From patchwork Fri Jan 18 10:58:06 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 10769711 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 884846C5 for ; Fri, 18 Jan 2019 10:58:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 769962ACE7 for ; Fri, 18 Jan 2019 10:58:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 6A4452AF06; Fri, 18 Jan 2019 10:58:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 935222AD1D for ; Fri, 18 Jan 2019 10:58:32 +0000 (UTC) Received: (qmail 18048 invoked by uid 550); 18 Jan 2019 10:58:25 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 18011 invoked from network); 18 Jan 2019 10:58:24 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=KEDamF1G6iG0yJARiV0f8WcLBjigYpz1ziosX686/wc=; b=B5is7oZMBWOvsBwStWjLCig5yDrvlpDdrOQaVttA4OM8lJLR8PUJgLQJuSn3uOAbM+ zfoXjGMTFKVFLsSR/uyYRuHpLI6LaXCt0F2x2foHcdKCMAKbVas/ppLo3H1u0lyBb8lB 5+hBoZaZERPR79NwjidOakjyX/n+JWU0dD5xI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=KEDamF1G6iG0yJARiV0f8WcLBjigYpz1ziosX686/wc=; b=Mop7m7rQftx13nTNrzPo3ELtKBFqdySaIAbRrxwSHG667Rt2jPzB/tocPhuIFbcrim naq/z65vGPVd4Oh+3eimi3PAMfTt0KOPPiWWgdSygzndWfByqVR16zmWHlFVnAWSEIGp MLnmioF0/+PoMdkyF/428WYbp1Y9cF538NnvPSeiKkELSEGxkMQaRsXi5Ky63Yzonk6g m+ZjA+ZWGxjDZSTUsWwpTGVHM/T50SUB1NMRCcwBaXDdOsFcS2UD6CfnDoD1d1/o6qcG fSEOs0iRvf5v22tM4af3wsTiTVlrxnTjSMtyPA+5fjU6oZLIunEoYYYIULWBP7uuuw/v hkHA== X-Gm-Message-State: AJcUukfjV8We0DyJXpzZxiZavUIymxBbbNgtdC0f70Sj+I/XE+1heRCI u6w8fWGFNMJxgBKMkbLPebuREA== X-Google-Smtp-Source: ALg8bN7qCWn/ViMIVnXJ1q67toJGgsTW8ewMP7OlvOby9t/lrnuCQtV3qoXuPoluDUv707tzxfr6vg== X-Received: by 2002:a1c:a104:: with SMTP id k4mr14994971wme.54.1547809092789; Fri, 18 Jan 2019 02:58:12 -0800 (PST) From: Ard Biesheuvel To: keescook@chromium.org Cc: re.emese@gmail.com, kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Ard Biesheuvel , Kugan Vivekanandarajah Subject: [PATCH 1/2] gcc-plugins: arm_ssp_per_task_plugin: sign extend the SP mask Date: Fri, 18 Jan 2019 11:58:06 +0100 Message-Id: <20190118105807.26425-2-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190118105807.26425-1-ard.biesheuvel@linaro.org> References: <20190118105807.26425-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP The ARM per-task stack protector GCC plugin hits an assert in the compiler in some case, due to the fact the the SP mask expression is not sign-extended as it should be. So fix that. Suggested-by: Kugan Vivekanandarajah Signed-off-by: Ard Biesheuvel --- scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c index de70b8470971..a65fbefb8501 100644 --- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c +++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c @@ -13,7 +13,7 @@ static unsigned int arm_pertask_ssp_rtl_execute(void) for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) { const char *sym; rtx body; - rtx masked_sp; + rtx mask, masked_sp; /* * Find a SET insn involving a SYMBOL_REF to __stack_chk_guard @@ -33,12 +33,13 @@ static unsigned int arm_pertask_ssp_rtl_execute(void) * produces the address of the copy of the stack canary value * stored in struct thread_info */ + mask = GEN_INT(sext_hwi(sp_mask, GET_MODE_PRECISION(Pmode))); masked_sp = gen_reg_rtx(Pmode); emit_insn_before(gen_rtx_SET(masked_sp, gen_rtx_AND(Pmode, stack_pointer_rtx, - GEN_INT(sp_mask))), + mask)), insn); SET_SRC(body) = gen_rtx_PLUS(Pmode, masked_sp, From patchwork Fri Jan 18 10:58:07 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 10769715 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1D52E13B4 for ; Fri, 18 Jan 2019 10:58:40 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0B0432ACE7 for ; Fri, 18 Jan 2019 10:58:40 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id F34262AF06; Fri, 18 Jan 2019 10:58:39 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 32C9F2ACE7 for ; Fri, 18 Jan 2019 10:58:39 +0000 (UTC) Received: (qmail 18188 invoked by uid 550); 18 Jan 2019 10:58:26 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 18136 invoked from network); 18 Jan 2019 10:58:25 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=4PBOByBDyORJotrQHfAdkrD3rgX1OelOnufeKqsU2dQ=; b=AlrM1972m+0wXMXOuZvU17EhloZ3TgU+0dIl+cd6pVPtOCjjKqwzIbZ3qrSe2qlVEW Hw9ggdG4YeVmAHafc5+n+akYNC0sXtYESZj6frJhFweaIHa/bj8H8YM6vI5nxTZSygcM 9vR54EMAC2oeYRxIsG4Cmg43eJLzQ9buONYUk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=4PBOByBDyORJotrQHfAdkrD3rgX1OelOnufeKqsU2dQ=; b=jfxHClDtYGRAuXqT+546lNPTl2/8uW4MuhQkKQPyXsK5YP7mHJF1EvMEsFs44QagoT 0g6PFhpU7qmeg1N3gtMNZHm63A/G8gFPYxtA7bbfwpji25z6wSUVH5JAao2U8leUjoHM b3t8OjvFMyS4kamg4IiFukzOIxqgEpTLboEvznCAiAF3kCe33Gq96xGOT4sfKz7TSzIg ZDoKWCQoLV3930uL7bl3R+mC0mwA1bGVlQiq5p9t1vdOfUBfHCcHClEc5gnWaF0M1Jv5 obKCu+2/eJP3uu8C28OOQrMxPgSVe74JsvdSLt6zv4HtSNn/1F+/dBt225IEc6siUOD9 ts7g== X-Gm-Message-State: AJcUukeLb0mAoRFDbquUmI4jUSxJU1ALY3vDtEwdtlI+O8uuvOczMgXb 4wUXERrgH0qGA+yvDQFKenbA6w== X-Google-Smtp-Source: ALg8bN6XNctV/3mjt9tXUIVh909CcvPA7/B0iHznoaW1oLjZTDN2yXXDqL2opy2cpSGYg4eMK78sIQ== X-Received: by 2002:adf:f5d1:: with SMTP id k17mr17072968wrp.59.1547809094054; Fri, 18 Jan 2019 02:58:14 -0800 (PST) From: Ard Biesheuvel To: keescook@chromium.org Cc: re.emese@gmail.com, kernel-hardening@lists.openwall.com, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, Ard Biesheuvel Subject: [PATCH 2/2] gcc-plugins: arm_ssp_per_task_plugin: fix for GCC 9+ Date: Fri, 18 Jan 2019 11:58:07 +0100 Message-Id: <20190118105807.26425-3-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190118105807.26425-1-ard.biesheuvel@linaro.org> References: <20190118105807.26425-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 X-Virus-Scanned: ClamAV using ClamSMTP GCC 9 reworks the way the references to the stack canary are emitted, to prevent the value from being spilled to the stack before the final comparison in the epilogue, defeating the purpose, given that the spill slot is under control of the attacker that we are protecting ourselves from. Since our canary value address is obtained without accessing memory (as opposed to pre-v7 code that will obtain it from a literal pool), it is unlikely (although not guaranteed) that the compiler will spill the canary value in the same way, so let's just disable this improvement when building with GCC9+. Signed-off-by: Ard Biesheuvel --- scripts/gcc-plugins/arm_ssp_per_task_plugin.c | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c index a65fbefb8501..89c47f57d1ce 100644 --- a/scripts/gcc-plugins/arm_ssp_per_task_plugin.c +++ b/scripts/gcc-plugins/arm_ssp_per_task_plugin.c @@ -53,6 +53,19 @@ static unsigned int arm_pertask_ssp_rtl_execute(void) #define NO_GATE #include "gcc-generate-rtl-pass.h" +#if BUILDING_GCC_VERSION >= 9000 +static bool no(void) +{ + return false; +} + +static void arm_pertask_ssp_start_unit(void *gcc_data, void *user_data) +{ + targetm.have_stack_protect_combined_set = no; + targetm.have_stack_protect_combined_test = no; +} +#endif + __visible int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version) { @@ -100,5 +113,10 @@ __visible int plugin_init(struct plugin_name_args *plugin_info, register_callback(plugin_info->base_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &arm_pertask_ssp_rtl_pass_info); +#if BUILDING_GCC_VERSION >= 9000 + register_callback(plugin_info->base_name, PLUGIN_START_UNIT, + arm_pertask_ssp_start_unit, NULL); +#endif + return 0; }