From patchwork Thu Jul 19 11:31:29 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Popov X-Patchwork-Id: 10534215 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9C05D601D2 for ; Thu, 19 Jul 2018 11:32:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 88B9E283CA for ; Thu, 19 Jul 2018 11:32:04 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 79CD428448; Thu, 19 Jul 2018 11:32:04 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.2 required=2.0 tests=BAYES_00, MAILING_LIST_MULTI, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 45B0F283CA for ; Thu, 19 Jul 2018 11:32:02 +0000 (UTC) Received: (qmail 26181 invoked by uid 550); 19 Jul 2018 11:32:00 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 26162 invoked from network); 19 Jul 2018 11:31:59 -0000 X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=NTWZ6INUY5tEKN4+qbDoBT/GesS/sm73LwaZZjDNyHY=; b=AQJO5XiwiusNVuNh3I1vC1nblPG6Q7+Ng3qoTSXY9IaTAclWRtaMb7Ukk6xGyuvH8R x+5gZeR/ZuAi66CtfmIuB7K5SjaOQikub+4B74H3WhIrBxRgizRK5XdbH3FUdVAAlb6T HMheiWWPsF05nIcAHr3UGcvDVL+Av+TumfsnGIdcaedRUEZUki5LRFb8sLes5IU+8tf8 wh4B76hHuoVnRnSxOF57+AT4Jm6wfagou8Fnfq/6M1maLb6UFDfm6YxD2UjLrAKhb3EL RtK26hiUFToHKlS8fUNJlm6Kihv1ezVYfXQVYme23mUsqt1+T0e2MnJKHmSIm89YT4Po VY4w== X-Gm-Message-State: AOUpUlENad7afeolzsvsrcgeFRdlZxaeYnkqlKMXs+KFvI9HRvuN11/k TDdx2iJNaI7PrMUXZSKXcjaBB3eWjSU= X-Google-Smtp-Source: AAOMgpcMr1o/ySITwAfNUQvNy2BfsHg33USo0s/guLKA/omSy5p+WSTsnLU5xMzX22XE53Mj7bVj0g== X-Received: by 2002:a19:238d:: with SMTP id j135-v6mr6752063lfj.58.1531999908424; Thu, 19 Jul 2018 04:31:48 -0700 (PDT) From: Alexander Popov To: kernel-hardening@lists.openwall.com, Kees Cook , Kees Cook , PaX Team , Brad Spengler , Ingo Molnar , Andy Lutomirski , Tycho Andersen , Laura Abbott , Mark Rutland , Ard Biesheuvel , Borislav Petkov , Richard Sandiford , Thomas Gleixner , "H . Peter Anvin" , Peter Zijlstra , "Dmitry V . Levin" , Emese Revfy , Jonathan Corbet , Andrey Ryabinin , "Kirill A . Shutemov" , Thomas Garnier , Andrew Morton , Alexei Starovoitov , Josef Bacik , Masami Hiramatsu , Nicholas Piggin , Al Viro , "David S . Miller" , Ding Tianhong , David Woodhouse , Josh Poimboeuf , Steven Rostedt , Dominik Brodowski , Juergen Gross , Linus Torvalds , Greg Kroah-Hartman , Dan Williams , Dave Hansen , Mathias Krause , Vikas Shivappa , Kyle Huey , Dmitry Safonov , Will Deacon , Arnd Bergmann , Florian Weimer , Boris Lukashev , Andrey Konovalov , x86@kernel.org, linux-kernel@vger.kernel.org, alex.popov@linux.com Subject: [PATCH v14 7/7] stackleak, sysctl: Allow runtime disabling of kernel stack erasing Date: Thu, 19 Jul 2018 14:31:29 +0300 Message-Id: <1531999889-18343-1-git-send-email-alex.popov@linux.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <20180717071223.GA29533@gmail.com> References: <20180717071223.GA29533@gmail.com> X-Virus-Scanned: ClamAV using ClamSMTP Introduce CONFIG_STACKLEAK_RUNTIME_DISABLE option, which provides 'stack_erasing_bypass' sysctl. It can be used in runtime to disable kernel stack erasing for kernels built with CONFIG_GCC_PLUGIN_STACKLEAK. Stack erasing will then remain disabled and STACKLEAK_METRICS will not be updated until the next boot. Signed-off-by: Alexander Popov --- Documentation/sysctl/kernel.txt | 19 +++++++++++++++++++ include/linux/stackleak.h | 6 ++++++ kernel/stackleak.c | 40 ++++++++++++++++++++++++++++++++++++++++ kernel/sysctl.c | 15 ++++++++++++++- scripts/gcc-plugins/Kconfig | 10 ++++++++++ 5 files changed, 89 insertions(+), 1 deletion(-) diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt index eded671d..63b7493 100644 --- a/Documentation/sysctl/kernel.txt +++ b/Documentation/sysctl/kernel.txt @@ -87,6 +87,7 @@ show up in /proc/sys/kernel: - shmmni - softlockup_all_cpu_backtrace - soft_watchdog +- stack_erasing_bypass - stop-a [ SPARC only ] - sysrq ==> Documentation/admin-guide/sysrq.rst - sysctl_writes_strict @@ -962,6 +963,24 @@ detect a hard lockup condition. ============================================================== +stack_erasing_bypass + +This parameter can be used to disable kernel stack erasing at the end +of syscalls for kernels built with CONFIG_GCC_PLUGIN_STACKLEAK. + +That erasing reduces the information which kernel stack leak bugs +can reveal and blocks some uninitialized stack variable attacks. +The tradeoff is the performance impact: on a single CPU system kernel +compilation sees a 1% slowdown, other systems and workloads may vary. + + 0: do nothing - stack erasing is enabled by default. + + 1: enable stack erasing bypass - stack erasing will then remain + disabled and STACKLEAK_METRICS will not be updated until the + next boot. + +============================================================== + tainted: Non-zero if the kernel has been tainted. Numeric values, which can be diff --git a/include/linux/stackleak.h b/include/linux/stackleak.h index b911b97..e1fc3d1 100644 --- a/include/linux/stackleak.h +++ b/include/linux/stackleak.h @@ -22,6 +22,12 @@ static inline void stackleak_task_init(struct task_struct *t) t->prev_lowest_stack = t->lowest_stack; # endif } + +#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE +int stack_erasing_bypass_sysctl(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos); +#endif + #else /* !CONFIG_GCC_PLUGIN_STACKLEAK */ static inline void stackleak_task_init(struct task_struct *t) { } #endif diff --git a/kernel/stackleak.c b/kernel/stackleak.c index f5c4111..f731c9a 100644 --- a/kernel/stackleak.c +++ b/kernel/stackleak.c @@ -14,6 +14,36 @@ #include +#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE +#include + +static DEFINE_STATIC_KEY_FALSE(stack_erasing_bypass); + +int stack_erasing_bypass_sysctl(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos) +{ + int ret = 0; + int state = static_branch_unlikely(&stack_erasing_bypass); + + table->data = &state; + table->maxlen = sizeof(int); + ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); + if (ret || !write) + return ret; + + /* Stack erasing re-enabling is not supported */ + if (static_branch_unlikely(&stack_erasing_bypass)) + return -EOPNOTSUPP; + + if (state) { + static_branch_enable(&stack_erasing_bypass); + pr_warn("stackleak: stack erasing is disabled until reboot\n"); + } + + return ret; +} +#endif /* CONFIG_STACKLEAK_RUNTIME_DISABLE */ + asmlinkage void stackleak_erase(void) { /* It would be nice not to have 'kstack_ptr' and 'boundary' on stack */ @@ -22,6 +52,11 @@ asmlinkage void stackleak_erase(void) unsigned int poison_count = 0; const unsigned int depth = STACKLEAK_SEARCH_DEPTH / sizeof(unsigned long); +#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE + if (static_branch_unlikely(&stack_erasing_bypass)) + return; +#endif + /* Search for the poison value in the kernel stack */ while (kstack_ptr > boundary && poison_count <= depth) { if (*(unsigned long *)kstack_ptr == STACKLEAK_POISON) @@ -78,6 +113,11 @@ void __used stackleak_track_stack(void) */ unsigned long sp = (unsigned long)&sp; +#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE + if (static_branch_unlikely(&stack_erasing_bypass)) + return; +#endif + /* * Having CONFIG_STACKLEAK_TRACK_MIN_SIZE larger than * STACKLEAK_SEARCH_DEPTH makes the poison search in diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 2d9837c..0ac25ca 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -91,7 +91,9 @@ #ifdef CONFIG_CHR_DEV_SG #include #endif - +#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE +#include +#endif #ifdef CONFIG_LOCKUP_DETECTOR #include #endif @@ -1230,6 +1232,17 @@ static struct ctl_table kern_table[] = { .extra2 = &one, }, #endif +#ifdef CONFIG_STACKLEAK_RUNTIME_DISABLE + { + .procname = "stack_erasing_bypass", + .data = NULL, + .maxlen = sizeof(int), + .mode = 0600, + .proc_handler = stack_erasing_bypass_sysctl, + .extra1 = &zero, + .extra2 = &one, + }, +#endif { } }; diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig index 292161d..0028945 100644 --- a/scripts/gcc-plugins/Kconfig +++ b/scripts/gcc-plugins/Kconfig @@ -182,4 +182,14 @@ config STACKLEAK_METRICS can be useful for estimating the STACKLEAK performance impact for your workloads. +config STACKLEAK_RUNTIME_DISABLE + bool "Allow runtime disabling of kernel stack erasing" + depends on GCC_PLUGIN_STACKLEAK + help + This option provides 'stack_erasing_bypass' sysctl, which can be + used in runtime to disable kernel stack erasing for kernels built + with CONFIG_GCC_PLUGIN_STACKLEAK. Stack erasing will then remain + disabled and STACKLEAK_METRICS will not be updated until the + next boot. + endif