From patchwork Thu Nov 17 23:43:21 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13047484 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 426C9C4332F for ; Thu, 17 Nov 2022 23:43:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239843AbiKQXnd (ORCPT ); Thu, 17 Nov 2022 18:43:33 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234063AbiKQXnc (ORCPT ); Thu, 17 Nov 2022 18:43:32 -0500 Received: from mail-pj1-x1031.google.com (mail-pj1-x1031.google.com [IPv6:2607:f8b0:4864:20::1031]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 384B360F9 for ; Thu, 17 Nov 2022 15:43:30 -0800 (PST) Received: by mail-pj1-x1031.google.com with SMTP id v4-20020a17090a088400b00212cb0ed97eso3476189pjc.5 for ; Thu, 17 Nov 2022 15:43:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=oZAyTYmNqDqjhiVXCbn/iUUPGOe7A4x1iLp5SSq3M+Y=; b=dLZRKPT5/7kx0TlEiZlNB+Bsy9MykCBzKuYvbf+8/d1f6JvHA95KD9yWjQ7NUiaK9U ltEsZgLLEbUiTwbrbPyy6lXrjWCmu0gC3RhGlwHRH0yyW/HaeOrAZGhMncVoFTbs5K1S u/OTX3D96+lxdOUPshdERc3h+34GJk/uYpU9k= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=oZAyTYmNqDqjhiVXCbn/iUUPGOe7A4x1iLp5SSq3M+Y=; b=wnDuKFZWfyva/N1nOk/D70Z5whIzcj2eXwYmgm08eJfsM/btYgKaaSqYsfaRze1cNO 4RxO67KhiVMkL3PlLB0LRxe0yY2gl8m/eXfZZpWGSYJHvM0z+LkHDaf4/MVqDYt1fyDh goP6zsR2CKcyB4Q5hxaZhkQQAkO+cYvlIrSQ/uuCuWOwVAHpG0C2XVfiRJFhVF9mDBkE Lqou9qXaattRV1hQlxOl9uzCJ5jkAQeQah3fCfX5IxOjNIDBcw8NoKOjPG9jOIBKs+2E /nXM+kJhcZByWbXThyFS50ZHTzehSFiFITnBV4XFtbkxzJiiJ2fwCthpWffhsilUylhs Bzuw== X-Gm-Message-State: ANoB5pkI3TNi8jP1STgcZyj2QpWBHmMfqjr1Bhf6UKkxj2r8xaSULyrx p0G8e7EL3TCAcjFlhaTBJa7Eog== X-Google-Smtp-Source: AA0mqf7bGaPbQBrK6tbmbhHYb+m32ki2iXpenM8TbT/Nda2AQsswz2Zx8KwCbvhgBsQ3yTreZUvBTA== X-Received: by 2002:a17:903:1c2:b0:182:631a:ef28 with SMTP id e2-20020a17090301c200b00182631aef28mr4854752plh.46.1668728609730; Thu, 17 Nov 2022 15:43:29 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id t15-20020a1709027fcf00b00186a8085382sm777889plb.43.2022.11.17.15.43.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Nov 2022 15:43:29 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Petr Mladek , Andrew Morton , tangmeng , "Guilherme G. Piccoli" , Tiezhu Yang , Sebastian Andrzej Siewior , Luis Chamberlain , Seth Jenkins , Greg KH , Linus Torvalds , Andy Lutomirski , "Eric W. Biederman" , Arnd Bergmann , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , David Gow , "Paul E. McKenney" , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v3 1/6] panic: Separate sysctl logic from CONFIG_SMP Date: Thu, 17 Nov 2022 15:43:21 -0800 Message-Id: <20221117234328.594699-1-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221117233838.give.484-kees@kernel.org> References: <20221117233838.give.484-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1240; h=from:subject; bh=MYCrkHw9R8LxDYIRQQdTTq6YEsTSsq26SRgNezbmUEc=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjdsccw0YheOkdHY6sLAGx2i/EwJzpirGYe5KFf1J2 O3NKspCJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY3bHHAAKCRCJcvTf3G3AJjQmD/ 9UudpK/LjYQqgT+uDSinOff7b8X/IOatcfoEVeqxjwXnW5g1w8/uvDchyE3AXUMKMSqUL9wlcA2YXY 9FsQwXAM9SiZxvpzbNCULf1J9dLOyGZpct/rt6MSKpGwRSboVh0q5IKCPpt527XqaY7ei1zE4MGiam 4eFnNJQKnOeU1nSKPj5C9V3FwStWVScAeP+eeWYhLytRpj+AVZ65/N4hdvCBK+rdV6a4k8uvS2o1bc VPNDgNxBbJIEn99M4tO00reM1b8JeS0x3kiCpL01KE2rYCeYC3Y5qFbAz1yj7TQZuDivhvVAgEXYTZ NDMeu733A70XHkm9eLHey8Sxdt+a59iiTDijcBqgOsjqMI67Xdt+mVA4MezxNn8c7TDJMukp7vYHgX 7w30Ut4mulgDUtaSbDBIDC4K8BJ8oInCdVm95U2j9U02tg0CltGRlNZXtdr66ydcPFz+lJUS53O9w4 bwCG83c270M7bk/bmJBKGbtETZLb2agP21esArCedrmGjWFHD9oKCEguHLI18J99mQ0kXvsA7yGkjq /Shb8v/SxobU3/gQ+OIl1a/paUZr1PmFr9F9y6PQ5NUfzucIpmrys6aUhc29wrFnuH1aiuyTroVlhx BkC9tCUjIlr2fuDrSQdTWWKaCmXp0MpZ8IUofmDmVX3pbG53VF2v2STqkKTA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org In preparation for adding more sysctls directly in kernel/panic.c, split CONFIG_SMP from the logic that adds sysctls. Cc: Petr Mladek Cc: Andrew Morton Cc: tangmeng Cc: "Guilherme G. Piccoli" Cc: Tiezhu Yang Cc: Sebastian Andrzej Siewior Reviewed-by: Luis Chamberlain Signed-off-by: Kees Cook --- kernel/panic.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/panic.c b/kernel/panic.c index da323209f583..d843d036651e 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -75,8 +75,9 @@ ATOMIC_NOTIFIER_HEAD(panic_notifier_list); EXPORT_SYMBOL(panic_notifier_list); -#if defined(CONFIG_SMP) && defined(CONFIG_SYSCTL) +#ifdef CONFIG_SYSCTL static struct ctl_table kern_panic_table[] = { +#ifdef CONFIG_SMP { .procname = "oops_all_cpu_backtrace", .data = &sysctl_oops_all_cpu_backtrace, @@ -86,6 +87,7 @@ static struct ctl_table kern_panic_table[] = { .extra1 = SYSCTL_ZERO, .extra2 = SYSCTL_ONE, }, +#endif { } }; From patchwork Thu Nov 17 23:43:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13047486 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A98F0C4321E for ; Thu, 17 Nov 2022 23:43:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240260AbiKQXni (ORCPT ); Thu, 17 Nov 2022 18:43:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239416AbiKQXnd (ORCPT ); Thu, 17 Nov 2022 18:43:33 -0500 Received: from mail-pl1-x62b.google.com (mail-pl1-x62b.google.com [IPv6:2607:f8b0:4864:20::62b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C522A44E for ; Thu, 17 Nov 2022 15:43:31 -0800 (PST) Received: by mail-pl1-x62b.google.com with SMTP id k7so3078028pll.6 for ; Thu, 17 Nov 2022 15:43:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=lmIZZc21Vqw+ah0v9NZF0i5NZ6eVMCNaXJnOrpu6AVc=; b=Yrj5IFrDvbUZ3Yvcoww5ZxD9/vtv8JQAnR+pht+KQwLqqHXthMcS0yvQmCr+eNVO9f o6LbrbHFtt/SytHCo4KpaWV397L63RMWGED1Hs8t8YbB/ZISoD9PQxa5W7Z+rJ/EJ1vv DLJA5t4SrLk0wKYJE+jlGYm37CcLrDtO27/Xo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=lmIZZc21Vqw+ah0v9NZF0i5NZ6eVMCNaXJnOrpu6AVc=; b=UnnlZqp6Of3stRXwwNssYM3fMcRcCSWDoyxQCt5tiMnCGRkepXfGKklNEjNrikbTU2 gczVCYy2Oh68qIePXmivzjzn0baYKHgcSGapfh7wrQPmKFOv50Y/b25WEvtFFJ+9qlMz j0/StIqLd5rz0m8xIYyShEQMiPRwz8QKgH/ubc3gnDA/qdLoi/guNIZ/+PcyqwPTsc6/ 7kvmW/tvdgHETJwFTUPZhLhBGtwp7SkIj1L0DA8pOPUX8Gyf7pVBkOJCimaFlXCDONn/ Z5IGfVz3wYops5RXOI7NTWPZAP9DLGksiHGXgAbYyozb99X//lajkhOdwxru4UuOUFFj eOXA== X-Gm-Message-State: ANoB5pnXNiP2wiy6ZJsM5n+MwiAF3ZSmyYOLP4Y/ukX7GRlgE6StBDuk /nrj7LVO8T6GMCJ+KWmrLlWrMA== X-Google-Smtp-Source: AA0mqf7s/asEdnHkCrNi5YFesuLIeRxumx7zAhOgO328FmhLx3/DrF0ZZE+OszS5js75jDXYCsHOtQ== X-Received: by 2002:a17:90a:710b:b0:218:725:c820 with SMTP id h11-20020a17090a710b00b002180725c820mr5027614pjk.170.1668728610498; Thu, 17 Nov 2022 15:43:30 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id r16-20020aa79890000000b005627d995a36sm1726716pfl.44.2022.11.17.15.43.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Nov 2022 15:43:29 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Luis Chamberlain , Seth Jenkins , Greg KH , Linus Torvalds , Andy Lutomirski , Andrew Morton , tangmeng , "Guilherme G. Piccoli" , Tiezhu Yang , Sebastian Andrzej Siewior , "Eric W. Biederman" , Arnd Bergmann , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , David Gow , "Paul E. McKenney" , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v3 2/6] exit: Put an upper limit on how often we can oops Date: Thu, 17 Nov 2022 15:43:22 -0800 Message-Id: <20221117234328.594699-2-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221117233838.give.484-kees@kernel.org> References: <20221117233838.give.484-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5376; i=keescook@chromium.org; h=from:subject; bh=bLKz0AsFfkmjD/QLdbw/QzipPdep0rPypPtLzjq9ZTA=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjdsccBvLQ6nT8J4vcb5go4xzTn7/5z8tY/5Q7hcSb zMPNB62JAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY3bHHAAKCRCJcvTf3G3AJpL1D/ oDk0k/qwVU9AOH7rJGYOAx8NIIF3c/+tKzCgbmUMHK8vTPitK9TmPTBdDT8RMWympaOJTlnGEyWEVZ qi89p2iZ/Ly7IkmOAm+XKeqt8Id7PBkvGfQ0S6hOJBU3vL9QiovG/ZBvBdaEjtezeuVa0K/njRUL8P IBXJMNwV1PaowE45g/K64RUmABpgQ6n/KmAcw61aJpDNRZS4WGzG7aXI3ZPYe9Jcrz8omNZM72o0sX lEvUNN1yHpHmGp9fsPIFzkQoW4QVRqRrxy8CUljllnNQzVo/03L4fA+cR1+RaTlnxwHiQ87T/32JP4 EmX6r4WjI21FvqTknthuTLg9BmgmB+TWSDDW/LnEIMcOY1vr4QymYzhycPxn1PK6WGkO8REkW+K1+O 4GwWjG895xklsuozUg/QU/iwbkRsvGxC4vSkT8qQBHVw7MAkISN+OkpAvxQg6gLZvyZlZC2zO2xMF5 VwiQFlFr6vuL9CMz+kBo68TOCs9iXuaYHRt0TnWcIel+zE9fZA0Mq72SGUglEf2cY6nqIlFNuBN8qe Vu1/C460YPWW9/d9EunqPkl3UUbL5qeCuR0jBraE02NNA1ta4jWs9BV7HenTQCni0j+clechmslpPH O1ShX8omxLAY2xC0IUAtMKY7RMIISZYapZnKNO18Lbo0S9i1uvATRGJhFHSw== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org From: Jann Horn Many Linux systems are configured to not panic on oops; but allowing an attacker to oops the system **really** often can make even bugs that look completely unexploitable exploitable (like NULL dereferences and such) if each crash elevates a refcount by one or a lock is taken in read mode, and this causes a counter to eventually overflow. The most interesting counters for this are 32 bits wide (like open-coded refcounts that don't use refcount_t). (The ldsem reader count on 32-bit platforms is just 16 bits, but probably nobody cares about 32-bit platforms that much nowadays.) So let's panic the system if the kernel is constantly oopsing. The speed of oopsing 2^32 times probably depends on several factors, like how long the stack trace is and which unwinder you're using; an empirically important one is whether your console is showing a graphical environment or a text console that oopses will be printed to. In a quick single-threaded benchmark, it looks like oopsing in a vfork() child with a very short stack trace only takes ~510 microseconds per run when a graphical console is active; but switching to a text console that oopses are printed to slows it down around 87x, to ~45 milliseconds per run. (Adding more threads makes this faster, but the actual oops printing happens under &die_lock on x86, so you can maybe speed this up by a factor of around 2 and then any further improvement gets eaten up by lock contention.) It looks like it would take around 8-12 days to overflow a 32-bit counter with repeated oopsing on a multi-core X86 system running a graphical environment; both me (in an X86 VM) and Seth (with a distro kernel on normal hardware in a standard configuration) got numbers in that ballpark. 12 days aren't *that* short on a desktop system, and you'd likely need much longer on a typical server system (assuming that people don't run graphical desktop environments on their servers), and this is a *very* noisy and violent approach to exploiting the kernel; and it also seems to take orders of magnitude longer on some machines, probably because stuff like EFI pstore will slow it down a ton if that's active. Signed-off-by: Jann Horn Link: https://lore.kernel.org/r/20221107201317.324457-1-jannh@google.com Reviewed-by: Luis Chamberlain Signed-off-by: Kees Cook --- Documentation/admin-guide/sysctl/kernel.rst | 8 ++++ kernel/exit.c | 42 +++++++++++++++++++++ 2 files changed, 50 insertions(+) diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index 98d1b198b2b4..09f3fb2f8585 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -667,6 +667,14 @@ This is the default behavior. an oops event is detected. +oops_limit +========== + +Number of kernel oopses after which the kernel should panic when +``panic_on_oops`` is not set. Setting this to 0 or 1 has the same effect +as setting ``panic_on_oops=1``. + + osrelease, ostype & version =========================== diff --git a/kernel/exit.c b/kernel/exit.c index 35e0a31a0315..799c5edd6be6 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -72,6 +72,33 @@ #include #include +/* + * The default value should be high enough to not crash a system that randomly + * crashes its kernel from time to time, but low enough to at least not permit + * overflowing 32-bit refcounts or the ldsem writer count. + */ +static unsigned int oops_limit = 10000; + +#if CONFIG_SYSCTL +static struct ctl_table kern_exit_table[] = { + { + .procname = "oops_limit", + .data = &oops_limit, + .maxlen = sizeof(oops_limit), + .mode = 0644, + .proc_handler = proc_douintvec, + }, + { } +}; + +static __init int kernel_exit_sysctls_init(void) +{ + register_sysctl_init("kernel", kern_exit_table); + return 0; +} +late_initcall(kernel_exit_sysctls_init); +#endif + static void __unhash_process(struct task_struct *p, bool group_dead) { nr_threads--; @@ -874,6 +901,8 @@ void __noreturn do_exit(long code) void __noreturn make_task_dead(int signr) { + static atomic_t oops_count = ATOMIC_INIT(0); + /* * Take the task off the cpu after something catastrophic has * happened. @@ -897,6 +926,19 @@ void __noreturn make_task_dead(int signr) preempt_count_set(PREEMPT_ENABLED); } + /* + * Every time the system oopses, if the oops happens while a reference + * to an object was held, the reference leaks. + * If the oops doesn't also leak memory, repeated oopsing can cause + * reference counters to wrap around (if they're not using refcount_t). + * This means that repeated oopsing can make unexploitable-looking bugs + * exploitable through repeated oopsing. + * To make sure this can't happen, place an upper bound on how often the + * kernel may oops without panic(). + */ + if (atomic_inc_return(&oops_count) >= READ_ONCE(oops_limit)) + panic("Oopsed too often (kernel.oops_limit is %d)", oops_limit); + /* * We're taking recursive faults here in make_task_dead. Safest is to just * leave this task alone and wait for reboot. From patchwork Thu Nov 17 23:43:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13047487 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4D35AC4167B for ; Thu, 17 Nov 2022 23:43:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231274AbiKQXnj (ORCPT ); Thu, 17 Nov 2022 18:43:39 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47146 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239672AbiKQXnd (ORCPT ); Thu, 17 Nov 2022 18:43:33 -0500 Received: from mail-pf1-x435.google.com (mail-pf1-x435.google.com [IPv6:2607:f8b0:4864:20::435]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 115BCAE56 for ; Thu, 17 Nov 2022 15:43:31 -0800 (PST) Received: by mail-pf1-x435.google.com with SMTP id k22so3302210pfd.3 for ; Thu, 17 Nov 2022 15:43:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=jEctX2gK/ElW3R9ceKOIZ71qq6p0GHil0cFCvNxx9OU=; b=g/cPhiEF39Jvwi7g1+Xq/pr38nMj44Nu7s3aqvgVZ1DuDpYFoo3QSUKLFZp+RMwqwL g5oKfoC/3yNkyhPPEKYdkg/utc2TP4MAjs/KblO7vXyah7+sZr2ylyYvIb8fIxIUDBNi KVyAxBdO6D26J0+lG5kgCcL5Y7eu/9gjkucTM= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=jEctX2gK/ElW3R9ceKOIZ71qq6p0GHil0cFCvNxx9OU=; b=lqMzQVJ2nh4ZXzzL4xQqhMpvXGIEfRh/LT80bSxCrvp7esOf/5mrT5neAVwx/TTErp 41R/EJlIE2zgbWv44fj6YsSNb1FZ+bWdtmGuCHL5kxIVMXATi22C/0n8Oe4aTJiqayPc PYnEpUW/2W0vaV0TpEA2O9mNSGpcZTLZ9ZXFkGxFDWiKyF1mlfTjwxaUucpLO97LQCAa WovGtUwNzGdHHzgcyzDKIyTTdZny7UZCFlUvNgP735OU+JDHdbZi6E5L6s/iYtzNzLw0 SlqHW8981EzOe7X83D7/2ryZVg+nmNuGTfDaoYk6ak9Erg2CrK85UJYDpLe2dMnYMiCj 8guQ== X-Gm-Message-State: ANoB5pnLRfkPplTkJp9bXhR5KMzI2/o2nk/hN64/LlLiBgT4ZWPl/8Se k5XQW8JPxZH9TemcPdJ9EKkWnw== X-Google-Smtp-Source: AA0mqf4M/o7GhXpsftplQmBpm+8mjuCK9Jc0JOK5XP71hY2vvCFVWcsgoDClF4tpNfGyM5thbqjLnQ== X-Received: by 2002:aa7:92d3:0:b0:571:fa1d:85b7 with SMTP id k19-20020aa792d3000000b00571fa1d85b7mr5205770pfa.39.1668728611497; Thu, 17 Nov 2022 15:43:31 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id a27-20020aa794bb000000b0056e8eb09d57sm1740441pfl.63.2022.11.17.15.43.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Nov 2022 15:43:29 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , "Eric W. Biederman" , Arnd Bergmann , Luis Chamberlain , Seth Jenkins , Greg KH , Linus Torvalds , Andy Lutomirski , Andrew Morton , tangmeng , "Guilherme G. Piccoli" , Tiezhu Yang , Sebastian Andrzej Siewior , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , David Gow , "Paul E. McKenney" , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v3 3/6] exit: Expose "oops_count" to sysfs Date: Thu, 17 Nov 2022 15:43:23 -0800 Message-Id: <20221117234328.594699-3-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221117233838.give.484-kees@kernel.org> References: <20221117233838.give.484-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2942; h=from:subject; bh=6N9/v4YXpaCj0jy2bGs74rqpXsiLoI6QvjFrvLVEdiU=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjdscdh2yxsYpUSBCFMx+XWPrp5jq3lGnveBJJoWti eB8Nl9WJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY3bHHQAKCRCJcvTf3G3AJjt4EA CjpotPoy23FlY4Qe6SzOgM/fewK8Qusqvop3tumZYb1OmUZ3CgaaTE15vdIUaf/nsyYtA1FhiPGV/U YQy1UTWXdQA2wt++NQZfMTdEMdmBItLvn+FAGrDmZpojr50i2xvPqQ4ZlTzhRzMA4NgWg+La/tm6rj rrsKc6k4YwSUes7KJWCF2R81GXMgfp2I13qsOUoqTmeeoWTkj9NQDzd+tbrjQ3C4gdqQUywUnDjZth U2HhrYciP9QXml569OiVFVdJqdk5r06EornXt5+0ffDu464SSxJdveFq11X9OGsM93M1T0Ct0tTfTD jCaFKZm4SdH8BPjWDdZd8WV1oscg2YS+C0ZlJ1IIHmRbDOeyPpsZyHgSzry1ErZrI++9xrESX6Rnk9 WFfS6UoZwKN6RXQFCh8dszPl/D23nHXp0TcN9D352o4kt4QnP8NrMRHB2c4akAbPZVmrBJrWhTFS7A IFJforSkglRfDq1Q4pY+zYhYCHA0IcvyOXU8zHLrw3SiT79IM/ELZb5Vif026dvQAFGc2H2zhqtJsA IPMHAhfLn32+WmGmgb3y8FYwiPnuNtRPq3hPthUqpNGpteOifZBwly3+o0FnPEoLYzAIRHq5tDL10c Sq+p7wxTwnoc9TVGptRmQKHqr92CO9QKe0gKg2UpDHcOAlTJ5znFcTS2wcxQ== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Since Oops count is now tracked and is a fairly interesting signal, add the entry /sys/kernel/oops_count to expose it to userspace. Cc: "Eric W. Biederman" Cc: Jann Horn Cc: Arnd Bergmann Reviewed-by: Luis Chamberlain Signed-off-by: Kees Cook --- .../ABI/testing/sysfs-kernel-oops_count | 6 +++++ MAINTAINERS | 1 + kernel/exit.c | 22 +++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-oops_count diff --git a/Documentation/ABI/testing/sysfs-kernel-oops_count b/Documentation/ABI/testing/sysfs-kernel-oops_count new file mode 100644 index 000000000000..156cca9dbc96 --- /dev/null +++ b/Documentation/ABI/testing/sysfs-kernel-oops_count @@ -0,0 +1,6 @@ +What: /sys/kernel/oops_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List +Description: + Shows how many times the system has Oopsed since last boot. diff --git a/MAINTAINERS b/MAINTAINERS index 1cd80c113721..0a1e95a58e54 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -11106,6 +11106,7 @@ M: Kees Cook L: linux-hardening@vger.kernel.org S: Supported T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening +F: Documentation/ABI/testing/sysfs-kernel-oops_count F: include/linux/overflow.h F: include/linux/randomize_kstack.h F: mm/usercopy.c diff --git a/kernel/exit.c b/kernel/exit.c index 799c5edd6be6..bc62bfe75bc7 100644 --- a/kernel/exit.c +++ b/kernel/exit.c @@ -67,6 +67,7 @@ #include #include #include +#include #include #include @@ -99,6 +100,25 @@ static __init int kernel_exit_sysctls_init(void) late_initcall(kernel_exit_sysctls_init); #endif +static atomic_t oops_count = ATOMIC_INIT(0); + +#ifdef CONFIG_SYSFS +static ssize_t oops_count_show(struct kobject *kobj, struct kobj_attribute *attr, + char *page) +{ + return sysfs_emit(page, "%d\n", atomic_read(&oops_count)); +} + +static struct kobj_attribute oops_count_attr = __ATTR_RO(oops_count); + +static __init int kernel_exit_sysfs_init(void) +{ + sysfs_add_file_to_group(kernel_kobj, &oops_count_attr.attr, NULL); + return 0; +} +late_initcall(kernel_exit_sysfs_init); +#endif + static void __unhash_process(struct task_struct *p, bool group_dead) { nr_threads--; @@ -901,8 +921,6 @@ void __noreturn do_exit(long code) void __noreturn make_task_dead(int signr) { - static atomic_t oops_count = ATOMIC_INIT(0); - /* * Take the task off the cpu after something catastrophic has * happened. From patchwork Thu Nov 17 23:43:24 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13047488 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01F37C4332F for ; Thu, 17 Nov 2022 23:43:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234724AbiKQXnk (ORCPT ); Thu, 17 Nov 2022 18:43:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234063AbiKQXnf (ORCPT ); Thu, 17 Nov 2022 18:43:35 -0500 Received: from mail-pf1-x42e.google.com (mail-pf1-x42e.google.com [IPv6:2607:f8b0:4864:20::42e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1122DAE44 for ; Thu, 17 Nov 2022 15:43:31 -0800 (PST) Received: by mail-pf1-x42e.google.com with SMTP id g62so3280713pfb.10 for ; Thu, 17 Nov 2022 15:43:31 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=a4mv3CX5gtAvBGKnmAgdVfBbS+bjuaYuEHlpManO9ok=; b=JAmzMP7DHtpsgJrcaJHLEpivCHt+540eE4yAZ5LJaET3wNe6tiPOo14LNAJvUu9+h1 4sJl5Cz3EV9NV5pLmLvQohZFFQYsEhRan8JkLl0nGrn4Yf2qYJ14ub07jRf8YNLbIaih M9OmVcAFgGjNshLsfMmIG4sJXYf+xPVCMLuv0= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=a4mv3CX5gtAvBGKnmAgdVfBbS+bjuaYuEHlpManO9ok=; b=Tvr8rCqlOu9rfVO+6u55DQpxA0ey6/EAVXBtQjAKA0b0m1rx2BDPaQAo5UmjMZh2cI B3MDV1eeXMNM9zrliCXrfp6U7ECarklcu6V08IVy5yI207rnSFETUJQvFJLAe5M/iUDX RTBWryRxAfOmu5tsy++0NwM2z/t+CeQ3Lco3w9myYcWAbTjEiBVCRlmI0Ax0cvyLo0hn 8qNF1ommt5qb7tQECauxDDJGf+7GLDSiLuuA56A3vI5NxVEtPAs6U2AinzvL7Ra+aBjL x19jLNxTYyLAMn4QkPQBvy+eYullrLLp9vQ2Ccvg2Pa7ZsP64yQH9y25+isHAyMjFnl9 fYnA== X-Gm-Message-State: ANoB5pmRxkcDhRpnoSiAEmu6Q2ophSMr+bMvm+KPD09Q+g1ujGY1il1K V0oB9oji+tFjvh7daKAfjxLdUQ== X-Google-Smtp-Source: AA0mqf5bontKGmSxfV5EPBb3DrrHk3pjZ7eyKPmqkUgTkAPEdzH7BqIzgkV0Ij3CWdMsMUqet+72Vg== X-Received: by 2002:a63:165d:0:b0:473:f7cd:6603 with SMTP id 29-20020a63165d000000b00473f7cd6603mr4329920pgw.336.1668728610990; Thu, 17 Nov 2022 15:43:30 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id ij27-20020a170902ab5b00b00188ea79fae0sm2006916plb.48.2022.11.17.15.43.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Nov 2022 15:43:29 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Marco Elver , Dmitry Vyukov , Ingo Molnar , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Mel Gorman , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , Andrew Morton , David Gow , tangmeng , Shuah Khan , Petr Mladek , "Paul E. McKenney" , Sebastian Andrzej Siewior , "Guilherme G. Piccoli" , Tiezhu Yang , kasan-dev@googlegroups.com, linux-mm@kvack.org, Luis Chamberlain , Seth Jenkins , Greg KH , Linus Torvalds , Andy Lutomirski , "Eric W. Biederman" , Arnd Bergmann , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v3 4/6] panic: Consolidate open-coded panic_on_warn checks Date: Thu, 17 Nov 2022 15:43:24 -0800 Message-Id: <20221117234328.594699-4-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221117233838.give.484-kees@kernel.org> References: <20221117233838.give.484-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5647; h=from:subject; bh=sxOIx5raY6nqpOG6YuXQYmflOUxoB4Lnr7UKuKqtC5Y=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjdscd2xOTxn5Fhuk9GHBu0+Cr2QXYwrSk2jHMMYhU hJUbffSJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY3bHHQAKCRCJcvTf3G3AJt2tEA CMAqhij2qsXL2q83Hi+yD1DUdHylf9XtJBUQ9nTL4LZpDtQlwpcXUruFfqc7cO9Qvcgf7Vcd3F9mq8 YnbF7Lw8McfpAWbrUALH/5lHVT6JR3HJ3wqRpcBjjC8j2fVbw+iFzXhufGOSOnI1FVtv3fSOS9wPws xiMYgUYWAvh1hpNRmS1mcy0EPLe4qocZLXb7qAnudPi8jy6RICKkPOoDN3zBnbY3D/4qq6bnoCm8tq MNu8W+hcuSpVh9UuUHw5yY898bSzCo3xS9SyHat8AagX5VORkdI7aB7n2Exm/p7ssIqoMhO4AfEKk1 z4hwroXVI9oMflHVHic//69Bu7Zvy29pGbqdYdssmz6H29qJhoRbU8xDIwVZ2xXJyj3qTtn6fjFKpd SW2d42wsi09rP/x1qiRySqimGVyM0tpM+iFhPXhaHfy+DWxNpdZY8M2qkPLX8D7byj+be1neeh4BPf CvWku0SS6YQDRkhMpQ9r1HlkkluJmJ9PhfLejqKgI+zdl8ihrsRJXRC255MhtnRYVCL+XtYYp4Tx0G qGmtZr8uDxv0TcU0eTgVsEw9ZIjcOAjRrkBaxVkFeqn1Uvfvyr+5jHAsqoaK+R2nov5FpdgxYxiYsZ nhr7fXddGhkxOEhViYRsnjF0kpB02cvImdzarQaeUlm8tOiOdy4EN7l3vHWA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Several run-time checkers (KASAN, UBSAN, KFENCE, KCSAN, sched) roll their own warnings, and each check "panic_on_warn". Consolidate this into a single function so that future instrumentation can be added in a single location. Cc: Marco Elver Cc: Dmitry Vyukov Cc: Ingo Molnar Cc: Peter Zijlstra Cc: Juri Lelli Cc: Vincent Guittot Cc: Dietmar Eggemann Cc: Steven Rostedt Cc: Ben Segall Cc: Mel Gorman Cc: Daniel Bristot de Oliveira Cc: Valentin Schneider Cc: Andrey Ryabinin Cc: Alexander Potapenko Cc: Andrey Konovalov Cc: Vincenzo Frascino Cc: Andrew Morton Cc: David Gow Cc: tangmeng Cc: Jann Horn Cc: Shuah Khan Cc: Petr Mladek Cc: "Paul E. McKenney" Cc: Sebastian Andrzej Siewior Cc: "Guilherme G. Piccoli" Cc: Tiezhu Yang Cc: kasan-dev@googlegroups.com Cc: linux-mm@kvack.org Reviewed-by: Luis Chamberlain Signed-off-by: Kees Cook Reviewed-by: Marco Elver Reviewed-by: Andrey Konovalov --- include/linux/panic.h | 1 + kernel/kcsan/report.c | 3 +-- kernel/panic.c | 9 +++++++-- kernel/sched/core.c | 3 +-- lib/ubsan.c | 3 +-- mm/kasan/report.c | 4 ++-- mm/kfence/report.c | 3 +-- 7 files changed, 14 insertions(+), 12 deletions(-) diff --git a/include/linux/panic.h b/include/linux/panic.h index c7759b3f2045..979b776e3bcb 100644 --- a/include/linux/panic.h +++ b/include/linux/panic.h @@ -11,6 +11,7 @@ extern long (*panic_blink)(int state); __printf(1, 2) void panic(const char *fmt, ...) __noreturn __cold; void nmi_panic(struct pt_regs *regs, const char *msg); +void check_panic_on_warn(const char *origin); extern void oops_enter(void); extern void oops_exit(void); extern bool oops_may_print(void); diff --git a/kernel/kcsan/report.c b/kernel/kcsan/report.c index 67794404042a..e95ce7d7a76e 100644 --- a/kernel/kcsan/report.c +++ b/kernel/kcsan/report.c @@ -492,8 +492,7 @@ static void print_report(enum kcsan_value_change value_change, dump_stack_print_info(KERN_DEFAULT); pr_err("==================================================================\n"); - if (panic_on_warn) - panic("panic_on_warn set ...\n"); + check_panic_on_warn("KCSAN"); } static void release_report(unsigned long *flags, struct other_info *other_info) diff --git a/kernel/panic.c b/kernel/panic.c index d843d036651e..cfa354322d5f 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -201,6 +201,12 @@ static void panic_print_sys_info(bool console_flush) ftrace_dump(DUMP_ALL); } +void check_panic_on_warn(const char *origin) +{ + if (panic_on_warn) + panic("%s: panic_on_warn set ...\n", origin); +} + /** * panic - halt the system * @fmt: The text string to print @@ -619,8 +625,7 @@ void __warn(const char *file, int line, void *caller, unsigned taint, if (regs) show_regs(regs); - if (panic_on_warn) - panic("panic_on_warn set ...\n"); + check_panic_on_warn("kernel"); if (!regs) dump_stack(); diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 5800b0623ff3..285ef8821b4f 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -5729,8 +5729,7 @@ static noinline void __schedule_bug(struct task_struct *prev) pr_err("Preemption disabled at:"); print_ip_sym(KERN_ERR, preempt_disable_ip); } - if (panic_on_warn) - panic("scheduling while atomic\n"); + check_panic_on_warn("scheduling while atomic"); dump_stack(); add_taint(TAINT_WARN, LOCKDEP_STILL_OK); diff --git a/lib/ubsan.c b/lib/ubsan.c index 36bd75e33426..60c7099857a0 100644 --- a/lib/ubsan.c +++ b/lib/ubsan.c @@ -154,8 +154,7 @@ static void ubsan_epilogue(void) current->in_ubsan--; - if (panic_on_warn) - panic("panic_on_warn set ...\n"); + check_panic_on_warn("UBSAN"); } void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs) diff --git a/mm/kasan/report.c b/mm/kasan/report.c index df3602062bfd..cc98dfdd3ed2 100644 --- a/mm/kasan/report.c +++ b/mm/kasan/report.c @@ -164,8 +164,8 @@ static void end_report(unsigned long *flags, void *addr) (unsigned long)addr); pr_err("==================================================================\n"); spin_unlock_irqrestore(&report_lock, *flags); - if (panic_on_warn && !test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) - panic("panic_on_warn set ...\n"); + if (!test_bit(KASAN_BIT_MULTI_SHOT, &kasan_flags)) + check_panic_on_warn("KASAN"); if (kasan_arg_fault == KASAN_ARG_FAULT_PANIC) panic("kasan.fault=panic set ...\n"); add_taint(TAINT_BAD_PAGE, LOCKDEP_NOW_UNRELIABLE); diff --git a/mm/kfence/report.c b/mm/kfence/report.c index 7e496856c2eb..110c27ca597d 100644 --- a/mm/kfence/report.c +++ b/mm/kfence/report.c @@ -268,8 +268,7 @@ void kfence_report_error(unsigned long address, bool is_write, struct pt_regs *r lockdep_on(); - if (panic_on_warn) - panic("panic_on_warn set ...\n"); + check_panic_on_warn("KFENCE"); /* We encountered a memory safety error, taint the kernel! */ add_taint(TAINT_BAD_PAGE, LOCKDEP_STILL_OK); From patchwork Thu Nov 17 23:43:25 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13047490 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DEADC4332F for ; Thu, 17 Nov 2022 23:43:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231570AbiKQXnn (ORCPT ); Thu, 17 Nov 2022 18:43:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47148 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240099AbiKQXng (ORCPT ); Thu, 17 Nov 2022 18:43:36 -0500 Received: from mail-pf1-x431.google.com (mail-pf1-x431.google.com [IPv6:2607:f8b0:4864:20::431]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74777B49F for ; Thu, 17 Nov 2022 15:43:32 -0800 (PST) Received: by mail-pf1-x431.google.com with SMTP id 140so3294816pfz.6 for ; Thu, 17 Nov 2022 15:43:32 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=xfJil3q4xneaphG+dBltmhf3iJIzvXDIW+JWkiHPnUY=; b=EIZNUa8F4WGrYp2tv1yKcZu0GTfzafGhT2L2DQkMVoO4piZ/rKuOgsgZvDgSG/Igd1 wdittd188cOqUku2QHG/wUBisTrq6vaHN9O6aNHqdPFeMwEYWiC4fNriciImpLYtTrqb 4kg2geAt6OwKUf+9fH/CfZXCZKRQplGj1+3eU= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=xfJil3q4xneaphG+dBltmhf3iJIzvXDIW+JWkiHPnUY=; b=23C5IXMTzWxHSLhPO6iRsHPEsxHMMyEUPPL8MKhc/i5ixJKmdL0HhLremJzSArbVw3 dXBOa+Zc196mZEYqFhFppPRzZSYU+Hq969X95KlTP50KVgvSsB5/6sFCGJchmA4fF879 blz7o7adBUYLnirinRAEIZErRSAjtCep+TXZvhHe4jK267gAs6n8t26kOU9GP8rXiKzK 7AFM1QoYemWK5Ij1nx7LQl3U6ZN1csIuUztuj/Iw8bpcQBdUBbDlUYEGSCwV5EefXgkq arydxAAduW9CMZlZlqwcMVqU+tGI/tD120MqjxU3WfHqxAfenlVfa++r5i5dGGfyWdnK XjbQ== X-Gm-Message-State: ANoB5plJqc78UbmfMG8np0YEyIeD6BOdp8TfCMjedqLf12yTJm4z+qK5 G1FDZo2JTKxyW+dSEZPDLA6Puw== X-Google-Smtp-Source: AA0mqf5RO0ohseJml0kMyZM8RW9bK2+ylkMpWRDRMToNKb5PFD/LTCbb2FYz53AgDtfV+G084ldgog== X-Received: by 2002:a63:114b:0:b0:46a:e00b:ada0 with SMTP id 11-20020a63114b000000b0046ae00bada0mr4211444pgr.409.1668728611983; Thu, 17 Nov 2022 15:43:31 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id h72-20020a62834b000000b0056bd1bf4243sm1738916pfe.53.2022.11.17.15.43.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Nov 2022 15:43:31 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Jonathan Corbet , Andrew Morton , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Petr Mladek , tangmeng , "Guilherme G. Piccoli" , Tiezhu Yang , Sebastian Andrzej Siewior , linux-doc@vger.kernel.org, Luis Chamberlain , Seth Jenkins , Greg KH , Linus Torvalds , Andy Lutomirski , "Eric W. Biederman" , Arnd Bergmann , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , David Gow , "Paul E. McKenney" , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-hardening@vger.kernel.org Subject: [PATCH v3 5/6] panic: Introduce warn_limit Date: Thu, 17 Nov 2022 15:43:25 -0800 Message-Id: <20221117234328.594699-5-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221117233838.give.484-kees@kernel.org> References: <20221117233838.give.484-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2740; h=from:subject; bh=UAp3/gSn5HSib4EzfW5wRRKF+FGTDjoMEFBYjvCvDcw=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjdscd1GA/3PLtD3N4H7SsA34PTW3nka1IngIvEXYO EYIpEOyJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY3bHHQAKCRCJcvTf3G3AJvptEA CdGFz8DSNbF4RMjKrrJk88mEDkxWYDqPKgqX4mCBz5IHyHLYf59wVt93MA2s9+Y5dISuBzWnk9orB4 qfArFrJPEPZY2IBBUlcPeCEho6xpwbHRntreRWX2Sn3lBbclKlgm+lVQ4FTgRavIV0cJjI0qMAutZF FAOyJnKFEYiRADA34tk5jIW4ubWsNHHNSG3AjwA0jb9PVui0Wy9LqrbJj0EJD9bkuR/7WGPavbMUEg ntUcsuYQDfvqUgW6Ywm+NK7jv4NozevnPZ7AVR7JCAdexGnbZsuZSeeal58/st/wu+XrpcUVhLcQ5q 8dapczcaRwqnG01Y1bbClamjnwPLMwL60GNMluInTigO4LEXvrEh9pUIjhTIXeIq9QAqDRxjifFRMu bCTr8sX6wOsDtkOizBKxqRBSgCsNFG4CFJbDcxGi5ZJNmOeFwyaJxfQbAWOUq+JZUKZ5FA51HfTDoN 4WjzLeqQ1jqeVDmfPJ0NgZD1rNVWBPpEPRaOmkukaDQyyOeA5Fbh7vfLGUGFMgs3m3NngBdna8YG19 Bv6YBosdV/NmTETybYC0gITxiJPHbKV1dx0B+ZNAbQ9wm1FfG+41bCdpnicHfdZwQGkISK1KSkk6cP 1VQADkQ9vKmG7cMXRQDydqjmg7PmKftmrXjELJoAwbLHqmZ85HDIfmjxDQKg== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Like oops_limit, add warn_limit for limiting the number of warnings when panic_on_warn is not set. Cc: Jonathan Corbet Cc: Andrew Morton Cc: Baolin Wang Cc: "Jason A. Donenfeld" Cc: Eric Biggers Cc: Huang Ying Cc: Petr Mladek Cc: tangmeng Cc: "Guilherme G. Piccoli" Cc: Tiezhu Yang Cc: Sebastian Andrzej Siewior Cc: linux-doc@vger.kernel.org Reviewed-by: Luis Chamberlain Signed-off-by: Kees Cook --- Documentation/admin-guide/sysctl/kernel.rst | 9 +++++++++ kernel/panic.c | 14 ++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/Documentation/admin-guide/sysctl/kernel.rst b/Documentation/admin-guide/sysctl/kernel.rst index 09f3fb2f8585..c385d5319cdf 100644 --- a/Documentation/admin-guide/sysctl/kernel.rst +++ b/Documentation/admin-guide/sysctl/kernel.rst @@ -1508,6 +1508,15 @@ entry will default to 2 instead of 0. 2 Unprivileged calls to ``bpf()`` are disabled = ============================================================= + +warn_limit +========== + +Number of kernel warnings after which the kernel should panic when +``panic_on_warn`` is not set. Setting this to 0 or 1 has the same effect +as setting ``panic_on_warn=1``. + + watchdog ======== diff --git a/kernel/panic.c b/kernel/panic.c index cfa354322d5f..e5aab27496d7 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -58,6 +58,7 @@ bool crash_kexec_post_notifiers; int panic_on_warn __read_mostly; unsigned long panic_on_taint; bool panic_on_taint_nousertaint = false; +static unsigned int warn_limit __read_mostly = 10000; int panic_timeout = CONFIG_PANIC_TIMEOUT; EXPORT_SYMBOL_GPL(panic_timeout); @@ -88,6 +89,13 @@ static struct ctl_table kern_panic_table[] = { .extra2 = SYSCTL_ONE, }, #endif + { + .procname = "warn_limit", + .data = &warn_limit, + .maxlen = sizeof(warn_limit), + .mode = 0644, + .proc_handler = proc_douintvec, + }, { } }; @@ -203,8 +211,14 @@ static void panic_print_sys_info(bool console_flush) void check_panic_on_warn(const char *origin) { + static atomic_t warn_count = ATOMIC_INIT(0); + if (panic_on_warn) panic("%s: panic_on_warn set ...\n", origin); + + if (atomic_inc_return(&warn_count) >= READ_ONCE(warn_limit)) + panic("%s: system warned too often (kernel.warn_limit is %d)", + warn_limit); } /** From patchwork Thu Nov 17 23:43:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13047489 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 495D0C43217 for ; Thu, 17 Nov 2022 23:43:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240377AbiKQXnm (ORCPT ); Thu, 17 Nov 2022 18:43:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47096 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231570AbiKQXnh (ORCPT ); Thu, 17 Nov 2022 18:43:37 -0500 Received: from mail-pj1-x102e.google.com (mail-pj1-x102e.google.com [IPv6:2607:f8b0:4864:20::102e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 06543B7C5 for ; Thu, 17 Nov 2022 15:43:33 -0800 (PST) Received: by mail-pj1-x102e.google.com with SMTP id e7-20020a17090a77c700b00216928a3917so6785033pjs.4 for ; Thu, 17 Nov 2022 15:43:33 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=LPxyAZmVFIQ+hzeHNDklOMYnt0nT5zaSRXR3AKVl0no=; b=CAnKSUlMijYM3oVNjTZMp+QYoCaxz54Tvn3HQZid0a5tCbxs2wTS7qkaFFagJiUS4o vZ80dfmkV08AIKBz7/JDfnIUWIOQTe8o9D+UJybk1RQ1IAtZ15Nt/LroPCWZXlTywlCK pEuPftQpieWwcSn3Zz3nK5otvgpihOgdX6Qyo= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=LPxyAZmVFIQ+hzeHNDklOMYnt0nT5zaSRXR3AKVl0no=; b=RVl/gwvDz2wk/EQUpUb/tmqRkCE+izk2O9pxnVXzUuJooK+d8nVHRvNW0Xh2glegSx eO6quep337qHt6b9IRzg0luYCxNYAyRlrUyUmiBV/ELv0o4wrv8+rXN7s89WmVvB86Ng Nt2k8m2zdmdsvTS56xs0j+KUhN+8pzU1VisJ1kAJZ6vjfpZJkMDoTZilCl4H2BoPRpSV 2Lc7kizT8YVEp/XXCckaDSHtzKpf6zd9Kn1qtI5OE5TF9qEFooSVf1f9i17+KctEDVZy 0Yw8SnF5nLQ0s4U3dX+eOvspQMXY4LQFClbRaIJLi2GVBOA8EnL68L4wMe+ZROyHGaPx R6BA== X-Gm-Message-State: ANoB5pnRqDy4k7NyztOeRJI7TM9tSnGsey50OhA1JTews8fdrW02YjiE dJGE4SsGFvzmJDMRHN0ikyC1pQ== X-Google-Smtp-Source: AA0mqf5/HPUPf8kTcojd23Y21MDR9j+2oe33EmCLeeB5s1/w+jLFfaLm0IoriYNIk05T+q106xmteQ== X-Received: by 2002:a17:90a:dd83:b0:218:61bd:d00d with SMTP id l3-20020a17090add8300b0021861bdd00dmr8381157pjv.236.1668728612350; Thu, 17 Nov 2022 15:43:32 -0800 (PST) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id w184-20020a627bc1000000b0056bb99db338sm1763850pfc.175.2022.11.17.15.43.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Nov 2022 15:43:31 -0800 (PST) From: Kees Cook To: Jann Horn Cc: Kees Cook , Petr Mladek , Andrew Morton , tangmeng , "Guilherme G. Piccoli" , Sebastian Andrzej Siewior , Tiezhu Yang , Luis Chamberlain , Seth Jenkins , Greg KH , Linus Torvalds , Andy Lutomirski , "Eric W. Biederman" , Arnd Bergmann , Dmitry Vyukov , Peter Zijlstra , Juri Lelli , Vincent Guittot , Dietmar Eggemann , Steven Rostedt , Ben Segall , Daniel Bristot de Oliveira , Valentin Schneider , Andrey Ryabinin , Alexander Potapenko , Andrey Konovalov , Vincenzo Frascino , David Gow , "Paul E. McKenney" , Jonathan Corbet , Baolin Wang , "Jason A. Donenfeld" , Eric Biggers , Huang Ying , Anton Vorontsov , Mauro Carvalho Chehab , Laurent Dufour , Rob Herring , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com, linux-mm@kvack.org, linux-doc@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH v3 6/6] panic: Expose "warn_count" to sysfs Date: Thu, 17 Nov 2022 15:43:26 -0800 Message-Id: <20221117234328.594699-6-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20221117233838.give.484-kees@kernel.org> References: <20221117233838.give.484-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3097; h=from:subject; bh=D2z//ezLIcXAbCg09JRiGI8OFvfo+V6hl+TtnONC3LA=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjdsceSurFVH4Xz0byr7qjcNZv7p7TUAKJ01o1LaCS il+61kOJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY3bHHgAKCRCJcvTf3G3AJrZqD/ 0XXgpqckv3Sl3gOzRU8XGOhhTKNCgley3+PyzCJRtiQH47toEntYyvD9vFmODaSLhG1FiyD30a+PUs G7BgQa2k5SXXu1y/m/LEYrgI+Ka82BZRjN3oncSn6Gj1sGbXDiyXNgFu2e7l3f5j0GuuPciyXT5UaC Whh7g6SSpQlWFg6h1VXkWltmzGxJmgVINVIrm35KuAdSyHO3fh2FDZDFbYgC7Zw5VEZQWZGwFRZKlq fZ2NQCYYViH28pOLbjsQelxISmwyjMc+u8Si72QGiSXyQDGontB6hLEn6ri71jOmtQC2fi1PaCVFse OlWZA3mp10sfh98TdxKylYukslvpvusA+K5MQpXzq1tksDtB8jEjaCMbaiVfi0VDO+HWdplKdRZ2+e n0Us8b6qHL08DRQD/d5Iyo3nKHoDU7W22eM6TKwdRh1VOt5OxabohHDHQQAQSKLRmVdRuK4voUVG2z WTiHCwgHCUaqjBbTFhP0qQEkOrInX+5FbG+pTGdqZYZkv2f092vx6VJEu8Z8BO3LF5bC2BFaiheOTK xh8e8bMHCJ2MM9mzid34rIfE7sSTbJVFhVblpoFmXm9S5J9GpgTITDTaHoCWUeeMuoxo3kOaCKuojk rVwdTZGGHPl+RyJg5fYfmDe+KCV0g0DLqAai97luhkgJ180YHwMEsAH3AtwQ== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Since Warn count is now tracked and is a fairly interesting signal, add the entry /sys/kernel/warn_count to expose it to userspace. Cc: Petr Mladek Cc: Andrew Morton Cc: tangmeng Cc: "Guilherme G. Piccoli" Cc: Sebastian Andrzej Siewior Cc: Tiezhu Yang Reviewed-by: Luis Chamberlain Signed-off-by: Kees Cook --- .../ABI/testing/sysfs-kernel-warn_count | 6 +++++ MAINTAINERS | 1 + kernel/panic.c | 22 +++++++++++++++++-- 3 files changed, 27 insertions(+), 2 deletions(-) create mode 100644 Documentation/ABI/testing/sysfs-kernel-warn_count diff --git a/Documentation/ABI/testing/sysfs-kernel-warn_count b/Documentation/ABI/testing/sysfs-kernel-warn_count new file mode 100644 index 000000000000..08f083d2fd51 --- /dev/null +++ b/Documentation/ABI/testing/sysfs-kernel-warn_count @@ -0,0 +1,6 @@ +What: /sys/kernel/oops_count +Date: November 2022 +KernelVersion: 6.2.0 +Contact: Linux Kernel Hardening List +Description: + Shows how many times the system has Warned since last boot. diff --git a/MAINTAINERS b/MAINTAINERS index 0a1e95a58e54..282cd8a513fd 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -11107,6 +11107,7 @@ L: linux-hardening@vger.kernel.org S: Supported T: git git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening F: Documentation/ABI/testing/sysfs-kernel-oops_count +F: Documentation/ABI/testing/sysfs-kernel-warn_count F: include/linux/overflow.h F: include/linux/randomize_kstack.h F: mm/usercopy.c diff --git a/kernel/panic.c b/kernel/panic.c index e5aab27496d7..d718531d8bf4 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -32,6 +32,7 @@ #include #include #include +#include #include #include @@ -107,6 +108,25 @@ static __init int kernel_panic_sysctls_init(void) late_initcall(kernel_panic_sysctls_init); #endif +static atomic_t warn_count = ATOMIC_INIT(0); + +#ifdef CONFIG_SYSFS +static ssize_t warn_count_show(struct kobject *kobj, struct kobj_attribute *attr, + char *page) +{ + return sysfs_emit(page, "%d\n", atomic_read(&warn_count)); +} + +static struct kobj_attribute warn_count_attr = __ATTR_RO(warn_count); + +static __init int kernel_panic_sysfs_init(void) +{ + sysfs_add_file_to_group(kernel_kobj, &warn_count_attr.attr, NULL); + return 0; +} +late_initcall(kernel_panic_sysfs_init); +#endif + static long no_blink(int state) { return 0; @@ -211,8 +231,6 @@ static void panic_print_sys_info(bool console_flush) void check_panic_on_warn(const char *origin) { - static atomic_t warn_count = ATOMIC_INIT(0); - if (panic_on_warn) panic("%s: panic_on_warn set ...\n", origin);