From patchwork Wed Apr 15 21:04:51 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kristen Carlson Accardi X-Patchwork-Id: 11492045 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 48A2913B2 for ; Wed, 15 Apr 2020 21:06:58 +0000 (UTC) Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.kernel.org (Postfix) with SMTP id AF4E82076D for ; Wed, 15 Apr 2020 21:06:57 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org AF4E82076D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kernel-hardening-return-18512-patchwork-kernel-hardening=patchwork.kernel.org@lists.openwall.com Received: (qmail 19560 invoked by uid 550); 15 Apr 2020 21:05:52 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 19460 invoked from network); 15 Apr 2020 21:05:51 -0000 IronPort-SDR: mBYelhYHVIsTs5v3Q+GHhl1bbNrUgJtlfbSabXFBe0hGyuxhk70OTuoEbaW/AUOkMILHlkYfuB +4EY2NJi6Juw== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False IronPort-SDR: 5NmaIRolpxwZ7///i8EhtVYQNaOyMjZP7JSXEUZoz/Lyy4pJxaGbfCCQFe9qXmggsANzKLJMBN 6Bu3/2RDxV1w== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.72,388,1580803200"; d="scan'208";a="455035629" From: Kristen Carlson Accardi To: keescook@chromium.org, tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, hpa@zytor.com, Jessica Yu Cc: arjan@linux.intel.com, x86@kernel.org, linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com, rick.p.edgecomb@intel.com Subject: [PATCH 9/9] module: Reorder functions Date: Wed, 15 Apr 2020 14:04:51 -0700 Message-Id: <20200415210452.27436-10-kristen@linux.intel.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200415210452.27436-1-kristen@linux.intel.com> References: <20200415210452.27436-1-kristen@linux.intel.com> MIME-Version: 1.0 If a module has functions split out into separate text sections (i.e. compiled with the -ffunction-sections flag), reorder the functions to provide some code diversification to modules. Signed-off-by: Kristen Carlson Accardi Reviewed-by: Kees Cook --- kernel/module.c | 82 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 82 insertions(+) diff --git a/kernel/module.c b/kernel/module.c index 646f1e2330d2..e432ec5f6df4 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -53,6 +53,8 @@ #include #include #include +#include +#include #include #include "module-internal.h" @@ -2370,6 +2372,83 @@ static long get_offset(struct module *mod, unsigned int *size, return ret; } +/* + * shuffle_text_list() + * Use a Fisher Yates algorithm to shuffle a list of text sections. + */ +static void shuffle_text_list(Elf_Shdr **list, int size) +{ + int i; + unsigned int j; + Elf_Shdr *temp; + + for (i = size - 1; i > 0; i--) { + /* + * pick a random index from 0 to i + */ + get_random_bytes(&j, sizeof(j)); + j = j % (i + 1); + + temp = list[i]; + list[i] = list[j]; + list[j] = temp; + } +} + +/* + * randomize_text() + * Look through the core section looking for executable code sections. + * Store sections in an array and then shuffle the sections + * to reorder the functions. + */ +static void randomize_text(struct module *mod, struct load_info *info) +{ + int i; + int num_text_sections = 0; + Elf_Shdr **text_list; + int size = 0; + int max_sections = info->hdr->e_shnum; + unsigned int sec = find_sec(info, ".text"); + + if (sec == 0) + return; + + text_list = kmalloc_array(max_sections, sizeof(*text_list), GFP_KERNEL); + if (text_list == NULL) + return; + + for (i = 0; i < max_sections; i++) { + Elf_Shdr *shdr = &info->sechdrs[i]; + const char *sname = info->secstrings + shdr->sh_name; + + if (!(shdr->sh_flags & SHF_ALLOC) || + !(shdr->sh_flags & SHF_EXECINSTR) || + strstarts(sname, ".init")) + continue; + + text_list[num_text_sections] = shdr; + num_text_sections++; + } + + shuffle_text_list(text_list, num_text_sections); + + for (i = 0; i < num_text_sections; i++) { + Elf_Shdr *shdr = text_list[i]; + + /* + * get_offset has a section index for it's last + * argument, that is only used by arch_mod_section_prepend(), + * which is only defined by parisc. Since this this type + * of randomization isn't supported on parisc, we can + * safely pass in zero as the last argument, as it is + * ignored. + */ + shdr->sh_entsize = get_offset(mod, &size, shdr, 0); + } + + kfree(text_list); +} + /* Lay out the SHF_ALLOC sections in a way not dissimilar to how ld might -- code, read-only data, read-write data, small data. Tally sizes, and place the offsets into sh_entsize fields: high bit means it @@ -2460,6 +2539,9 @@ static void layout_sections(struct module *mod, struct load_info *info) break; } } + + if (IS_ENABLED(CONFIG_FG_KASLR) && kaslr_enabled()) + randomize_text(mod, info); } static void set_license(struct module *mod, const char *license)