From patchwork Mon Apr 6 23:16:05 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11476829 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 3AFB11744 for ; Mon, 6 Apr 2020 23:16:24 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id EA1F32082D for ; Mon, 6 Apr 2020 23:16:23 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="FAUou8gY" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org EA1F32082D Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E1A238E0010; Mon, 6 Apr 2020 19:16:15 -0400 (EDT) Delivered-To: linux-mm-outgoing@kvack.org Received: by kanga.kvack.org (Postfix, from userid 40) id D9FC18E0001; Mon, 6 Apr 2020 19:16:15 -0400 (EDT) X-Original-To: int-list-linux-mm@kvack.org X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id BEF758E0010; Mon, 6 Apr 2020 19:16:15 -0400 (EDT) X-Original-To: linux-mm@kvack.org X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0134.hostedemail.com [216.40.44.134]) by kanga.kvack.org (Postfix) with ESMTP id A66C78E0001 for ; Mon, 6 Apr 2020 19:16:15 -0400 (EDT) Received: from smtpin25.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id 5CCB0A8E9 for ; Mon, 6 Apr 2020 23:16:15 +0000 (UTC) X-FDA: 76678990710.25.front50_8de340561381a X-Spam-Summary: 2,0,0,861ac08b523d35cd,d41d8cd98f00b204,keescook@chromium.org,,RULES_HIT:41:355:379:541:800:960:968:973:988:989:1260:1311:1314:1345:1359:1431:1437:1515:1535:1544:1711:1730:1747:1777:1792:2197:2198:2199:2200:2393:2559:2562:2693:2731:3138:3139:3140:3141:3142:3355:3653:3865:3866:3867:3868:3870:3871:3872:4118:4250:4321:4605:5007:6261:6653:6742:8660:9592:10004:11026:11473:11658:11914:12043:12114:12296:12297:12438:12517:12519:12555:12895:12986:13148:13230:13894:14096:14181:14394:14721:21080:21221:21444:21451:21627:21966:30054,0,RBL:209.85.216.67:@chromium.org:.lbl8.mailshell.net-66.100.201.201 62.2.0.100,CacheIP:none,Bayesian:0.5,0.5,0.5,Netcheck:none,DomainCache:0,MSF:not bulk,SPF:fp,MSBL:0,DNSBL:neutral,Custom_rules:0:0:0,LFtime:23,LUA_SUMMARY:none X-HE-Tag: front50_8de340561381a X-Filterd-Recvd-Size: 7198 Received: from mail-pj1-f67.google.com (mail-pj1-f67.google.com [209.85.216.67]) by imf06.hostedemail.com (Postfix) with ESMTP for ; Mon, 6 Apr 2020 23:16:14 +0000 (UTC) Received: by mail-pj1-f67.google.com with SMTP id z3so571098pjr.4 for ; Mon, 06 Apr 2020 16:16:14 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=afO1zKmkq1sj5aqNSAPmo8IRjezuEuKjnM3GlRCWtRE=; b=FAUou8gYmt2MCxO2cKyXhzSw4j1IC8KgeC+bXiqTqe5QqSNRmdnqOuVJoHQDJ+UyPU RdIafVDCCHUGnepHULs0h0QZtUehhYm52xPc8JIfEafNjj7L97tUHTMzVrIHdX23tu7T 870tT8w8N8DbhdKYHGf474/jG4q9lS98mHNd0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=afO1zKmkq1sj5aqNSAPmo8IRjezuEuKjnM3GlRCWtRE=; b=UUWqxrT3obTLnzfy/MK8SjkKi/z6Qohb+BrsSfMl7m9JY2FZkie1a2AKOUFl2hbu7c UUdXTFdD7gOq39wQ5U1NVriHwnL/DnXkvKWkmCtR/9egzAWjKP5Ah9AZRIvE2KaUCgU6 V6keVXfI59OIwDO3gYr3VHVTSuH35+MGJQ7SG8TA64whvbHzqG4mrfb/BXm0EV47iTSa xumJpeMIdmdUUMm/r5AV0RtmgYCF29lYX0SdGxJhjvRJyGCL0GuOO33DCsxB16ijzOXe WKxXGm1+gkPbicmgqtR0ncB12xn0HPNJjwdJr0grGKaaekE3+NW7WZ+6Y54KyahF5Un+ npAw== X-Gm-Message-State: AGi0Pub1NMrxo4cP6zDtnaUGm16rlqzb40AU79JRSXEZatWzRbERw2Yt jnnyBOM8cjXvYII/yO+YNHriBw== X-Google-Smtp-Source: APiQypLKqmE7eCIX43I8YR8JbiR94l3ZUUPoGei30hzmH3c+zDO2qS2G3j+Tlv/Caq6mWLyP6sMzhQ== X-Received: by 2002:a17:902:788e:: with SMTP id q14mr22301315pll.72.1586214974066; Mon, 06 Apr 2020 16:16:14 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id f8sm10635773pgc.75.2020.04.06.16.16.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Apr 2020 16:16:10 -0700 (PDT) From: Kees Cook To: Thomas Gleixner Cc: Kees Cook , Elena Reshetova , x86@kernel.org, Andy Lutomirski , Peter Zijlstra , Catalin Marinas , Will Deacon , Mark Rutland , Alexander Potapenko , Ard Biesheuvel , Jann Horn , kernel-hardening@lists.openwall.com, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 4/5] x86/entry: Enable random_kstack_offset support Date: Mon, 6 Apr 2020 16:16:05 -0700 Message-Id: <20200406231606.37619-5-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200406231606.37619-1-keescook@chromium.org> References: <20200406231606.37619-1-keescook@chromium.org> MIME-Version: 1.0 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Allow for a randomized stack offset on a per-syscall basis, with roughly 5 bits of entropy. In order to avoid unconditional stack canaries on syscall entry, also downgrade from -fstack-protector-strong to -fstack-protector to avoid triggering checks due to alloca(). Examining the resulting canary coverage changes to common.o, this also removes canaries in other functions, due to a handful of declarations of "__u64 args[6]" (from seccomp) and "unsigned long args[6]" (from tracepoints), but their accesses are indexed (instead of via dynamically sized linear reads/writes) so the risk of removing useful mitigation coverage here is very low. Signed-off-by: Kees Cook --- arch/x86/Kconfig | 1 + arch/x86/entry/Makefile | 9 +++++++++ arch/x86/entry/common.c | 12 +++++++++++- 3 files changed, 21 insertions(+), 1 deletion(-) diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index beea77046f9b..b9d449581eb6 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -150,6 +150,7 @@ config X86 select HAVE_ARCH_TRANSPARENT_HUGEPAGE select HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD if X86_64 select HAVE_ARCH_VMAP_STACK if X86_64 + select HAVE_ARCH_RANDOMIZE_KSTACK_OFFSET select HAVE_ARCH_WITHIN_STACK_FRAMES select HAVE_ASM_MODVERSIONS select HAVE_CMPXCHG_DOUBLE diff --git a/arch/x86/entry/Makefile b/arch/x86/entry/Makefile index 06fc70cf5433..7b40e6ae2618 100644 --- a/arch/x86/entry/Makefile +++ b/arch/x86/entry/Makefile @@ -7,6 +7,15 @@ OBJECT_FILES_NON_STANDARD_entry_64_compat.o := y CFLAGS_syscall_64.o += $(call cc-option,-Wno-override-init,) CFLAGS_syscall_32.o += $(call cc-option,-Wno-override-init,) + +# Downgrade to -fstack-protector to avoid triggering unneeded stack canary +# checks due to randomize_kstack_offset. This also removes canaries in +# other places as well, due to a handful of declarations of __u64 args[6] +# (seccomp) and unsigned long args[6] (tracepoints), but their accesses +# are indexed (instead of via dynamically sized linear reads/writes) so +# the risk of removing useful mitigation coverage here is very low. +CFLAGS_common.o += $(subst -fstack-protector-strong,-fstack-protector,$(filter -fstack-protector-strong,$(KBUILD_CFLAGS))) + obj-y := entry_$(BITS).o thunk_$(BITS).o syscall_$(BITS).o obj-y += common.o diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c index 9747876980b5..086d7af570af 100644 --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include @@ -189,6 +190,13 @@ __visible inline void prepare_exit_to_usermode(struct pt_regs *regs) lockdep_assert_irqs_disabled(); lockdep_sys_exit(); + /* + * x86_64 stack alignment means 3 bits are ignored, so keep + * the top 5 bits. x86_32 needs only 2 bits of alignment, so + * the top 6 bits will be used. + */ + choose_random_kstack_offset(rdtsc() & 0xFF); + cached_flags = READ_ONCE(ti->flags); if (unlikely(cached_flags & EXIT_TO_USERMODE_LOOP_FLAGS)) @@ -283,6 +291,7 @@ __visible void do_syscall_64(unsigned long nr, struct pt_regs *regs) { struct thread_info *ti; + add_random_kstack_offset(); enter_from_user_mode(); local_irq_enable(); ti = current_thread_info(); @@ -355,6 +364,7 @@ static __always_inline void do_syscall_32_irqs_on(struct pt_regs *regs) /* Handles int $0x80 */ __visible void do_int80_syscall_32(struct pt_regs *regs) { + add_random_kstack_offset(); enter_from_user_mode(); local_irq_enable(); do_syscall_32_irqs_on(regs); @@ -378,8 +388,8 @@ __visible long do_fast_syscall_32(struct pt_regs *regs) */ regs->ip = landing_pad; + add_random_kstack_offset(); enter_from_user_mode(); - local_irq_enable(); /* Fetch EBP from where the vDSO stashed it. */