From patchwork Wed Nov 9 20:00:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13038003 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 59D6EC43219 for ; Wed, 9 Nov 2022 20:00:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231939AbiKIUA4 (ORCPT ); Wed, 9 Nov 2022 15:00:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50946 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231416AbiKIUAz (ORCPT ); Wed, 9 Nov 2022 15:00:55 -0500 Received: from mail-pg1-x532.google.com (mail-pg1-x532.google.com [IPv6:2607:f8b0:4864:20::532]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E3BC13D40 for ; Wed, 9 Nov 2022 12:00:52 -0800 (PST) Received: by mail-pg1-x532.google.com with SMTP id o13so7822687pgu.7 for ; Wed, 09 Nov 2022 12:00:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=TOl6z/umIA2dhnmGMIG6cWX9VY1K0BEEK1Uosuato8Y=; b=Gka6JzDygIJ+DxhGOwp9S4RRCCCas04VGzIVik8QVniYT/h00GDqtbUPtAuiwLyLSo IcgRZX8xWzDMOfRAL0zquC3Ofpvb2fxZp/na3w0ujskXq0kO/9uZJwY68rl9BDhrkX2l 86vacPYObXCyQOmEyb8omdqyh55iUH4MV+7/U= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=TOl6z/umIA2dhnmGMIG6cWX9VY1K0BEEK1Uosuato8Y=; b=y3AAg9nHwvajlOPPoqwDNxKAvrFUZelzI6/9OaWq8lZuyGgrPfcmdRvs67TzCAhjkk Nf3XfTGmx67oibCLDGPq3UUJMorc1RvvvR9mEqNnTgtx1ZEtBiSuq13vHmdotdZgPrff d2NAJhz67SIxCy47zoi1ck1oVTp5dWq0ikEo/rfwOzXiWlYvNYPSl/jTgIMG93RaTiL2 31V1vmCc+AXkpF/CsfnQpIUqiGjWA2645UMjNlfUOuuym4Ayqgv0MvVjawcP6RXGpdOp LW3J6MhadhpzYJ7nsGCSuaNdXKVgiwdU4TbX6xn8f+K+FDbYDq+mWX8XJxxEbxyLmjKL 13KA== X-Gm-Message-State: ACrzQf3dmBFCz1LT9IpKW/4NLpAgaEcmd+X/K3FGZPBxr1t5e6QlRC+4 mbdzD1CczNRiURtwv3FTGUuMow== X-Google-Smtp-Source: AMsMyM4yF1PgLzGEhlLvREfoGwRGCLaCp4b09MgHR3ZbYDeWI2E6+jguZ+DVChze5gOOKmIr3sL0wA== X-Received: by 2002:a63:5150:0:b0:46f:be60:d1eb with SMTP id r16-20020a635150000000b0046fbe60d1ebmr45016359pgl.82.1668024052025; Wed, 09 Nov 2022 12:00:52 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id a17-20020aa794b1000000b0056eaa577eb0sm8654375pfl.215.2022.11.09.12.00.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Nov 2022 12:00:51 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Petr Mladek , Andrew Morton , tangmeng , "Guilherme G. Piccoli" , Tiezhu Yang , Sebastian Andrzej Siewior , Greg KH , Linus Torvalds , Seth Jenkins , Andy Lutomirski , "Eric W. Biederman" , Arnd Bergmann , Marco Elver , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , Luis Chamberlain , David Gow , "Paul E. McKenney" , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 1/6] panic: Separate sysctl logic from CONFIG_SMP Date: Wed, 9 Nov 2022 12:00:44 -0800 Message-Id: <20221109200050.3400857-1-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221109194404.gonna.558-kees@kernel.org> References: <20221109194404.gonna.558-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1192; h=from:subject; bh=IoW4clR1Z0l0tOPQKCaXz5ByKX5rPTSXg36TIGSUe64=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjbAbv1LOBj/eV9FJ9roBnkkNtYxaBPhV1cL6wlgbR D9gETvCJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY2wG7wAKCRCJcvTf3G3AJlUtD/ 97OgZ7IMn3jz6bT9vmc/YgFyUCFPLVBPbEk8QBykQqQITpRvaIn71jcxvGnQ6p0uGNEiQuoxc7AhU1 ah6MKCbYMay02cZ0WqCIGOnGcoH30Chbhu1peQ1QPCY24ArACK+DU5g1FSe2/rMFXFDBh7omd2GKVR jA30ciu1aIlQ//Lo8ZE5yW3VVKAGBhuohwQ04R/CawrVz/qXjSl/RqgyiXkINJNOCcytNkFPPcJBhQ 889xaIIzfX5NijRPr8S8tmJcGnNbLAuSV+ejNRUMQAWnbtbHZNBFUJyL2w3GPFqGOy5polHHUb6EQG Z7Cvlc4eOt4GP5drNlw+1smVVa68Oj+DTzuTkUEYpUpc0ajYX63hOFn2eMC1e25/l+5Sl2jfjT58ZZ 5aZrHCGfBHK7mrz+AL+7NkF9PHD1iLGqXT4tMG0mNbpftOn/h93mg8RKDi6vusCqKUwgQsYY4Q6B2l Mg9AP9hEjp0dtI2NCekNW23wvTElrzNMqldUgwJjvGnft7gCT4wsIqR/rzl92YKChzX3P9e0jfoSco nPPCFRMXOhY100moOq2KtKG49g/Ms4RvvyFP1Gmo+m3ppsvsqeBp7apapgTsE6pKtVzWkcgAlBArGI /0UUIHG03P7pOXIEOq/Ec7ouKxipBwYsM8AvUGRA9D9IDd7bcKz5j/VoZbBg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org In preparation for adding more sysctls directly in kernel/panic.c, split CONFIG_SMP from the logic that adds sysctls. Cc: Petr Mladek Cc: Andrew Morton Cc: tangmeng Cc: "Guilherme G. Piccoli" Cc: Tiezhu Yang Cc: Sebastian Andrzej Siewior Signed-off-by: Kees Cook --- kernel/panic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/panic.c b/kernel/panic.c index da323209f583..129936511380 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -75,8 +75,9 @@ ATOMIC_NOTIFIER_HEAD(panic_notifier_list); EXPORT_SYMBOL(panic_notifier_list); -#if defined(CONFIG_SMP) && defined(CONFIG_SYSCTL) +#if CONFIG_SYSCTL static struct ctl_table kern_panic_table[] = { +#if defined(CONFIG_SMP) { .procname = "oops_all_cpu_backtrace", .data = &sysctl_oops_all_cpu_backtrace, @@ -86,6 +87,7 @@ static struct ctl_table kern_panic_table[] = { .extra1 = SYSCTL_ZERO, .extra2 = SYSCTL_ONE, }, +#endif { } }; From patchwork Wed Nov 9 20:00:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13038004 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B49E6C4321E for ; Wed, 9 Nov 2022 20:00:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231963AbiKIUA6 (ORCPT ); Wed, 9 Nov 2022 15:00:58 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50950 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231899AbiKIUAz (ORCPT ); Wed, 9 Nov 2022 15:00:55 -0500 Received: from mail-pj1-x102c.google.com (mail-pj1-x102c.google.com [IPv6:2607:f8b0:4864:20::102c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA02F13D75 for ; Wed, 9 Nov 2022 12:00:52 -0800 (PST) Received: by mail-pj1-x102c.google.com with SMTP id l22-20020a17090a3f1600b00212fbbcfb78so2868746pjc.3 for ; Wed, 09 Nov 2022 12:00:52 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=kQKFx/3OVEr8FOcVZmOutyPL+4wZ1FyB719efe5yfh8=; b=Eaj/SO41QTj6LK1PYYV3lOKLMoZSqh+R0yOIIew/1/tAcK612AxIrryq13QPOM+mG3 cIGmAGV1hA0JT7z/XcIG7pfVNECt7JsEuq8IzQEpG+xbwBgzHHge111qfOUOpF/DODDh gd9NKs/G/CVQXIRMjB5VA6NVlRIODdQVSaQVw= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=kQKFx/3OVEr8FOcVZmOutyPL+4wZ1FyB719efe5yfh8=; b=YNo7D5Zs4lPggPBiWwXOpQkw5Dk0GGn2TLAV5I3UZnw4T4CBkedOZtiuVDl8sSoDU5 nzGtXsinubFZlgcZjEEG4dEzkKl5iX/86o6eaBHMMRA7vKZDdf5Co/kGM5yb1BuZAWM+ uxkwANFGmO0340/2OsXgje1uxNKauprAKr/LWYttHNEkO2AXelm4pNQKHUWkrIQWcG7H 4H0WFwEXHYrYdcbsD7eYNZG5il+W8x7CHqUqN07r9TXrGdLJATg74Rp6wYgg8G5JrEb3 NUAT0vsaZsgxe2qWwUbup5275MqJhFN17PgfNfL5pz7JVTm7G1lhR5ypOPUnpdpnjjZX wI0Q== X-Gm-Message-State: ACrzQf1lvR3MnbSoTA0Wo+emGd/nIr0QZlUKSbLIOoveDnEWBffdiFSF tTVpfM4GRHv5wc9gh6h2OgNqSA== X-Google-Smtp-Source: AMsMyM6mufCgxjvUeKez7jB4G5EOHeMUc1Hxuif7xwxUrr+40nx9N84+xIx/MS0AbRJyF1rMX+hmwA== X-Received: by 2002:a17:902:7283:b0:188:612b:1d31 with SMTP id d3-20020a170902728300b00188612b1d31mr31950444pll.81.1668024052270; Wed, 09 Nov 2022 12:00:52 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id bd5-20020a17090b0b8500b0020d9306e735sm1629847pjb.20.2022.11.09.12.00.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Nov 2022 12:00:51 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Greg KH , Linus Torvalds , Seth Jenkins , Andy Lutomirski , Petr Mladek , Andrew Morton , tangmeng , "Guilherme G. Piccoli" , Tiezhu Yang , Sebastian Andrzej Siewior , "Eric W. Biederman" , Arnd Bergmann , Marco Elver , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , Luis Chamberlain , David Gow , "Paul E. McKenney" , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 2/6] exit: Put an upper limit on how often we can oops Date: Wed, 9 Nov 2022 12:00:45 -0800 Message-Id: <20221109200050.3400857-2-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221109194404.gonna.558-kees@kernel.org> References: <20221109194404.gonna.558-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5361; i=keescook@chromium.org; h=from:subject; bh=+f/+Dg4RjhhWvYSeTOZHt0meJbZX9qmj9YfRzK8RgiI=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjbAbvj62Q9JcvPPd6ZZiW3RZKbMkJ9KitwgH9cwUs jkYefu2JAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY2wG7wAKCRCJcvTf3G3AJtTYEA Coz/20jIancS/LGuMA+yU7vBUbp90sWb4OB9OEWj+5Z8KSUdedxGwouUYlMeNAAlL/7NDkKSvNpUDC JmGbJON8OKVCS8idIB9lACwcVavVx18L/YCJvzSwTvQTdXDOhMSjrS4Ouyyt2MSQiCpru6xUvwlGCm DOXU4YlA5cqVJ9CA/Uwq1U23IVAQOTldToR9GH19lq+0Kmr19P0jQha/rl5uarCKr5BU0XTqW6QKT2 k4cPF3Fjb65aiz0I3G2gW8SrPW4AANI3jJyhQT1+m32izI7gqs4Dz/h4jq9RSfF9rXjBXmBceJfnnb UmjaXMhmVJvPnAB7UXA5/tUz5h4PnWMb4WIyWqS8K3Rjppw81sgG0S3FEKk317d7y/ucXUDBwAIdbZ QqQI+ijh8zAw6m4pa1PHMgJxjN1nvqzNRip6eiShoPrpJrNKHlVZMseoUe+ytcD0IXZlr5VZgMlSnR MvmYVYavcUj4497v/0Zh4lg22PSKybYSsACuCv/g6jWagGfwMiDf+qOK4fNpn6eI5Jk9v4/vqg9zTj iEwg/2zCSXBGZsM3rMMyuud3hH9sMkmyKANOQvl4zbB3ghuT0gVX9Vt4Sb+innAy0kHTbvs2+F4XSh VvkhTOPJ5bFVFdiIqQFVx3jLysoYcUAkK3oXCThGbXsbm9fTKpWY3lnzNiVA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org From: Jann Horn Many Linux systems are configured to not panic on oops; but allowing an attacker to oops the system **really** often can make even bugs that look completely unexploitable exploitable (like NULL dereferences and such) if each crash elevates a refcount by one or a lock is taken in read mode, and this causes a counter to eventually overflow. The most interesting counters for this are 32 bits wide (like open-coded refcounts that don't use refcount_t). (The ldsem reader count on 32-bit platforms is just 16 bits, but probably nobody cares about 32-bit platforms that much nowadays.) So let's panic the system if the kernel is constantly oopsing. The speed of oopsing 2^32 times probably depends on several factors, like how long the stack trace is and which unwinder you're using; an empirically important one is whether your console is showing a graphical environment or a text console that oopses will be printed to. In a quick single-threaded benchmark, it looks like oopsing in a vfork() child with a very short stack trace only takes ~510 microseconds per run when a graphical console is active; but switching to a text console that oopses are printed to slows it down around 87x, to ~45 milliseconds per run. (Adding more threads makes this faster, but the actual oops printing happens under &die_lock on x86, so you can maybe speed this up by a factor of around 2 and then any further improvement gets eaten up by lock contention.) It looks like it would take around 8-12 days to overflow a 32-bit counter with repeated oopsing on a multi-core X86 system running a graphical environment; both me (in an X86 VM) and Seth (with a distro kernel on normal hardware in a standard configuration) got numbers in that ballpark. 12 days aren't *that* short on a desktop system, and you'd likely need much longer on a typical server system (assuming that people don't run graphical desktop environments on their servers), and this is a *very* noisy and violent approach to exploiting the kernel; and it also seems to take orders of magnitude longer on some machines, probably because stuff like EFI pstore will slow it down a ton if that's active. [Moved sysctl into kernel/exit.c -kees] Signed-off-by: Jann Horn Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20221107201317.324457-1-jannh@google.com --- Documentation/admin-guide/sysctl/kernel.rst | 8 ++++ kernel/exit.c | 42 +++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index 98d1b198b2b4..09f3fb2f8585 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -667,6 +667,14 @@ This is the default behavior. an oops event is detected. +oops_limit +========== + +Number of kernel oopses after which the kernel should panic when +``panic_on_oops`` is not set. Setting this to 0 or 1 has the same effect +as setting ``panic_on_oops=1``. + + osrelease, ostype & version =========================== diff --git a/kernel/exit.c b/kernel/exit.c index 35e0a31a0315..892f38aeb0a4 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -72,6 +72,33 @@ #include #include +/* + * The default value should be high enough to not crash a system that randomly + * crashes its kernel from time to time, but low enough to at least not permit + * overflowing 32-bit refcounts or the ldsem writer count. + */ +static unsigned int oops_limit = 10000; + +#if CONFIG_SYSCTL +static struct ctl_table kern_exit_table[] = { + { + .procname = "oops_limit", + .data = &oops_limit, + .maxlen = sizeof(oops_limit), + .mode = 0644, + .proc_handler = proc_douintvec, + }, + { } +}; + +static __init int kernel_exit_sysctls_init(void) +{ + register_sysctl_init("kernel", kern_exit_table); + return 0; +} +late_initcall(kernel_exit_sysctls_init); +#endif + static void __unhash_process(struct task_struct *p, bool group_dead) { nr_threads--; @@ -874,6 +901,8 @@ void __noreturn do_exit(long code) void __noreturn make_task_dead(int signr) { + static atomic_t oops_count = ATOMIC_INIT(0); + /* * Take the task off the cpu after something catastrophic has * happened. @@ -897,6 +926,19 @@ void __noreturn make_task_dead(int signr) preempt_count_set(PREEMPT_ENABLED); } + /* + * Every time the system oopses, if the oops happens while a reference + * to an object was held, the reference leaks. + * If the oops doesn't also leak memory, repeated oopsing can cause + * reference counters to wrap around (if they're not using refcount_t). + * This means that repeated oopsing can make unexploitable-looking bugs + * exploitable through repeated oopsing. + * To make sure this can't happen, place an upper bound on how often the + * kernel may oops without panic(). + */ + if (atomic_inc_return(&oops_count) >= READ_ONCE(oops_limit)) + panic("Oopsed too often (oops_limit is %d)", oops_limit); + /* * We're taking recursive faults here in make_task_dead. Safest is to just * leave this task alone and wait for reboot. From patchwork Wed Nov 9 20:00:46 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13038006 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9755C43219 for ; Wed, 9 Nov 2022 20:01:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231940AbiKIUBA (ORCPT ); Wed, 9 Nov 2022 15:01:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231956AbiKIUA4 (ORCPT ); Wed, 9 Nov 2022 15:00:56 -0500 Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 152FF13F03 for ; Wed, 9 Nov 2022 12:00:54 -0800 (PST) Received: by mail-pl1-x62f.google.com with SMTP id k7so18098580pll.6 for ; Wed, 09 Nov 2022 12:00:54 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=/UYGWVP+2kBbzi2iV4I0WWEoZudfeo1pQ1Ba/UKdZ3A=; b=Al9IUPioLVhF5aUYYmkVtzrhkkI5wmxiVaQ31mvEBzjeJfi8pW+OvoGceYUnEAui4l ZJLlkqQKqQWC2KF3997axm5+kzh3obM2aom1tQR9B2Ym9X8BhF9d9LpBxMDWeuw12+hg KPthUHOrt24jG8LjP6wtzdgAQ857NclAmm1L4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=/UYGWVP+2kBbzi2iV4I0WWEoZudfeo1pQ1Ba/UKdZ3A=; b=02BNgvUBDt61oarKNZElU3ArA6M7S0ZV8NeWyhgfVUwxI3Tbt5nwoVnngVhW9HfpUe 06COiPkfKuL03d5SF9+vQua5Ed5fu0fvBLs0qIlH1W88eSipJt2mKuHypNemIJU3Ezka AW/qtIsjsPGepFTDZllrdrzZ07pYQ7v6IKalkVr7bgbooYqwwTbGthydmkmhry8XroUM 3PCqFqcZFzBJ3HkTKIA/EOInYVUsozKUol0tlHiOlrNmHwxdHL3jrE/8xBQWkAefBSUp r8BWXX+OaYKnRiXeWMFGly5A5C+RLBwqftfail59ROlAxuV6OzSn7gq0+E7MrwGLnVOQ HdkA== X-Gm-Message-State: ACrzQf1mAGba6AL0Kd1HYOSGIpBPQHERBfuo/eJ7H9M1stZevz4BiywM JJV81BvXusMpGM5hC1uaonOdIg== X-Google-Smtp-Source: AMsMyM7LaEdlGS+MabxmO85Gn0ysyq3v1L2PjhWfgRyvBliSgVbai4V+CzcTzJ2ZUHN27GIBAj6bPw== X-Received: by 2002:a17:903:1211:b0:178:9353:9e42 with SMTP id l17-20020a170903121100b0017893539e42mr61056479plh.45.1668024053928; Wed, 09 Nov 2022 12:00:53 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id jf9-20020a170903268900b001868bf6a7b8sm9480282plb.146.2022.11.09.12.00.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Nov 2022 12:00:51 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , "Eric W. Biederman" , Arnd Bergmann , Greg KH , Linus Torvalds , Seth Jenkins , Andy Lutomirski , Petr Mladek , Andrew Morton , tangmeng , "Guilherme G. Piccoli" , Tiezhu Yang , Sebastian Andrzej Siewior , Marco Elver , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , Luis Chamberlain , David Gow , "Paul E. McKenney" , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 3/6] exit: Expose "oops_count" to sysfs Date: Wed, 9 Nov 2022 12:00:46 -0800 Message-Id: <20221109200050.3400857-3-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221109194404.gonna.558-kees@kernel.org> References: <20221109194404.gonna.558-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2891; h=from:subject; bh=qMx/IsiWcmyqv4bprAvLa4Z+pu9RdmRiuPSjG1ZzTgs=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjbAbwo1/8yglxqkQYwl/TzoU05jno2OXdm4rO0Khj SNJWKvmJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY2wG8AAKCRCJcvTf3G3AJn+dEA CRtODMqBP7kZcO5j9TwUU+pK8X2SSatj9G4jVKq5CV0wprk1khK5tQp/daoG01CBFuBi8pywh0MToC qWOJ91xSfQ/agiOTbGd07lX6ERIsGg7OnwthRfzrrgbStqJTaL9Ei56cH358dNkLxqP13ai260fQ6r pGCtPIHQ1HKjN+2ZUwXbMdVQSryY9wEfEV0qELbRCKol1wPOJqQI4EF7LMJjAQVqM/5YSDZVWAKoc1 PozfKT/HCo/8/vCKUyH29aaFklAEtl4yqgamCcr97ZuLklQn7lUhd4EMHF5P+iCsqaHKTxW4+2dRbK IZddqBIugKXp5xwXEUgHTjd9CD3spRwYJThUf4qTQjCMTceS+KunCfAMfDs4gvwgiJKXrmfViqcDvj Boo6O8+t+Dx84XTCh4iCcOUuSm/WrgINQCwCQn+kDHxUaVnwIVG7d1EfHIdb9f/3Ipt74/drWWYQLN eMz+nYK3J0JnqPAfoh/QdRk7t2ojlnwEAXhRsS7g2YLDfKIHCLyvaC0SEuynhHyX1umjMm3G5rEsp7 jjFeQESAFmjYAUoak8T6n6jnl0Q0e/0N0/Yi+jTgf5WnBJ27ID/Oqs2EFlBosDJ3WwuxdK4lZEp1q9 5pPeP4jLcdy3SOY/cdO3S74h5jopYa5+mufuWL4X4p7060Tps+iGxoxMR1IA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Since Oops count is now tracked and is a fairly interesting signal, add the entry /sys/kernel/oops_count to expose it to userspace. Cc: "Eric W. Biederman" Cc: Jann Horn Cc: Arnd Bergmann Signed-off-by: Kees Cook --- .../ABI/testing/sysfs-kernel-oops_count | 6 +++++ MAINTAINERS | 1 + kernel/exit.c | 22 +++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-oops_count diff --git a/Documentation/ABI/testing/sysfs-kernel-oops_count b/Documentation/ABI/testing/sysfs-kernel-oops_count new file mode 100644 index 000000000000..156cca9dbc96 --- /dev/null +++ b/Documentation/ABI/testing/sysfs-kernel-oops_count @@ -0,0 +1,6 @@ +What: /sys/kernel/oops_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List +Description: + Shows how many times the system has Oopsed since last boot. diff --git a/MAINTAINERS b/MAINTAINERS index 1cd80c113721..0a1e95a58e54 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -11106,6 +11106,7 @@ M: Kees Cook L: linux-hardening@vger.kernel.org S: Supported T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening +F: Documentation/ABI/testing/sysfs-kernel-oops_count F: include/linux/overflow.h F: include/linux/randomize_kstack.h F: mm/usercopy.c diff --git a/kernel/exit.c b/kernel/exit.c index 892f38aeb0a4..4bffef9f3f46 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -67,6 +67,7 @@ #include #include #include +#include #include #include @@ -99,6 +100,25 @@ static __init int kernel_exit_sysctls_init(void) late_initcall(kernel_exit_sysctls_init); #endif +static atomic_t oops_count = ATOMIC_INIT(0); + +#ifdef CONFIG_SYSFS +static ssize_t oops_count_show(struct kobject *kobj, struct kobj_attribute *attr, + char *page) +{ + return sysfs_emit(page, "%d\n", atomic_read(&oops_count)); +} + +static struct kobj_attribute oops_count_attr = __ATTR_RO(oops_count); + +static __init int kernel_exit_sysfs_init(void) +{ + sysfs_add_file_to_group(kernel_kobj, &oops_count_attr.attr, NULL); + return 0; +} +late_initcall(kernel_exit_sysfs_init); +#endif + static void __unhash_process(struct task_struct *p, bool group_dead) { nr_threads--; @@ -901,8 +921,6 @@ void __noreturn do_exit(long code) void __noreturn make_task_dead(int signr) { - static atomic_t oops_count = ATOMIC_INIT(0); - /* * Take the task off the cpu after something catastrophic has * happened. From patchwork Wed Nov 9 20:00:47 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13038005 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69EE6C4332F for ; Wed, 9 Nov 2022 20:01:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231986AbiKIUA7 (ORCPT ); Wed, 9 Nov 2022 15:00:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51002 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231940AbiKIUA4 (ORCPT ); Wed, 9 Nov 2022 15:00:56 -0500 Received: from mail-pl1-x62f.google.com (mail-pl1-x62f.google.com [IPv6:2607:f8b0:4864:20::62f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E5F613DC6 for ; Wed, 9 Nov 2022 12:00:53 -0800 (PST) Received: by mail-pl1-x62f.google.com with SMTP id j12so18096955plj.5 for ; Wed, 09 Nov 2022 12:00:53 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=FoO8Qi1M2kCdIN6zHAfogLzoF2oQxJ0yZB573MhBfxM=; b=EhVqRQKR/J/E9Hb9pWPoBTGiGmmVJ15if/s/UHujP+rFedb22K9Y6uH+iHmOitVeRO IbY5kw5eRYyZCDWPS2Qe8qKzNu9QoCSNA3K73CvdAay+ive3yjMrD+Qw1dmLfEgCRCAV XdTFZWcHpuhwwmYoDWP8Y4MASNfDL/NPQYVYc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=FoO8Qi1M2kCdIN6zHAfogLzoF2oQxJ0yZB573MhBfxM=; b=uXn6kyGQTt7bTpw+JwOCVUFQ3Rb1+NpVAPf0A3fwE3lQGBJEeCu/CHyQzoEfjzVs88 3kqvOPspF0/SM636aCSEO0X1k72tK/468QkMkAjFPM9lUMOB1vTe9TG8w/Q6//IF/jRv wK2ym0K1JidGs5EdTfmJtvIRjeNcCFTcDwjKYk0YXA/BByQStRgfc7Kjq+H1CbaOafjE wW0PZ3eLyoVti5A9twokiW9xmLNeay4s6TvWtti0zbVtTE0Uo3YryJns1wRs/MMZL9xM 38vNPOV7Ofi+ISWwQbLQiGh1iGDhLSQLXk0YQOU1UQEPyG6Ujqji+OaeGFcqbRz9mjUl XZnA== X-Gm-Message-State: ACrzQf1bfdN2OpSNIw3Ncp/iInUWxWCDhphmAJkzcN6aWfDpPveZqO4G 0z9vPjnXjt3nH1ilyd5Ghoil4w== X-Google-Smtp-Source: AMsMyM7SeWAc8gpa4nrlnL+apd00+XFV1GPMSvpuDJMO2XLoGLkvHPOQwxYY2e+UQHUXm2NDDJDGjw== X-Received: by 2002:a17:902:ebc4:b0:186:b32c:4ce5 with SMTP id p4-20020a170902ebc400b00186b32c4ce5mr61507291plg.74.1668024052529; Wed, 09 Nov 2022 12:00:52 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id t3-20020a170902b20300b00186a8beec78sm9499392plr.52.2022.11.09.12.00.51 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Nov 2022 12:00:51 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Marco Elver , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , Andrew Morton , Luis Chamberlain , David Gow , tangmeng , Petr Mladek , "Paul E. McKenney" , Sebastian Andrzej Siewior , "Guilherme G. Piccoli" , Tiezhu Yang , kasan-dev@googlegroups.com, linux-mm@kvack.org, Greg KH , Linus Torvalds , Seth Jenkins , Andy Lutomirski , "Eric W. Biederman" , Arnd Bergmann , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 4/6] panic: Consolidate open-coded panic_on_warn checks Date: Wed, 9 Nov 2022 12:00:47 -0800 Message-Id: <20221109200050.3400857-4-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221109194404.gonna.558-kees@kernel.org> References: <20221109194404.gonna.558-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5558; h=from:subject; bh=VhZyajDguwXIOeRKKSSBP5ZVJr/iLJGDdjMef3dLzMw=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjbAbwCC8IljHAxeFaKkt0TLagUmeHw0bhuvd7ksR8 fg83TzSJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY2wG8AAKCRCJcvTf3G3AJifHEA CxHC8oBdRT9jmscKAq1CLjsng9Xu0W2++MH6aYtXPPh25LnNhXYdV9KUvaJjzFjqRkkI7X5f9hEATv 9nuFwmdAocHRelXYsa4bEIsLo/KYPVXuoagngmb7VfQcwJ84BzZAwvxcPH5Lkn1BJa6niOTpms388R 9rtIAL21U66N//NJHwbMuybr3RL+OGqIYN3Dl1jaggZMneQyFFBzuBDa5QZ0WG20DEvRLXEfPNUXZE byJiHgygyJNN5ng21MQ5yPhekwsLUFIR+9BXrupZBP9NH7lCWAW5a9fKMnIKKwOcG8hhfjcdMaBjb3 il3beRvwO4Fzrrw/8NDh12B5l5nd/fxNQK6bko4ILshXi/05VG308GEXdKecc9Y2EUAJB5aHVrKY0H NOK7XHUBeVeT70pDl7A76wtfe/2/ti5ukPfkzBOlblWr0swqFt210ZL05WDfZuNfRAzyxOtfU3lxnZ am+wMKJDx7OdRfhVEYGLVSaOinlE629WiO8FjhY7Ev3SHPoUOiRB+uJXcApTQYPFBS869SOiPmpt1w gaMKFf8mCAF4tclFqFV9nf9f0ORxE4YzFGmUuzSZFAVALBhH+1o+kbr3IlDU2hn0VyuYC2CDdAcNon 9Nwk+/4iG4f3rNqthjUpAvew2tvHiooY4Lp+2aA8LsYzaf05DNZtDkIKbTng== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll their own warnings, and each check "panic_on_warn". Consolidate this into a single function so that future instrumentation can be added in a single location. Cc: Marco Elver Cc: Dmitry Vyukov Cc: Peter Zijlstra Cc: Juri Lelli Cc: Vincent Guittot Cc: Dietmar Eggemann Cc: Steven Rostedt Cc: Ben Segall Cc: Mel Gorman Cc: Daniel Bristot de Oliveira Cc: Valentin Schneider Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Vincenzo Frascino Cc: Andrew Morton Cc: Luis Chamberlain Cc: David Gow Cc: tangmeng Cc: Jann Horn Cc: Petr Mladek Cc: "Paul E. McKenney" Cc: Sebastian Andrzej Siewior Cc: "Guilherme G. Piccoli" Cc: Tiezhu Yang Cc: kasan-dev@googlegroups.com Cc: linux-mm@kvack.org Signed-off-by: Kees Cook --- include/linux/panic.h | 1 + kernel/kcsan/report.c | 3 +-- kernel/panic.c | 9 +++++++-- kernel/sched/core.c | 3 +-- lib/ubsan.c | 3 +-- mm/kasan/report.c | 4 ++-- mm/kfence/report.c | 3 +-- 7 files changed, 14 insertions(+), 12 deletions(-) diff --git a/include/linux/panic.h b/include/linux/panic.h index c7759b3f2045..1702aeb74927 100644 --- a/include/linux/panic.h +++ b/include/linux/panic.h @@ -11,6 +11,7 @@ extern long (*panic_blink)(int state); __printf(1, 2) void panic(const char *fmt, ...) __noreturn __cold; void nmi_panic(struct pt_regs *regs, const char *msg); +void check_panic_on_warn(const char *reason); extern void oops_enter(void); extern void oops_exit(void); extern bool oops_may_print(void); diff --git a/kernel/kcsan/report.c b/kernel/kcsan/report.c index 67794404042a..e95ce7d7a76e 100644 --- a/kernel/kcsan/report.c +++ b/kernel/kcsan/report.c @@ -492,8 +492,7 @@ static void print_report(enum kcsan_value_change value_change, dump_stack_print_info(KERN_DEFAULT); pr_err("==================================================================\n"); - if (panic_on_warn) - panic("panic_on_warn set ...\n"); + check_panic_on_warn("KCSAN"); } static void release_report(unsigned long *flags, struct other_info *other_info) diff --git a/kernel/panic.c b/kernel/panic.c index 129936511380..3afd234767bc 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -201,6 +201,12 @@ static void panic_print_sys_info(bool console_flush) ftrace_dump(DUMP_ALL); } +void check_panic_on_warn(const char *reason) +{ + if (panic_on_warn) + panic("%s: panic_on_warn set ...\n", reason); +} + /** * panic - halt the system * @fmt: The text string to print @@ -619,8 +625,7 @@ void __warn(const char *file, int line, void *caller, unsigned taint, if (regs) show_regs(regs); - if (panic_on_warn) - panic("panic_on_warn set ...\n"); + check_panic_on_warn("kernel"); if (!regs) dump_stack(); diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 5800b0623ff3..285ef8821b4f 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -5729,8 +5729,7 @@ static noinline void __schedule_bug(struct task_struct *prev) pr_err("Preemption disabled at:"); print_ip_sym(KERN_ERR, preempt_disable_ip); } - if (panic_on_warn) - panic("scheduling while atomic\n"); + check_panic_on_warn("scheduling while atomic"); dump_stack(); add_taint(TAINT_WARN, LOCKDEP_STILL_OK); diff --git a/lib/ubsan.c b/lib/ubsan.c index 36bd75e33426..60c7099857a0 100644 --- a/lib/ubsan.c +++ b/lib/ubsan.c @@ -154,8 +154,7 @@ static void ubsan_epilogue(void) current->in_ubsan--; - if (panic_on_warn) - panic("panic_on_warn set ...\n"); + check_panic_on_warn("UBSAN"); } void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs) diff --git a/mm/kasan/report.c b/mm/kasan/report.c index df3602062bfd..cc98dfdd3ed2 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -164,8 +164,8 @@ static void end_report(unsigned long *flags, void *addr) (unsigned long)addr); pr_err("==================================================================\n"); spin_unlock_irqrestore(&report_lock, *flags); - if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) - panic("panic_on_warn set ...\n"); + if (!test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) + check_panic_on_warn("KASAN"); if (kasan_arg_fault == KASAN_ARG_FAULT_PANIC) panic("kasan.fault=panic set ...\n"); add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); diff --git a/mm/kfence/report.c b/mm/kfence/report.c index 7e496856c2eb..110c27ca597d 100644 --- a/mm/kfence/report.c +++ b/mm/kfence/report.c @@ -268,8 +268,7 @@ void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *r lockdep_on(); - if (panic_on_warn) - panic("panic_on_warn set ...\n"); + check_panic_on_warn("KFENCE"); /* We encountered a memory safety error, taint the kernel! */ add_taint(TAINT_BAD_PAGE, LOCKDEP_STILL_OK); From patchwork Wed Nov 9 20:00:48 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13038008 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3816C43219 for ; Wed, 9 Nov 2022 20:01:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231947AbiKIUBD (ORCPT ); Wed, 9 Nov 2022 15:01:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51066 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231996AbiKIUBA (ORCPT ); Wed, 9 Nov 2022 15:01:00 -0500 Received: from mail-pj1-x1031.google.com (mail-pj1-x1031.google.com [IPv6:2607:f8b0:4864:20::1031]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 23BF213D75 for ; Wed, 9 Nov 2022 12:00:56 -0800 (PST) Received: by mail-pj1-x1031.google.com with SMTP id k5so17694509pjo.5 for ; Wed, 09 Nov 2022 12:00:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=t5tPw3hkeTB324+bIPHjvhZ9LhWv7TTl0XHczdtESK4=; b=I1GTcHYtB8YdG9fl2OaQqVeKR34nKD1YdPrA64q7FsG6q2E6ffr69kJwfJMMOkJ/Sr odbQT5/HnpjggIyr9lMyFcumFpexhjb75nlj49y0dOhZmmrVi8y1b7uZXbpqcg4Su2oy nGrJzVFszBPQAQCAgRJRuuX+U+mRLq4h+Zkgs= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=t5tPw3hkeTB324+bIPHjvhZ9LhWv7TTl0XHczdtESK4=; b=vMdSiueo4cT3Ixze5kvKk40b9iwPdUkXCR6RzRzokDBFxEgxYubpLnJai1TlEI/WiJ rCAR1ms1/+i+9PIB1kfDd4Dn4RQljjeblGzJFztKe22sMfkotwyE83GkLBX9WT20U+Wr 8RQOPCpsmS30dctAPaqG00QT6PNWnIUESCZqR2E1pvHcSxhvPXvNBeiKGCiemiyKAiVA zeb/muixSj8p/EAGvtnhHQahAhj7PHHVUjepUKIIPd2RLbRog6Ej4Qfn5PLLKV7C8tFL 0sJX0cx3z9W207iYLbLp+heW443+qoYSe3z60IbR+b+2VtQwLf2Q5u/rsDA9W7VBPkGU +fCw== X-Gm-Message-State: ACrzQf1LcuvkWPhHeG8CNESp8JH3g+TRSDrwOF8/5G55JdnU0DsrPwL6 o7Y132prpUkwTmfHHMZfZ+gsXQ== X-Google-Smtp-Source: AMsMyM5SANqY078orgX6dY68ZUWThz6OawQG+ENCYzuNrVVACjjBb7dQsTuNuerSN/q+uZVcLFc7gQ== X-Received: by 2002:a17:903:40d2:b0:186:6f1d:608c with SMTP id t18-20020a17090340d200b001866f1d608cmr63246987pld.52.1668024055366; Wed, 09 Nov 2022 12:00:55 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id l5-20020a622505000000b0056be1581126sm8965936pfl.143.2022.11.09.12.00.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Nov 2022 12:00:54 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Jonathan Corbet , Andrew Morton , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Petr Mladek , tangmeng , "Guilherme G. Piccoli" , Tiezhu Yang , Sebastian Andrzej Siewior , linux-doc@vger.kernel.org, Greg KH , Linus Torvalds , Seth Jenkins , Andy Lutomirski , "Eric W. Biederman" , Arnd Bergmann , Marco Elver , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , Luis Chamberlain , David Gow , "Paul E. McKenney" , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 5/6] panic: Introduce warn_limit Date: Wed, 9 Nov 2022 12:00:48 -0800 Message-Id: <20221109200050.3400857-5-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221109194404.gonna.558-kees@kernel.org> References: <20221109194404.gonna.558-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2660; h=from:subject; bh=Rm+lJ6u++jsmLEQkzPRQ5ICHP8+KAUDhfRVS5zjHPJE=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjbAbwcHBlBplI6+7kNyZcKwP+Sml/277Z4LaSTf0u 9eRZjBiJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY2wG8AAKCRCJcvTf3G3AJh1aD/ 9xflRviDrYBqPld0yVa3h4GYZgnj9k/BudvGLDeZgQ06918EaiTlebzGcxbEnFK/Au8S4maFKSwALy TFXCJWRYa99rQHPpbupXdfXoEa5jCKoNbrmLRQfssWJeQK8sCfP2uSAsDa7MVpgHm3DdjJrDhPsGcj IKq2X6+Bp8tvNslJm2CGJGLmdxv8catsbbA4u3nnxUyVoC4TSGDGnT/0qgrcmjnzD7FgJ/0zzWkS/z JO9QWa92/1FFddRhRdTYL4i/Zb8DcTUf1Zs/FFAPPy2YVN5nDMdBZmnRfHu8MRnhCV6EvaIATcF1mv hzaDeqIB5a6IHWQt1o3fkIhnTClQpvKn5KGSbt3WdCQL3UIvDQyDPPb7SkleOAHv7JUtDilQwn0CI/ ITPXTBIFuT9wcUQISWWb5hK2LsGhlqoIVigQx1I35f+TLjd13Jb9Kw8BuOuFKWyY9jxsBKl0t7g5VQ 7RpZubqS/13Dn6lCOtASVrfQ4hBlefUop5zVkeIOa1td6YoKFEgu0wNjV19haFm/xfZLZkEbIkafel yZHFuA5KEjrUh9vxzO6KXOhJv9bya2JKJ37BPoZCdFEPtjynjSfxcICwraUUOg8KX06Yz/OVFnktJa GgDhFRMJXgvpB4ir9DCwhcXC2BmPk900nMHvxiJUihERg0jE+/9VpX8wHjIg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Like oops_limit, add warn_limit for limiting the number of warnings when panic_on_warn is not set. Cc: Jonathan Corbet Cc: Andrew Morton Cc: Baolin Wang Cc: "Jason A. Donenfeld" Cc: Eric Biggers Cc: Huang Ying Cc: Petr Mladek Cc: tangmeng Cc: "Guilherme G. Piccoli" Cc: Tiezhu Yang Cc: Sebastian Andrzej Siewior Cc: linux-doc@vger.kernel.org Signed-off-by: Kees Cook --- Documentation/admin-guide/sysctl/kernel.rst | 9 +++++++++ kernel/panic.c | 13 +++++++++++++ 2 files changed, 22 insertions(+) diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index 09f3fb2f8585..c385d5319cdf 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -1508,6 +1508,15 @@ entry will default to 2 instead of 0. 2 Unprivileged calls to ``bpf()`` are disabled = ============================================================= + +warn_limit +========== + +Number of kernel warnings after which the kernel should panic when +``panic_on_warn`` is not set. Setting this to 0 or 1 has the same effect +as setting ``panic_on_warn=1``. + + watchdog ======== diff --git a/kernel/panic.c b/kernel/panic.c index 3afd234767bc..b235fa4a6fc8 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -58,6 +58,7 @@ bool crash_kexec_post_notifiers; int panic_on_warn __read_mostly; unsigned long panic_on_taint; bool panic_on_taint_nousertaint = false; +static unsigned int warn_limit __read_mostly = 10000; int panic_timeout = CONFIG_PANIC_TIMEOUT; EXPORT_SYMBOL_GPL(panic_timeout); @@ -88,6 +89,13 @@ static struct ctl_table kern_panic_table[] = { .extra2 = SYSCTL_ONE, }, #endif + { + .procname = "warn_limit", + .data = &warn_limit, + .maxlen = sizeof(warn_limit), + .mode = 0644, + .proc_handler = proc_douintvec, + }, { } }; @@ -203,8 +211,13 @@ static void panic_print_sys_info(bool console_flush) void check_panic_on_warn(const char *reason) { + static atomic_t warn_count = ATOMIC_INIT(0); + if (panic_on_warn) panic("%s: panic_on_warn set ...\n", reason); + + if (atomic_inc_return(&warn_count) >= READ_ONCE(warn_limit)) + panic("Warned too often (warn_limit is %d)", warn_limit); } /** From patchwork Wed Nov 9 20:00:49 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13038009 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B713C433FE for ; Wed, 9 Nov 2022 20:01:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231996AbiKIUBF (ORCPT ); Wed, 9 Nov 2022 15:01:05 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51072 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232007AbiKIUBA (ORCPT ); Wed, 9 Nov 2022 15:01:00 -0500 Received: from mail-pj1-x1033.google.com (mail-pj1-x1033.google.com [IPv6:2607:f8b0:4864:20::1033]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D1C12F00C for ; Wed, 9 Nov 2022 12:00:56 -0800 (PST) Received: by mail-pj1-x1033.google.com with SMTP id m6-20020a17090a5a4600b00212f8dffec9so2979118pji.0 for ; Wed, 09 Nov 2022 12:00:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=ro0afIwumapgwWvmG1YsaLR3d/PQtiJimII64ZaFtl0=; b=Bj6yZrGQoXcj6tNclOshbH3J9egAhjRfmkDStPVklR9XEa2v3+3RdklXH8z9cfK7y6 PPcmlkc0mboBMbnoQZtz+vYF6J+Wi51E/b/I8emu9c/PT+P5E72HPuJEYseo44GJfTjC LNoK4lTry2eXlMd8D+D4AHavtEoQuosMVMq10= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=ro0afIwumapgwWvmG1YsaLR3d/PQtiJimII64ZaFtl0=; b=gDiqcS3Xg3sB5P2Ag3KZLvm1F75YSCuxJQNroZWCpEiU799r0h7nXp2sMMurYEtDaH IwQHRjiaE0GrCuN7QxX78I4Ouj1Pi+gsI3xRrmu4ilLaSALuHfXNfiiiyiFnNzh0Tl2Y xcZj54VtbJlk9/4KDT1U9pW2+c7J32M9U5U/Q/R7EMX1CIGur6zRf99fCWpGhTjrrXbt S++a5ja7xoqQBC4x/COdp80lhDtYlfGjdcEQkq5sCHvx+XPi45nkxPAbwkSyg1fg41Xp I6bF7Mz8sC3xRNgjm3IGln2tIfDwhme8ZhcWtqS/yn4e6qdsIYm2gEdlcyYjLtBE8OJe 3hNQ== X-Gm-Message-State: ACrzQf1IzmR8hwIS3v547EJHIL+emzkHjRHnYt1/flqnVisn8M/lLSt+ izc9P2w2L4vcsVSUa/4uJnuC2w== X-Google-Smtp-Source: AMsMyM6s+8KZY3HwZ2NBLRKmVoBPCut+WPXxEXFmTLrSqQTqHLCi1hv7jT0ImlockAyWwGGLZF71bw== X-Received: by 2002:a17:902:edd5:b0:187:1e83:8b96 with SMTP id q21-20020a170902edd500b001871e838b96mr54187822plk.1.1668024055895; Wed, 09 Nov 2022 12:00:55 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id bf20-20020a17090b0b1400b0020ad53b5883sm1639166pjb.14.2022.11.09.12.00.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 09 Nov 2022 12:00:54 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Petr Mladek , Andrew Morton , tangmeng , "Guilherme G. Piccoli" , Sebastian Andrzej Siewior , Tiezhu Yang , Greg KH , Linus Torvalds , Seth Jenkins , Andy Lutomirski , "Eric W. Biederman" , Arnd Bergmann , Marco Elver , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , Luis Chamberlain , David Gow , "Paul E. McKenney" , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v2 6/6] panic: Expose "warn_count" to sysfs Date: Wed, 9 Nov 2022 12:00:49 -0800 Message-Id: <20221109200050.3400857-6-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221109194404.gonna.558-kees@kernel.org> References: <20221109194404.gonna.558-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3046; h=from:subject; bh=crjf/DqHlmowr17FD7/hL69h8FPT+JeC7P8wT4Sy3y8=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjbAbwTj82NH1mVc/BdwILXJUeaZUer5Kuv1KXHcsT gLf80RyJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY2wG8AAKCRCJcvTf3G3AJqs9D/ 44ACl1LNxgKhWqINCpUTjTgHQ0kvWjIPxs52zdEdrIVDv2BZZ/DhUpxrcC730QQtcJ6F7xe3UlmePB 3hKgSYaj13nxQyS3P9cvMUtbFrQj7cCWQ8v2Q4xYikQw5hnl76PZNNLk9JRzNurPZykchYWXpIrXDt yPp0o/bmBoaDGuwOBGLA3ZcGPZgVtS3734GCjfABnwjPchjreV8dXC7sLPVxx1MAcgHOKuqoYRTcfZ sqZKqkLm9KLO/nZ5dm5UtR/R6AljYC5Y1uxCfYNkicYlrzReWZefDGPaBPR/ZQ68eDwIUiGSi8G9cz 6S9Jy7hFaGQGgsxyLMJQwKOVFoLDLpm6q2HbyNVp2Cenh5utpS6/TVtvR9OqFo+7w1UPBi0z1Hczye 6qKolXHZNNv70gNEN8fXOJGu0vqBZAEaSYp5YvkGnnymFY5tMIOG2FM+dJ1Rh3eFx1KoKh5/8uWgLP zR9Vl5PP3Wi27coL560UkZve06uP7FO8GZnRBiPLpOxZw7AGp1jlCAXOn28uBrDybJAvFxZt1W5emj 6AfqaB0D26hF55T8TAlhjp8jtR0Nk247ofFgCq/h7fshmRCFK94izJo05cL5SWAJFlphsHH6pYPpk/ 9L8qhMC3W+qJVj26D2+kYfHGTR7ruMYJ2UqU1p94HQJ4R8tORQAiouOk+uWA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Since Warn count is now tracked and is a fairly interesting signal, add the entry /sys/kernel/warn_count to expose it to userspace. Cc: Petr Mladek Cc: Andrew Morton Cc: tangmeng Cc: "Guilherme G. Piccoli" Cc: Sebastian Andrzej Siewior Cc: Tiezhu Yang Signed-off-by: Kees Cook --- .../ABI/testing/sysfs-kernel-warn_count | 6 +++++ MAINTAINERS | 1 + kernel/panic.c | 22 +++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-warn_count diff --git a/Documentation/ABI/testing/sysfs-kernel-warn_count b/Documentation/ABI/testing/sysfs-kernel-warn_count new file mode 100644 index 000000000000..08f083d2fd51 --- /dev/null +++ b/Documentation/ABI/testing/sysfs-kernel-warn_count @@ -0,0 +1,6 @@ +What: /sys/kernel/oops_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List +Description: + Shows how many times the system has Warned since last boot. diff --git a/MAINTAINERS b/MAINTAINERS index 0a1e95a58e54..282cd8a513fd 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -11107,6 +11107,7 @@ L: linux-hardening@vger.kernel.org S: Supported T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening F: Documentation/ABI/testing/sysfs-kernel-oops_count +F: Documentation/ABI/testing/sysfs-kernel-warn_count F: include/linux/overflow.h F: include/linux/randomize_kstack.h F: mm/usercopy.c diff --git a/kernel/panic.c b/kernel/panic.c index b235fa4a6fc8..ddf0f8956d6e 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include @@ -107,6 +108,25 @@ static __init int kernel_panic_sysctls_init(void) late_initcall(kernel_panic_sysctls_init); #endif +static atomic_t warn_count = ATOMIC_INIT(0); + +#ifdef CONFIG_SYSFS +static ssize_t warn_count_show(struct kobject *kobj, struct kobj_attribute *attr, + char *page) +{ + return sysfs_emit(page, "%d\n", atomic_read(&warn_count)); +} + +static struct kobj_attribute warn_count_attr = __ATTR_RO(warn_count); + +static __init int kernel_panic_sysfs_init(void) +{ + sysfs_add_file_to_group(kernel_kobj, &warn_count_attr.attr, NULL); + return 0; +} +late_initcall(kernel_panic_sysfs_init); +#endif + static long no_blink(int state) { return 0; @@ -211,8 +231,6 @@ static void panic_print_sys_info(bool console_flush) void check_panic_on_warn(const char *reason) { - static atomic_t warn_count = ATOMIC_INIT(0); - if (panic_on_warn) panic("%s: panic_on_warn set ...\n", reason);