS_ENABLED(CONFIG_FRAME_POINTER)) + return NOT_STACK; + + arg.err = GOOD_FRAME; + arg.obj_start = (unsigned long)obj; + arg.obj_end = arg.obj_start + obj_len; + + FAKE_FRAME(frame, arch_within_stack_frames); + arg.frame_start = frame.fp; + + /* + * Skip 4 non-inlined frames: , + * arch_within_stack_frames(), check_stack_object() and + * __check_object_size(). + */ + arg.discard_frames = 4; + + walk_stackframe(current, &frame, check_frame, &arg); + + return arg.err; +} + #ifdef CONFIG_STACKTRACE struct stack_trace_data { struct stack_trace *trace;